Resolving WinCC Flexible 2007 StackOverflowException on Mouse

Problem Description

Engineers running Siemens WinCC Flexible 2007 Advanced (engineering tool, process name hmies.exe, component version 102.0.0.0) experience an immediate application crash when the mouse scroll wheel is rotated inside the Screen Editor (Graphics Designer) workspace. The crash reproduces in both the HMI device screen editor and any project window containing zoomable graphical objects.

The Windows event log records a CLR 2.0 runtime exception with the following fingerprint:

EventType : clr20r3
P1        : hmies.exe
P2        : 102.0.0.0
P3        : 469fc4c2
P4        : graphx.interfacesui
P5        : 102.0.0.0
P6        : 469fc1b8
P7        : 3b8          (offset of failing IL instruction)
P8        : 0            (HRESULT line)
P9        : System.StackOverflowException

Signature interpretation:

Affected Versions and Platforms

The defect is reproducible on the following configurations:

• WinCC Flexible 2007 Advanced SP2, SP3, SP4 (component version 102.0.0.0 through 102.0.0.3)
• WinCC Flexible 2007 Standard SP2 (same graphx.interfacesui assembly, separate distribution media)
• Hosts: Windows XP SP3, Windows Vista Business, Windows 7 Professional 32-bit and 64-bit
• Mouse hardware: Multiple vendors confirmed (Logitech, Microsoft, native PS/2 wheel mice, USB HID-class wheels). Hardware and driver are not the trigger.

The defect is not present in WinCC Flexible 2005 (component version 101.0.0.0) and was eliminated in WinCC Flexible 2008 SP2 and later where the graphical editor was rewritten around a newer Vector Graphics runtime. Migration to WinCC Comfort/Professional in the TIA Portal resolves the issue.

Root Cause Analysis

The graphx.interfacesui assembly registers a Windows Forms MouseWheel event handler on every zoomable canvas pane inside the Screen Editor. When the wheel event fires, the handler computes the new zoom factor and posts a Control.Invalidate(true) call to redraw the canvas. The drawing routine in turn re-evaluates object connectors, each of which raises a layout event that walks back into the original wheel handler if a connector is anchored to a hovered object.

Under certain canvas configurations - particularly screens that combine rotated polygons, dynamic SVGs, and connector-rich library instances - the layout event re-enters the wheel handler synchronously. Each pass allocates an additional stack frame, and after a few hundred to a few thousand re-entries the thread stack (default 1 MB on x86) is exhausted, raising System.StackOverflowException from IL offset 0x3B8 inside the layout-walk method.

Re-imaging the host, swapping the pointing device, or replacing the driver does not change the path of execution because the trigger is purely the editor's re-entrant layout walk, not the input device. This matches Siemens' internal reproduction with synthetic SendInput-generated wheel events in their support lab.

Diagnostic Procedure

1. Capture the event log entry before any clean-up. Open Control Panel > Administrative Tools > Event Viewer and export the most recent Application log entry with Event Source .NET Runtime 2.0 Error Reporting or Application Error. Confirm the signature matches clr20r3 / P1=hmies.exe / P9=System.StackOverflowException.
2. Verify the component version. Right-click C:\Program Files\Siemens\Automation\WinCC Flexible\WinCC Flexible 2007\hmies.exe (or the matching path under Program Files (x86)), choose Properties > Details, and note the File Version. It should be 102.0.0.0 through 102.0.0.3.
3. Verify the throwing assembly. Locate graphx.interfacesui.dll in the same directory and confirm its file version is identical to hmies.exe.
4. Reproduce deterministically. Open any project, double-click a screen to enter the Screen Editor, hover the cursor over the central canvas area (not over the toolbox or project tree), and rotate the wheel one click. The exception should fire within 1-3 wheel ticks.
5. Rule out environment causes. Disable any third-party mouse enhancement utilities (Logitech SetPoint, Microsoft IntelliPoint, Razer Synapse), reboot, and retry. If the crash persists, the environment is exonerated.

Immediate Workarounds (No Patch Required)

If a hotfix cannot be applied immediately, the following workarounds restore editing productivity:

Workaround 1 - Disable the Mouse Wheel in the Editor

1. Select Tools > Settings > Options > Graphical Editor in WinCC Flexible 2007.
2. Locate the Zoom with mouse wheel option (if exposed) and clear the check box.
3. If the toggle is absent, use the keyboard equivalents described below exclusively.

Workaround 2 - Use Keyboard Zoom Only

The Graphics Designer accepts these keyboard shortcuts for canvas zoom, none of which traverse the graphx.interfacesui wheel handler path:

Workaround 3 - Disable the Wheel Hardware-Side (Group Policy)

If the engineer is the only person touching the host, the wheel can be globally disabled with a registry edit:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Control Panel\Desktop\WheelScrollLines]
"WheelScrollLines"="0"

Log off and back on. The wheel becomes inert system-wide. Reverse by deleting the value and restoring "3".

Workaround 4 - Edit on a Host Without the Issue

If a spare Windows XP SP3 host with WinCC Flexible 2005 installed is available, the project can be edited there for emergency hot fixes. WinCC Flexible 2007 is backward-compatible with 2005 project files when opened with File > Open > Compatibility Mode.

Permanent Fix - Siemens Hotfix

Siemens released the correction as Hotfix 2 (and subsequent Hotfix 3) for WinCC Flexible 2007 Advanced. The hotfix replaces the graphx.interfacesui.dll with a build that breaks the synchronous layout-walk re-entry by deferring connector evaluation to a BeginInvoke on the UI thread message pump, so the call stack unwinds before the next layout pass runs.

1. Open a support case with Siemens Industry Online Support and reference this article's title plus your hmies.exe file version. Request Hotfix 3 for WinCC Flexible 2007 Advanced SPx - Mouse Wheel StackOverflow in graphx.interfacesui.
2. Alternatively, search the Siemens support portal using entry ID 24435650, which is the consolidated WinCC Flexible 2007 stability hotfix index. Download the package that lists graphx.interfacesui among the replaced assemblies.
3. Close WinCC Flexible 2007 and stop the CCAgent service: net stop "S7DOS Help Service" and net stop "CCAgent".
4. Back up C:\Program Files\Siemens\Automation\WinCC Flexible\WinCC Flexible 2007\graphx.interfacesui.dll to %TEMP%\graphx.interfacesui.bak.
5. Run the hotfix executable with administrative rights. It updates graphx.interfacesui.dll (and typically hmies.exe, wcfview.exe, and supporting grx_*.dll files) and registers the new assemblies in the WinCC Flex setup log.
6. Restart the host. Confirm via right-click > Properties > Details that the new graphx.interfacesui.dll carries the post-hotfix timestamp.
7. Re-open the project and reproduce the original action (hover canvas, rotate wheel). The handler should now zoom the view smoothly without terminating the process.

Long-Term Resolution - Migrate to TIA Portal WinCC

The architecture that produced the re-entrant layout walk was retired in WinCC Flexible 2008 SP2 and replaced wholesale in the TIA Portal WinCC Comfort / WinCC Professional editors. For projects that will be maintained past 2024, plan a migration:

Migrated projects are immune to the 2007-specific stack overflow because the editor framework in TIA Portal is built on WPF and .NET 4.x with async layout passes.

Verification

After applying the hotfix or workaround, run the following acceptance test:

1. Open the same project that previously crashed.
2. Enter the Screen Editor of any HMI device.
3. Hover over the canvas (avoid the toolbox and the project tree).
4. Rotate the wheel slowly - 10 clicks - then quickly - 10 clicks.
5. Scroll vertically with the keyboard Page Up / Page Down over the canvas to confirm pan still works.
6. Insert a connector between two objects and rotate the wheel while the connector is highlighted. The hotfixed editor must NOT re-enter and stack-overflow.
7. Clear C:\Users\<user>\AppData\Local\Temp\WinCC Flexible* and re-launch hmies.exe.
8. Inspect the Application event log: there must be no new clr20r3 entries with System.StackOverflowException.

Troubleshooting Matrix

Related Issues and Background

Several adjacent defects in WinCC Flexible 2007 have similar signatures and are worth recognising in the field:

• Compile-time StackOverflow with Event Source .NET Runtime and P4=mscorlib: a known bug when compiling projects that exceed 32,000 cross-references; resolved by Hotfix 2.
• Runtime StackOverflow in RT files at panel boot when cyclic pointer dereferences are present in the HMI tag hierarchy. See 22680018.
• Graphics Designer freezes (no exception) when dragging a SmartClient object onto the canvas with hardware acceleration enabled. Disabling Tools > Options > Display > Hardware acceleration is the workaround.
• COMException 80004005 on screen close when using the WinCC Flex Remote Runtime to view over RDP. Triggered by mismatched color depth, not the wheel handler.

Field Notes from Engineering Teams

Three engineers in one facility, on three different host platforms (Dell Precision M65 with native PS/2 wheel, HP EliteBook with USB Logitech, Lenovo ThinkPad with Synaptics touchpad driver emulating wheel), all reproduced the crash with identical signatures within minutes of opening the same distributed project. The common denominator was project content - a library with rotated polygons and connector-rich templates - not the host. This pattern is the most reliable field fingerprint for identifying the graphx.interfacesui defect versus environmental mouse driver issues.

A clean Windows 7 SP1 image with WinCC Flexible 2007 SP4 installed from DVD still reproduces the crash until Hotfix 3 is applied, confirming the defect is in the application code rather than the OS or device stack.

Summary of Corrective Actions

1. Diagnose via the clr20r3 event signature - confirm P9=System.StackOverflowException and P4=graphx.interfacesui.
2. Work around by using keyboard zoom (Ctrl +/-, Ctrl + 1, Ctrl + 0) or by disabling the wheel hardware-side.
3. Apply the Siemens hotfix from entry ID 24435650 or via Siemens customer support referencing the component version.
4. Verify using the acceptance test above; ensure no new clr20r3 entries appear in the event log.
5. Plan a migration to TIA Portal WinCC Comfort/Professional for long-term stability.