Resolving WinCC RT Professional Client Script Tag Write Errors

Problem Overview

Engineers deploying Siemens WinCC Runtime Professional on a distributed Server/Client topology in TIA Portal v17 (and matching versions v18, v19, v20) frequently observe the following failure pattern:

• A C script that calls GetTagChar() and SetTag() executes correctly on the Runtime Server.
• The same script on a Runtime Client succeeds for a small subset of tag writes and silently fails for the majority.
• No compiler errors are reported when the script is generated in the engineering station.
• No application-level exception is raised; the script simply does not deliver the value to the PLC.

This is a classic intermittent failure mode caused by differences in script execution context, tag binding, and client-server session handling. Sporadic tag write failures of this kind are not a defect in the script source code; they are a configuration or environment issue at the client runtime layer.

Affected Environment and Versions

Root Cause Analysis

The sporadic behavior is rarely a single defect. It is usually the combination of several root causes ranked by frequency in field reports:

1. Missing or stale client project on the target computer. The Runtime Client loads the project from a configured server share or from a local copy. If the local project is older than the server, the tag references used by the script may no longer exist on the PLC, so SetTag() writes to a tag that points to the wrong address, or to a tag that was renamed on the server side.
2. Client launch mode not set to "Client with its own project." If the client is started in the wrong mode (e.g., server mode by accident, or as a WebNavigator client when a native client is required), the script runtime environment differs from the documented server behavior.
3. WebNavigator-specific restrictions on user-defined functions. According to the official TIA Portal WinCC documentation, "user-defined functions may contain unsupported functions and in this case cannot run on the WebNavigator client." This applies to both C and VB scripts that call into user DLLs, COM components, or unsupported ODK APIs.
4. Tag update direction / write permission mismatch. Tag objects in the HMI tags editor may have the Acquisition mode set to "On demand" with read-only access, or the Write permission may require an active user login on the client. Unauthenticated client sessions silently drop the write.
5. Asynchronous execution timing on the client. The script engine on the client schedules scripts on the same dispatch loop as graphics rendering. If the script is fired in a screen-object event (e.g., OnClick), the underlying tag value may not have completed the round-trip to the server before the next SetTag() call. The server, with less load, masks this race condition.
6. Display script errors disabled. By default, the Runtime Client suppresses runtime script errors. The script appears to "succeed" when in fact an internal call has been swallowed.

Reference: Using Scripts (RT Professional) - WinCC.

Diagnostic Procedure

Run the following checks in order. Each step produces a verifiable output, so do not skip ahead.

Step 1 – Enable script error display on the client

On the Runtime Client computer, open the WinCC RT start application. Navigate to the runtime configuration and enable "Display script errors". Restart the runtime so the change is loaded. Reproduce the failure. Any C script runtime exception (HRESULT failure, NULL pointer, unsupported API call) will now be reported in a message box and written to the diagnostic log.

Step 2 – Compare project files on server and client

On the server, locate the active runtime project directory (default: C:\Program Files\Siemens\Automation\WinCC RT Professional\Projects\<ProjectName>\). On the client, compare the locally loaded project. The most reliable check is a hash comparison of the *.db archive and the ConfigurationFiles folder. Any mismatch means the client is running a stale project.

Step 3 – Inspect WinCC_Sys log files

Open the WinCC diagnose folder on the client:

Filter for the time window when the script fired. Look for entries such as SCADA_PB: tag write denied, Authentication required, Tag not found in address space, or Script engine: HRESULT 0x80070005. The HRESULT 0x80070005 (E_ACCESSDENIED) is a direct match for tag write permission issues.

Step 4 – Confirm connection path on the client

In the client project, verify that the HMI connection to the PLC is set to "Always" rather than "On demand" for the tags touched by the script. "On demand" tags are only resolved when the HMI screen is loaded, which can lead to SetTag() returning without writing if the connection is currently suspended.

Step 5 – Validate tag quality codes

From the engineering station, in the script, add a temporary diagnostic line that calls GetTagQuality() for each tag touched. Quality codes such as 0x0000001C (Bad_OutOfService), 0x00000014 (Bad_DeviceNotConnected), or 0x00000040 (Bad_NotInitialized) explain exactly why SetTag() failed without raising an exception.

Solution

The fix is procedural, not a code rewrite. Apply the following actions:

1. Re-deploy the project to the client. From the engineering station, use Compile > Software (rebuild all), then transfer the complete runtime project to the client. Do not transfer only the HMI tags file; the script compilation output and configuration files must match the server version.
2. Configure the client launch mode. On the client machine, in WinCC RT start, set the project mode to "Client with its own project" and enter the server's project path. Tick the option "Server project on remote computer" if the project is loaded over the network.
3. Switch to VB Script or consolidate writes. The original suggestion from the field — using VB Script for simple read/write operations — has merit: VB Script on the client tends to surface errors more clearly. For multi-tag writes, the recommended pattern is to bind the tags to a screen or to a script-side buffer and write once, instead of issuing sequential SetTag() calls inside a tight loop.
4. Enable write permission on the target tags. In the engineering station, open HMI tags > <TagName> > Properties > Properties > Write permission and ensure the tag accepts writes from any user, or that the script runs in a context where a valid user is logged in.
5. Add explicit synchronization. If the C script fires from a screen event, use SetTagWait() instead of SetTag() for the critical write, or wrap the multi-tag write in a single VB Script call that the C script invokes via HMIRuntime.Screens("Screen_1").ScreenItems("Button_1").Click() or a direct PDLRT.SetTagValue call through the ODK.
6. Avoid unsupported APIs in user-defined functions. Per the official documentation, user-defined functions in C or VB that call Win32 APIs, external COM objects, or ODK functions not whitelisted for the client will silently fail on a WebNavigator client. Refactor these into VB global modules and use only HMIRuntime.Tags and HMIRuntime.Screens objects.

Reference: Differences to the WinCC Basic System – Using Scripts (RT Professional).

Verification

After the corrective actions, perform the following to confirm the fix is stable:

1. Click the button on the Runtime Client that triggers the script. Repeat the action 20 times in a row. All tag writes should succeed.
2. Read the tags back from the PLC with the engineering client's online view. Values must match the expected script output for every iteration.
3. Close and re-open the Runtime Client, then repeat the test. A correct deployment survives a client restart.
4. Reboot the client computer. Repeat the test. This catches cases where the project was loaded from a temporary cache.
5. Inspect WinCC_Sys and WinCC_RT logs for the entire test window. No script error entries should be present.

Workarounds for Constrained Environments

If the project cannot be redeployed immediately, the following workarounds reduce the symptom but do not replace the corrective actions above.

Best Practices for Distributed WinCC RT Professional Systems

• Single source of truth. Always deploy the runtime project from the engineering station to the server, then propagate to clients. Do not edit the runtime project directly on the server or the client.
• Versioned project archives. Use TIA Portal's project versioning (introduced in V17) to track which client received which build. A failed write on a client running build N−1 against a server on build N is a configuration drift issue, not a script bug.
• Centralized logging. Forward WinCC_Sys logs to a SIEM or a network share. The default C:\ProgramData\Siemens\Automation\Logfiles\ path is local; in a distributed system, this hides client-side errors from the engineer sitting at the server.
• Default deny on write permission. Configure tags to require an authenticated write. This makes a missing login visible (the tag value is unchanged) instead of silently dropping the write.
• Test on the slowest expected client. Race conditions in script execution scale with the client CPU load. A test that passes on a development workstation may fail on a thin client in the field.
• Use SetTagWait() only when blocking is acceptable. The blocking variant can hold the client UI thread for up to 5 seconds (default timeout). In a fast click sequence, this introduces its own race condition.

Troubleshooting Matrix

FAQ