Resolving WinCC V13 SP1 Faceplate Crash When Editing Process Tags

Resolving WinCC V13 SP1 Faceplate Crash When Editing Process Tags

TIA Portal V13 SP1 Update 1 ships with a known defect that causes the engineering environment to hang and crash when a faceplate type interface is modified, when process tags are added to a faceplate, or when a User-Defined Data Type (UDT) already in use inside a faceplate is extended by inserting new members in the middle of the type definition. This reference compiles the reproducible crash patterns, the architectural root cause, Siemens-published fixes, and field-engineer workarounds that restore editing capability without rolling the entire project back to a previous software version.

1. Problem Summary

Faceplates in TIA Portal WinCC are reusable visualization objects, defined once as a faceplate type and instantiated as faceplate instances across screens. A faceplate type carries:

• A faceplate interface made of interface tags (input, output, in/out).
• Property scripts that bind the interface tags to the visual elements on the faceplate canvas.
• Events triggered by user interaction or by tag value changes.
• Versioning metadata (released version vs. work-state version).

When a faceplate type is referenced from one or more screens, the project database stores an association between the faceplate type, the interface definition, and the tags wired to each instance. In V13 SP1 Update 1 this association is not always rebuilt correctly when the interface changes, which produces the crashes reported in the field. The defective behavior covers the following user actions:

The crash pattern is reproducible across multiple engineering workstations (the issue is not workstation-specific) and persists after a clean uninstall / reinstall of WinCC Comfort and WinCC Runtime. The defect is therefore a project-database migration bug introduced by the V13 SP1 Update 1 patch level, not an installation corruption.

2. Affected Software and Hardware

3. Root Cause Analysis

The V13 SP1 Update 1 patch introduced a redesigned faceplate type storage model to align with the new PLC UDT handling available in SP1. With V13 SP1, WinCC can consume PLC data types directly, eliminating duplicate declarations between the HMI and the PLC. The integration carries the following structural consequences:

1. Coupled type metadata. Each faceplate instance now carries a snapshot of the UDT it references, not just a tag-level reference. The project database therefore stores two coupled structures: the faceplate interface and the UDT shape.
2. Recompute on every interface change. When a process tag is added to the faceplate interface, or when the bound UDT is mutated, the engine must rebuild the snapshot stored in every instance. In V13 SP1 Update 1 the rebuild path contains a null-pointer access for faceplate instances whose cached snapshot was created under the pre-SP1 format.
3. Mid-array insertion in UDT. Inserting a new tag in the middle of a UDT (rather than appending) causes a member-index shift that the faceplate snapshot does not re-index, producing a mismatch that triggers the same null-pointer access.

The 32-bit Windows application then enters a faulted state in the TIA_Portal.exe process, surfaces the standard Siemens error dialog, and exits with a non-zero return code (typically a structured exception 0xC0000005 access violation logged in the Windows Application event log under Application Error with faulting module TIA_Portal.exe).

Siemens technical support confirmed in the affected case that the supplied project could be opened on their reference engineering system; this strongly indicates a project-state migration regression rather than a per-installation corruption. The project database recovered and recompiled by Siemens support still exhibited the same crash on the customer machine, which is consistent with the customer-side installation being on the defective V13 SP1 Update 1 patch level.

4. Pre-Upgrade Checklist

Before applying any patch or executing any workaround, capture a complete backup of the affected project. The faceplate crash can leave the project in an inconsistent state on disk; an unmodified archive is required for rollback.

1. Open the affected project in TIA Portal and select Project > Archive. Store the .zap13 archive on a network share or external drive, not on the local PC drive.
2. Export the WinCC HMI compilation log: Project tree > Devices & Networks > right-click HMI device > Compile > Software (rebuild all) and save the .log file.
3. Capture the installed software level from Help > Installed software and record the exact build numbers of: STEP 7, WinCC, Startdrive (if present), PLCSIM, and all add-on packages.
4. Capture a Windows event snapshot: eventvwr.msc → Windows Logs → Application → Filter for Application Error with TIA_Portal.exe in the last 24 h.
5. List every faceplate type used in the project with its current released version and any work-state version. Note which faceplates consume UDTs vs. simple elementary types.
6. List every UDT and the faceplate / DB / tag table that consumes it. Tag the UDTs that were modified mid-array.

5. Solution Path A – Upgrade to V13 SP1 Update 3

Field reports indicate that V13 SP1 Update 3 resolves the faceplate interface editing crash when applied to a clean installation. Update 2 is a partial fix; engineers who experienced only faceplate-event loss (without crash) often had their issue resolved by Update 2, but the mid-array UDT and process-tag-add crash remained.

5.1 Update sequence

1. Open Help > Installed software in TIA Portal and note the build numbers.
2. Download the V13 SP1 Update 3 package (article ID 109311724 from Siemens Industry Online Support).
3. Close TIA Portal and stop the S7TraceService, CCDisplayService, and the SIMATIC automation license manager service.
4. Run the Update 3 installer with administrator rights. Do not run the engineering environment in parallel.
5. Reboot the workstation before re-opening the project. TIA Portal V13 patch installers replace shared DLLs used by both WinCC and STEP 7; mixed patch levels are a documented source of secondary instability.
6. Update every other installed Siemens software package to the latest available SP / Update level on the same workstation. Mixed patch levels across the STEP 7 / WinCC / Startdrive stack have been observed to reintroduce faceplate crashes even after the primary fix.
7. Open the project, compile the HMI software (rebuild all), and verify the faceplate type can be opened in the editor without crash.

6. Solution Path B – Apply the Interface Reconstruction Workaround (No Update)

If a workstation patch cannot be applied immediately (for example, due to a frozen project baseline or a restricted maintenance window), the following manual workaround has been verified in the field to restore editing capability on V13 SP1 Update 1 without changing the software level. It is destructive to faceplate events and property-script wiring inside the faceplate type only; instance connections on the screens are not lost permanently and must be re-bound.

6.1 Procedure

1. Close every faceplate type in the project and confirm none are in an unsaved work state.
2. Open the first affected faceplate type in the editor.
3. In the Properties tab under Events, select every configured event. Delete all events on the faceplate type. Save the faceplate type.
4. Delete any work-state version of the faceplate type through the project navigator (right-click the faceplate type → Version history → delete work-state version). If this action crashes the engineering client, restart TIA Portal and proceed with step 5.
5. Reopen the faceplate type, recreate every event with the original event name, and re-bind it to the original function / script.
6. Compile the faceplate type and check the Output window for warnings about orphaned references.
7. Open every screen that hosts an instance of this faceplate type. Select each instance and rebind the interface properties that were previously connected. The instance count and screen positions are preserved; only the wiring to interface tags must be re-established.
8. Repeat steps 2-7 for every faceplate type that references the modified UDT.
9. Compile the entire HMI station (rebuild all) and verify that no warning remains in the output window.

7. UDT Modification Best Practices

The crash is most reliably reproduced when a UDT that is already in use inside a faceplate is mutated. The following rules eliminate the most common crash trigger regardless of TIA Portal patch level:

7.1 Recommended UDT versioning workflow

1. Duplicate the UDT in the PLC data types editor and rename to <Name>_v<n>.
2. Update the new UDT definition in any order (insertions, deletions, renames are now safe).
3. Update the faceplate interface to bind against the new UDT version.
4. Rebind every instance to the new UDT version. Instances on the legacy UDT continue to operate until the swap is complete.
5. Compile and verify. Only after success, delete the legacy UDT and re-compile.

8. Faceplate Recovery Procedure After a Crash

When the engineering environment crashes mid-edit, the project database may retain an inconsistent work-state version of one or more faceplate types. Use the following procedure to restore a clean state before applying any fix.

1. Launch TIA Portal. Open the project. If TIA Portal opens the project without crash, proceed.
2. Locate the affected faceplate type in the project navigator. Right-click and select Version history.
3. If a work-state version is listed, attempt to delete it. If the deletion crashes, the work-state version is corrupt; proceed to step 4.
4. Close TIA Portal. Navigate to the project directory and remove the work-state database cache: <project>\IM\HMI\<device>\Faceplates\<faceplate_type>\workstate. Back up the directory before deletion.
5. Re-open the project. The faceplate type reverts to the last released version. Re-create the work-state version manually.
6. Recompile the HMI station (rebuild all) and confirm zero errors and zero faceplate-related warnings.

9. Verification Tests

Run the following checks in order before declaring the issue resolved:

1. Reproduction guard. Add a process tag to a test faceplate interface. Engineering client must complete the action within 5 seconds without crash. Repeat for adding a new category.
2. Instance integrity. Open every screen containing a faceplate instance. Each instance must render without the placeholder "red X" error indicator.
3. UDT round-trip. Add a tag at the end of a UDT consumed by a faceplate. Recompile PLC and HMI. All faceplate instances must update without crash.
4. Archive round-trip. Archive the project to a network share. Confirm the archive completes and the file size is within 5% of a known-good baseline.
5. Cross-workstation load. Copy the project to a second engineering workstation. Open, compile, and confirm identical behavior. This validates that the fix is not machine-local.
6. Runtime simulation. Use the WinCC Runtime Simulator (Start → SIMATIC → WinCC → Runtime Loader) to render the screens containing the modified faceplates. All animations, colors, and events must trigger correctly.

10. Troubleshooting Matrix

11. Related Siemens References

• SIMATIC TIA Portal V13 SP1 Update 2 – Entry ID 109311724 – official Siemens update package; the first patch level that documents faceplate-type editor fixes.
• Editing a Faceplate Type (Panels, Comfort Panels, RT Advanced, RT Professional) – TIA Portal help; documents the released-version vs. work-state lifecycle used in the recovery procedure.
• TIA Portal Faceplates and Data Types – SiePortal forum – official Siemens community thread confirming V13 SP1 supports PLC data types directly in WinCC, removing duplicate type declarations.

12. FAQ