Siemens MP377 WinCE Shutdown: VBScript, API, and PLC Methods

Siemens MP377 WinCE Shutdown: VBScript, API, and PLC Methods

1. Overview: Why Controlled HMI Shutdown Matters

Industrial HMI panels such as the Siemens SIMATIC MP377 Multi Panel family are deployed in plants that run continuously for months or years. The Windows CE 5.0/6.0 image underneath these panels uses a hive-based registry (typically hdr.bin, flash.bin, or userdb) and a delayed-write file system that flushes dirty buffers on a multi-second cadence. An abrupt power removal between RegFlushKey cycles leaves the registry in an inconsistent state, which manifests as boot-loop reloads, a "RAM-based only" warning at boot, or missing project screens.

Three operational scenarios drive the requirement for a programmatic shutdown:

1. Planned maintenance - power down to replace components, service the UPS, or enter LOTO (Lockout/Tagout).
2. Sequenced plant shutdown - PLC-controlled shutdown is part of a coordinated E-stop or orderly line stop.
3. Remote panel reset - reboot an unreachable panel from the control room without a service visit.

The shutdown symbol in the Windows CE SDK, as documented at Microsoft Learn: shutdown (Windows CE 5.0), refers exclusively to socket shutdown semantics (disable send/receive on a connected socket), not OS system shutdown. Programmers searching "shutdown" on Windows CE frequently land on that socket page first; the correct OS-shutdown primitives are SetSystemPowerState, PowerOffSystem, and the Power Manager IOCTLs. Confusing the two is the most common source of "my panel does nothing" bug reports.

2. Siemens MP377 Hardware and OS Specifications

The MP377 is the 12"/15"/19" Multi Panel line released with WinCC flexible 2008 SP3 and later TIA Portal V13/V14. Confirm hardware configuration with the factory rating plate and Siemens order number (6AV6 ...) before choosing a shutdown method, because some derivatives ship with Windows CE 5.0 and others with Windows CE 6.0.

Confirm the installed OS at runtime before issuing any shutdown call. Read \Windows\win.ini or query the registry path HKEY_LOCAL_MACHINE\System\Version. The string value ProductName returns "Microsoft Windows CE" plus major version. Windows CE 5.0 and 6.0 are API-compatible for shutdown, but the registry hive path differs: CE 5.0 stores user settings in \Mounted Volumes\OS_xx\; CE 6.0 adds the user-profile hive accessible at \Users\Mounted Volumes\OS_yy\. The support lifecycle for Windows CE mainline ended 9 October 2018; extended support ended 10 October 2023 (Wikipedia: Windows CE). Siemens continues firmware support for SIMATIC MP-class devices through 2030 under its industrial automation lifecycle commitment.

3. Windows CE Shutdown Architecture

The Windows CE Power Manager is the only process allowed to transition the device into the OFF state. Application code requests a transition by calling SetSystemPowerState (preferred) or PowerOffSystem (internal, forces state without notification). Power Manager then walks the device tree, sending WM_POWER with PWR_SUSPENDREQUEST and PWR_CRITICALSUSPEND to every registered driver, waiting for the registered DLL_PWR_HNDLR to confirm a save of persistent state. Once all drivers ack, the Power Manager instructs the OEM adaptation layer (OAL) to gate power rails. On MP377 hardware this means a controlled 5-second drain of the hold-up capacitor before the SITECORE 24 V supply rail is dropped.

The Power Manager exposes four system state flags to user code:

For shutdown, combine POWER_STATE_OFF with optional Power Manager flags. The default settings panel in CE 5.0 stores the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\Timeouts with values BattPowerOff and ACPowerOff controlling automated transitions; do not modify these values without explicit approval from the line-side PLC integrator.

4. Method 1: VBScript via WinCC flexible / TIA Portal Runtime

The MP377 ships with the WinCC VBScript runtime. The runtime binds VBScript to the global script object HMIRuntime, but for OS-level actions such as shutdown the script must reach outside the WinCC sandbox via the Windows Script Host. WinCC flexible SP3 and later expose VBScript through \Siemens\WinCC\VBScripts. The production runtime parses and executes files dropped here at project load.

Place the following snippet in shutdown.vbs at \Storage Card\Siemens\WinCC\VBScripts\ on a USB-flashed project, or call it through the WinCC flexible "Execute Program" function from a button event:

' shutdown.vbs - WinCC flexible / TIA Portal VBScript run from MP377
' Triggers a controlled SetSystemPowerState(OFF) via WSH CE

Dim objShell
Dim strCmd
Dim intRet

Set objShell = CreateObject("WScript.Shell")

' Build the command line. The -f flag forces open applications to close,
' -s specifies shutdown (default if omitted but spelled out here for clarity).
strCmd = "shutdown -s -f -t 0"

intRet = objShell.Run(strCmd, 0, True)

If intRet <> 0 Then
    ' Fallback path: call the native SetSystemPowerState through a small CE util
    objShell.Run "SysPowerOff.exe OFF", 0, True
End If

' Reached only if shutdown was refused by the OS
Set objShell = Nothing
WScript.Quit 0

Call the script from a button "OnClick" event using:

HMIRuntime.Trace "Shutdown requested by operator @ " & Now & vbCrLf
HMIRuntime.SysFct.TriggerEvent "E_STOP_ACK", 1
HMIRuntime.SysFct.OpenCommandPrompt("shutdown.vbs", "")

Tune the timeout using the project's "Shutdown behavior" parameter in TIA Portal. Default is 10 s. Do not set this below 5 s; the WinCC runtime closes its own SQLite-style tag-logging buffers in 3-4 s and any interruption mid-flush creates a corrupt log index.

5. Method 2: SetSystemPowerState Native API Call

For OEMs and integrators with a Visual Studio 2008 / Platform Builder toolchain, the most reliable shutdown path is a direct P/Invoke or native DLL call to SetSystemPowerState. This bypasses the missing WSHCE limitation entirely. On Windows CE 5.0 the function is declared in pwinuser.h:

// From pwinuser.h, Windows CE 5.0 SDK
// DWORD SetSystemPowerState(LPCVOID pSystemState, DWORD StateFlags, DWORD Options);

// C implementation that calls native shutdown. Compile with /D_WIN32_WCE=0x500
// and link against coredll.lib

#include <windows.h>
#include <pm.h>

int TriggerShutdown(DWORD dwCode)
{
    DWORD dwRet;

    dwRet = SetSystemPowerState(NULL,
                                POWER_STATE_OFF,
                                POWER_FORCE | dwCode);

    if (dwRet != ERROR_SUCCESS) {
        // Last-resort: call SetSystemPowerState again with POWER_STATE_CRITICAL
        dwRet = SetSystemPowerState(NULL,
                                    POWER_STATE_OFF,
                                    POWER_FORCE);
    }
    return (int)dwRet;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ulReason, LPVOID lpReserved)
{
    switch (ulReason) {
        case DLL_PROCESS_DETACH:
            TriggerShutdown(0);
            return TRUE;
    }
    return TRUE;
}

The full declaration of SetSystemPowerState, POWER_STATE_OFF, and the IOCTLs IOCTL_POWER_CAPABILITIES / IOCTL_POWER_SET are documented at Microsoft Learn: shutdown (Windows CE 5.0) (related page) and the Power Manager reference in the Windows CE 5.0 SDK (Platform Builder install). Cross-check the Microsoft Power Manager documentation in your SDK install at %ProgramFiles(x86)%\Windows CE 5.0 SDK\Include\Emulator\pm.h.

Deploy the resulting SysPowerOff.dll to \Storage Card\Tools\ on the panel. Register it as a startup program only when you also configure a soft-button keystroke to invoke shutdown; leaving it auto-loaded on every boot creates an infinite shutdown loop if added to HKEY_LOCAL_MACHINE\Init by mistake.

6. Method 3: PLC-Controlled Relay Power Cutoff

This is the simplest and the one Siemens officially recommends for new machine builders in the FAQ Siemens Industry Online Support entry ID 15247601 - look up "How do you switch off a Panel on Windows CE?" in the SIMATIC HMI knowledge base. The pattern eliminates all software shutdown complexity by using the PLC as the safety arbiter.

Reference architecture:

1. PLC (S7-1200, S7-1500, ET200SP, or CompactLogix on a PROFINET link) holds a digital output, e.g. Q4.0 on an S7-1500, wired through a 24 V DC relay (Siemens 3RT2016-1BB41 or Phoenix Contact PLC-RSC-24DC/21).
2. The relay's normally-closed contact is in series with the 24 V supply rail feeding the MP377 power input (Siemens 6AV6671-5AE00-0AX0 power supply or equivalent).
3. PLC logic arms the relay only after confirming: (a) the WinCC runtime has acknowledged "ready to stop" via bit HMI_ReadyToPowerOff, (b) no safety-relevant alarm is active, (c) a 5-second timer has elapsed.
4. Relay drops the rail; MP377 capacitor holds input above 19 V for the 200-400 ms required for the OAL to drain cache and complete the registry flush.

S7-1500 ladder snippet (translated to STL/TIA Portal representation):

// Ladder logic on S7-1500, tag HMI_ShutDownRequest
// Outputs: HMI_PowerRail_Allowed (to relay coil driver)

// Network 1: Request to shut down must be latched AND not safety hold
A   "HMI_ShutDownRequest"
AN  "SafetyHold_Active"
S   "HMI_ShutdownArmed"

// Network 2: Operator confirmation + 5 second debounce
A   "HMI_ShutdownArmed"
A   "OperatorAck_OK"
L   S5T#5s
SD  "HMI_ShutdownTimer"

// Network 3: Release the rail after timer elapses and HMI confirms
A   "HMI_ShutdownTimer"
A   "HMI_ReadyToPowerOff"
=   "HMI_PowerRail_Allowed"     // inverted to drive 24V through NC contact

Wire the relay NC contact such that loss of the HMI_PowerRail_Allowed signal releases the rail - the contact is normally closed, so the panel is powered until the PLC explicitly calls for shutdown. This fail-safe topology keeps the panel ON if the PLC loses power, which matches OSHA / ISO 13849-1 category-3 expected behaviour.

Capacitor sizing check. The MP377 power supply draws roughly 1.2 A at 24 V. A 3300 uF hold-up capacitor across the input rail gives t = C * dV / I ~ 83 ms at 1 V droop, which is not enough. A 22 000 uF cap gives t > 500 ms at 5 V droop, sufficient for the OAL drain. Many field installations use an external Phoenix Contact QUINT-PS buffer module (rated 1.3 A / 250 ms at 24 V DC) to guarantee sequencing without modifying the MP377 power supply.

7. Method 4: Remote Trigger via EWS or PROFINET

The MP377 PROFINET interface (or the 6AV6644-... PROFINET-equipped variants) accepts wake-on-LAN frames. Combined with the SIMATIC MP377 EWS (Embedded Web Server) panel page at http://<panel-ip>/ews, a remote operator can issue a "Reboot" or "Shutdown" command after authenticating with the HMI panel's account credentials.

EWS is enabled at commissioning time via WinCC flexible / TIA Portal under "Panel Settings > Service > EWS". Default credentials are set by the project engineer; never leave the default admin/admin credentials on a production line. Use a TLS-secured reverse proxy if EWS is exposed outside the process VLAN.

A PROFINET-RT alternative uses one of the MP377's bytes in the area pointer "Coordination" with the PLC. From the S7-1500 you set bit 7 of byte 0 of the coordination area, which the WinCC runtime interprets as a "quit runtime and power down" request. Implement this as a System Function call under a "soft key" button in TIA Portal: HMIRuntime.SysFct.StopRuntime 1. This forces the runtime to exit through its own orderly shutdown, returning control to the CE shell, then the PLC drops the rail using the path from Section 6.

8. Power Management Parameters and Registry Settings

Author-controlled values that govern how a MP377 reacts to a shutdown request live in the registry hive HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power. The most important keys for an integrator are:

Disable WakeupPowerOff on any production panel that receives morning shift wake-ups via PROFINET; otherwise the panel may auto-shutdown immediately on resume. The 5 V standby rail remains live while these keys are configured, so registry edits take effect after the next cold boot rather than immediately.

9. Commissioning and Verification Procedure

After any shutdown implementation, run this checklist at commissioning. Execute every step with the WinCC project in "Service mode" and tag logging temporarily disabled to avoid spurious alarm noise.

1. Capture baseline file hash. Snapshot hdr.bin, flash.bin, and the active WinCC project file (*.fwx or *.ap16) before the test. Use cmd /c md5sum equivalent or capture via FTP.
2. Trigger shutdown with the method under test. Watch the LCD for the WinCC "Stopping" overlay, then the OEM "Windows CE" splash with progress bar.
3. Observe the 24 V rail with a current clamp on the panel input lead. A controlled shutdown returns the rail to 0 within 8-15 s of issue. A relay-only cut returns the rail to 0 immediately on the relay's contact drop. Either is acceptable as long as the underlying OS completes its drain.
4. Power cycle after 30 s. The panel must reach the WinCC project start screen within 40-60 s of 24 V reapplied.
5. Re-hash files. hdr.bin and flash.bin must match the baseline exactly. If they differ, the shutdown was not clean.
6. Check event log at \System\event.evt for entries SVCHOST_EVENT_SHUTDOWN_OK or PM_EVENT_SHUTDOWN_FAIL. The latter indicates the Power Manager could not negotiate one of the attached drivers.
7. Repeat three times consecutively. If any test iteration corrupts the file hash, drop back to Method 3 (PLC relay) which bypasses the OS shutdown entirely.

Acceptance criteria: 3 of 3 iterations complete with matching hashes and no PM_EVENT_SHUTDOWN_FAIL entries logged. Use a Siemens Field PG or a Windows machine running ProSave to read event.evt over Ethernet from the service interface.

10. Troubleshooting Matrix

11. Safety and Best Practices

• Never wire the safety circuit through the panel. The MP377 must remain energised during normal operation even if the WinCC runtime fails. The PLC owns the rail release, not the HMI.
• Always debounce the operator "Shutdown" command with a 5-second hold before the rail is dropped. Operators routinely double-press buttons during an emergency.
• Use the PROFINET coordination byte instead of a custom VBScript when integrating with a Siemens PLC - the byte is documented in the SIMATIC HMI Communication manual and is visible to the S7-1500 diagnostics buffer.
• Confirm OS version before relying on a specific Power Manager IOCTL. Windows CE 5.0 ships with Power Manager 1.0; CE 6.0 with Power Manager 1.6 (more granular flags). The Microsoft Learn page shutdown (Windows CE 5.0) covers the socket shutdown variant only; the Power Manager reference is in the Platform Builder SDK Power Manager chapter.
• Perform dry-run shutdowns quarterly. Add an annual PM (Preventive Maintenance) task that triggers a controlled shutdown, verifies the file hashes, and reports any drift.
• Document the procedure in the FMEA (Failure Mode and Effects Analysis) so the panel shutdown path is part of the safety case, not an afterthought.
• Stop the WinCC runtime before issuing any OS shutdown. The runtime holds open handles to the tag-log and alarm-log SQLite files; an OS-level cut while these are open is the primary cause of log corruption after a "controlled" shutdown.

12. Frequently Asked Questions