Troubleshooting PCS 7 CFC Chart Download Errors: Complete Fix

1. Problem Overview

Siemens SIMATIC PCS 7 installations occasionally fail when an engineer attempts to download individual Continuous Function Charts (CFCs) from the CFC editor, even though the full program download from the SIMATIC Manager project tree completes without error. The chart download aborts with a system error dialog that halts the transfer, forces a retry, and on the next attempt typically fails again on a different chart. The failure is reproducible across every Engineering Station (ES) on the plant network, which immediately rules out a single-station fault. A freshly formatted workstation with a freshly installed PCS 7 works correctly until the first Windows restart, after which the failure reappears — a behavior that points to a persistent environmental condition rather than a project defect.

This article documents the four root causes that engineering teams have verified in the field: duplicate CP1623 MAC addresses across stations, NDIS and Industrial Ethernet address aliasing on the same CP1623, SCADA-targeting malware infection, and insufficient communication job allocation on the AS. Each cause produces a similar chart-download error but is resolved with a different corrective procedure. A diagnostic decision matrix, step-by-step fix sequence, and verification checklist are provided in the sections that follow.

2. Symptoms and Error Manifestations

The error is characterized by the following observable behavior on the Engineering Station:

• Full program download from SIMATIC Manager completes without error.
• Downloading a single CFC or a multi-CFC selection from the CFC editor fails with a system error dialog.
• Compiling charts and individual blocks succeeds.
• Online/offline comparison works; only the chart download step fails.
• Failure reproduces on every ES in the plant, not on a single workstation.
• The error appears on Windows XP SP2/SP3, Windows 7, and Windows Server 2003/2008 ES images alike.
• A freshly formatted workstation with a clean PCS 7 install works correctly until the first Windows restart, after which the failure returns.
• The failure has been reproduced on PCS 7 V6.1, V7.0, V7.1, V8.0 SP1, and later revisions.

The presence of a working full-program download but a failing chart-level download narrows the cause to the S7 download channel that the CFC editor uses (a delta-download path) rather than the bulk S7 download channel used by SIMATIC Manager. The two channels differ in their use of the CP1623 personality, the AS communication job pool, and the project archive cache on the file share.

3. Root Cause 1 — CP1623 MAC Address Duplication

The SIMATIC PCS 7 Engineering Station uses a CP1623 (or CP1628) communications processor for the Industrial Ethernet connection to the AS. Each CP1623 is identified on the plant network by its burned-in MAC address. When the same physical CP1623 module is moved between the ES and the OS Server (or Standby Server), Windows may retain a cached MAC binding, or the operator may clone a disk image and inadvertently duplicate the MAC across two stations.

The full program download in SIMATIC Manager uses a robust retry path and a longer timeout, so it can absorb transient MAC conflicts. The chart download path is more sensitive: the S7 communication stack that runs on top of the CP1623 attempts to open a single S7 connection for the delta transfer, and when the stack detects that the same MAC is being advertised by two different network entities, the connection establishment times out and the chart download is aborted with a system error. The error is reported against the chart file even though the network layer is the actual failure point.

Verify the MAC condition on every ES and OS Server in the plant:

1. Open Control Panel → Network and Sharing Center → Change adapter settings.
2. Right-click the CP1623 adapter and select Status → Details.
3. Record the Physical Address (MAC) of every CP1623-equipped station.
4. Compare the recorded MACs with the sticker printed on the back of each CP1623 module.
5. From an elevated command prompt, run getmac /v /fo list to list every adapter's MAC in a scriptable form for the full plant inventory.

If two stations report the same MAC, the duplicate must be removed before chart download will work. The corrective options are:

• Re-image the affected station from a per-station disk image (do not clone a master image across stations without resetting the CP1623 MAC).
• Manually reset the CP1623 MAC using the SIMATIC NET diagnostic tool: Start → SIMATIC → SIMATIC NET → Commissioning → CP1623 → Set MAC Address.
• Replace the cloned disk image with one generated per-station and document the MAC allocation in the plant network register.

The complete procedure, including screenshots and the SIMATIC NET toolchain call sequence, is in the Siemens Support entry 109743154.

4. Root Cause 2 — CP1623 NDIS and Industrial Ethernet Address Aliasing

The CP1623 exposes two network personalities to Windows: a standard NDIS adapter (used for general IP traffic, diagnostics, and remote desktop) and a dedicated Industrial Ethernet / S7 channel (used for S7 communication to the AS). Both personalities share the same physical MAC but are addressed by Windows as two separate adapters. Each can be assigned its own IPv4 address, subnet mask, and gateway.

If an operator configures both adapters with the same IP address — for example, by copying a network configuration from a template, by using a unified plant addressing scheme, or by accident during commissioning — Windows routes S7 packets to the NDIS side, the S7 communication stack fails to bind to the Industrial Ethernet side, and the chart download is aborted. The same failure mode appears when both adapters sit in the same /24 subnet, because the OS cannot disambiguate which adapter owns the S7 destination IP.

Verification procedure on the ES:

1. Open ncpa.cpl on the Engineering Station.
2. Identify the CP1623 NDIS adapter and the Siemens Industrial Ethernet (CP1623) adapter.
3. Check the IPv4 properties of each. The two adapters must not share an IP address, must not be in the same /24 subnet, and must not be in the same broadcast domain if both are enabled.
4. Confirm with ipconfig /all in an elevated command prompt and capture the output for the change log.
5. For S7 routing, the Industrial Ethernet side must be in the same subnet as the AS Ethernet interface (typically 10.0.0.0/24 or a plant-specific subnet); the NDIS side, if used, must be in a different subnet dedicated to ES diagnostics.

The reference document for this configuration is the CP1623 installation guide, available from Siemens Industry Online Support under product family SIMATIC NET — CP1623. The corrective procedure, including the recommended IP addressing scheme, is also summarized in support entry 109743154.

5. Root Cause 3 — SCADA Malware Infection

Plant networks running PCS 7 and WinCC have been targeted by SCADA-specific malware that replaces or corrupts WinCC project files, S7 block libraries, and SIMATIC Manager DLLs. The most documented family is the Stuxnet lineage, which uses signed drivers and rootkit techniques to remain resident on a PCS 7 workstation even after a standard antivirus scan. Once a workstation is infected, the CFC download path may be compromised: the chart data is intercepted, the S7 download handshake is altered, or the chart file is rewritten in transit. The downstream symptom is a system error from the chart download dialog, but the root cause is on the ES itself, not on the AS.

The reproduction pattern for malware-induced chart errors is:

• Every ES in the plant fails at the same time, after a shared file-server event, an antivirus signature update, or a USB device being connected to any ES.
• Errors persist across PC reformatting only if the project archive itself has been corrupted by the infected workstation writing back to the file share.
• Standard antivirus engines (Symantec Endpoint Protection 11, legacy ESET NOD32 v4 with stale signatures, etc.) may not detect the SCADA-targeting payload because the malicious DLLs are signed with valid Siemens code-signing certificates stolen from the supply chain, or use rootkit techniques that hide from user-mode scanners.
• Connecting an ES to the office LAN or to the public Internet (directly or via an uplink) is the most common entry vector.

Containment procedure:

1. Disconnect every affected ES and OS Server from the plant network immediately. Do not power them down yet — a live memory capture may be required for incident response.
2. Do not connect removable media (USB sticks, SD cards, optical media) to any plant workstation until the plant is declared clean.
3. Capture a memory image of one affected ES using a forensic tool (e.g., WinPmem, FTK Imager) before powering down.
4. Re-image each workstation from a known-good PCS 7 install media. Do not attempt in-place cleaning.
5. Restore the project from a read-only backup or from the master CD — not from the last network share, which may have been written by the infected workstation.
6. Update the antivirus signature database offline; ESET NOD32 v4 with current updates has been used in field deployments to identify residual payloads, but offline signature updates are mandatory after a clean install, before the ES is allowed back on the network.
7. Apply the latest PCS 7 security patches and Siemens ProductCERT advisories before reconnecting to the plant network.
8. Audit every user account and every shared credential on the ES — SCADA malware has been observed harvesting engineering credentials.

6. Root Cause 4 — Communication Job Saturation (System Error 1739:60458)

SIMATIC S7 communication is built on a fixed pool of communication jobs allocated to the AS. Each online action — chart download, online block compare, status query, forcing tag, online program status, recipe view — consumes one or more jobs from this pool. The default allocation is sufficient for engineering on a small project but is too low for downloading an entire CFC chart with many nested blocks in a single S7 transaction.

When the job pool is exhausted, the S7 stack returns system error 1739:60458 to the chart download task. The full program download still works because SIMATIC Manager fragments it into smaller S7 transactions that fit the job pool; the chart download path takes a single large transaction and exceeds it. Increasing the number of communication jobs in the AS configuration resolves the failure immediately.

Configuration procedure:

1. In SIMATIC Manager, open the S7 Program container for the affected AS.
2. Right-click the Hardware object and open Object Properties → Communication.
3. Increase Number of communication jobs. Recommended starting values are:

4. Recompile the hardware configuration and download it to the AS during a maintenance window. A hardware configuration download to an AS is a short stop-and-restart of the AS; coordinate with operations.
5. After the AS restarts, retry the chart download from the CFC editor.

The official Siemens guidance is documented in the FAQ entry 2446042. Verify the exact maximum supported by your AS firmware in the hardware catalog; the values above are typical for current PCS 7 revisions and may be lower for older AS firmware.

7. Diagnostic Decision Matrix

8. Step-by-Step Resolution Procedure

Execute the following steps in order until the chart download succeeds. Each step is independent — stop after the first success and document the fix in the change log.

1. Verify CP1623 MAC uniqueness. Use getmac /v /fo list on every ES and OS Server. Build a MAC register and resolve any duplicates before continuing. Reference: Siemens 109743154.
2. Verify CP1623 NDIS / Industrial Ethernet addressing. Ensure the two personalities are on disjoint subnets, or disable the NDIS side entirely. Reference: Section 4 above.
3. Confirm the project archive is clean. On an isolated workstation (one that has never touched the plant network), expand the project archive from the master CD or a verified read-only backup. Re-attempt the chart download. If it succeeds, the in-service project on the plant file share is corrupted — restore it from the same read-only source.
4. Increase the AS communication job count to the value recommended in Section 6. Recompile and reload the AS hardware configuration during a maintenance window.
5. Re-image the ES from clean PCS 7 install media. Do not re-attach it to the plant network until the antivirus database is current and the plant has been swept for malware.
6. Capture the S7 trace for the change log. From SIMATIC Manager: Options → PC Diagnostics → S7 Trace, set log level to 3, reproduce the chart download, and save the trace. This is required for the Siemens support case if the failure persists.

9. Verification Checklist

After applying any fix, verify resolution with the following sequence. The first three steps are the minimum acceptance criteria; the remaining steps are the full commissioning test.

1. From the CFC editor, select Chart → Download on a chart that previously failed. The download must complete without a system error dialog.
2. Open Online → Monitor on the same chart. Online values must appear within 2 seconds of opening the monitor view.
3. Run Chart → Download Changes Only on a multi-CFC S7 program. This is the most stringent test because it reopens a single S7 connection for delta transfers. The equivalent workflow in TIA Portal V20 / WinCC Unified is described in the Siemens TIA Portal V20 documentation.
4. Repeat the test on a second chart that contains nested block instances and runtime blocks (FB, FC, DB, UDT).
5. On PCS 7 V8.0 SP1 or later with an AS 410, repeat the test in the redundant OS Server context — switch the OS Server role and confirm the chart download from the now-active server.
6. Force a chart value online, then perform an online/offline compare. The compare must complete without a system error.

Acceptance thresholds for a healthy plant:

• Single-CFC chart download completes in under 5 seconds on a small chart.
• Full CFC page download (20 – 30 chart instances) completes in under 30 seconds.
• Delta download (changes only) completes in under 10 seconds for a project with 50 charts.

Capture the SIMATIC Manager diagnostic trace (S7otbxlx.dll log level = 3) before closing the engineering session so the resolution can be referenced in the change log and the PCS 7 knowledge base.

10. Preventive Measures

Once the chart download is restored, harden the PCS 7 installation against recurrence. The following controls have been verified in operational plants.

• Network segmentation. The Engineering Station LAN must be physically or logically isolated from the office LAN. A single uplink to the office network is sufficient to introduce SCADA-targeting malware into the plant. Use a unidirectional gateway (data diode) or a screened subnet with strict ACLs for any required data exchange.
• Media control. Block USB and removable media on every ES via Group Policy or a managed Removable Media Service (RMS). If transfers are required, use a dedicated scanning kiosk outside the plant network.
• MAC inventory. Maintain a MAC address register for every CP1623 and CP1628 in the plant. Add a verification step to the PC-replacement procedure so that cloned disk images cannot introduce duplicate MACs.
• CP1623 configuration baseline. Document the NDIS / Industrial Ethernet IP addressing scheme in the plant network standard. Disable the NDIS side of the CP1623 unless it is explicitly required for diagnostics.
• Communication job review. When adding a new CFC library or a large runtime structure to an AS, re-evaluate the communication job allocation. A standard AS 410 running PCS 7 V8+ should never operate with fewer than 12 jobs if any CFC chart download is in regular use.
• Antivirus and patch cadence. Define a monthly maintenance window for offline signature updates and PCS 7 hotfix deployment. Restrict the ES user account so that only the PCS 7 installer can write to %ProgramFiles%\Siemens\Automation and %ProgramFiles%\Siemens\WinCC.
• Project backups. Keep the master project archive on read-only media (DVD-R or a write-protected NAS share). Never restore a project from a network share that any ES has write access to. Maintain at least three generations of backups.
• SIMATIC Manager log retention. Archive the S7 trace and the WinCC diagnostics log for every engineering session. These logs are essential when filing a Siemens support request and when post-incident review is required.

11. Notes for TIA Portal V20 / WinCC Unified Migrations

Engineers migrating a PCS 7 project to the TIA Portal V20 platform with WinCC Unified will find that the chart-download workflow has been refactored. In the Unified runtime, Download changes only keeps the WinCC Unified runtime running while the delta is applied — see the official TIA Portal V20 documentation for the exact procedure and the runtime behavior during the delta. The S7 communication job allocation is still relevant for the AS side of that workflow; the same job-count guidance in Section 6 applies, and an exhausted job pool will produce a comparable error in the Unified engineering client.

The CP1623 module has been replaced for new installations by the CP 1626 and by the IE General module on the AS 410. On a CP 1626, the NDIS/Industrial Ethernet aliasing check in Section 4 still applies — both personalities are exposed to Windows as two adapters and must be addressed on disjoint subnets or the NDIS side must be disabled. On the AS 410 IE General, only one personality is exposed, so the Section 4 cause does not apply — but the Section 3 MAC duplication check is still required when an ES is migrated from a CP1623 to a CP 1626 and the plant network inventory is not updated.