Problem Overview
WinCC Flexible 2005 SP1 (and later 2007/2008 variants) supports email transmission from the runtime environment through the built-in SendEmail VBScript function. A common commissioning failure is that the script functions correctly inside the WinCC Flexible simulator on the engineering station (PG/PC), but no mail is delivered when the same project is loaded onto the target runtime device. The runtime does not raise a visible error; the call simply returns with no message in the user's mailbox.
This article documents the root cause most frequently observed in field deployments (third-party antivirus or endpoint protection blocking outbound TCP/25), the diagnostic procedure that isolates it, and the corrective steps to restore mail delivery on a WinCC Flexible runtime panel or PC-based runtime station.
Affected Environment
| Component | Value |
|---|---|
| HMI Software | SIMATIC WinCC Flexible 2005 SP1 (also affects 2007, 2008 SP1/SP2) |
| Runtime Target | PC Runtime (Windows 2000 Professional SP4, Windows XP SP2/SP3) |
| Scripting Language | VBScript (WinCC Scripting Engine) |
| Mail Function |
HMIRuntime.SmartTags("SendEmail") or SendEmail WScript-style call |
| Mail Transport | SMTP, TCP port 25 (unencrypted) |
| Known Interfering Software | McAfee VirusScan / ePolicy Orchestrator, Norton/Symantec Endpoint, Trend Micro OfficeScan, Kaspersky Endpoint Security |
SMTP and WinCC Flexible Email Architecture
WinCC Flexible implements email as a thin client over the operating system's TCP/IP stack. The runtime resolves the configured Simple Mail Transfer Protocol (SMTP) server hostname through standard DNS, then opens a single outbound TCP connection to port 25 on the mail server. The email body is constructed inside the VBScript SendEmail function and submitted using a minimal SMTP conversation (HELO/EHLO, MAIL FROM, RCPT TO, DATA, QUIT).
Because WinCC Flexible does not implement a local spool or retry queue, the call is fire-and-forget: if the socket cannot be opened, or if it is reset by a host firewall/antivirus driver, the message is silently discarded. There is no on-device log, no dead-letter folder, and no event-log entry written by WinCC Flexible itself.
Root Cause: TCP Port 25 Blocked by Endpoint Security
The most common production failure mode observed on Windows-based runtime stations is outbound blocking of TCP/25 by host-based security software. Endpoint protection suites intercept outbound connections at the WFP (Windows Filtering Platform) or TDI driver layer and can deny SMTP traffic even when the Windows Firewall is configured to allow it. McAfee VirusScan in particular has been confirmed to block port 25 on managed endpoints when the Access Protection rule set is enabled.
The diagnostic signature is exact:
- Email from the simulator on the engineering station: delivered
- Email from the runtime on the target PC: not delivered
- Same WinCC Flexible project file (.fwx / .hmi) on both machines
- Same SMTP server address and port defined in Device Settings > SMTP Server
- Same WinCC Internet Settings (Control Panel applet) on both machines
The discriminator is almost always a process policy, Group Policy, or host firewall rule on the runtime that is not present on the engineering station.
Differential Diagnosis Matrix
| Symptom | Likely Cause | Verification |
|---|---|---|
| Works in simulator, fails on runtime | Host firewall / AV blocking TCP/25 |
telnet smtp.server 25 from runtime |
| Works on both, mail arrives late | DNS resolution delay on target |
nslookup smtp.server on target |
| Fails on both | Wrong SMTP host, wrong port, or relay denied | Check SMTP server logs for connection attempt |
| Fails with no error and no socket | WinCC Internet Settings not pointing to project default | Verify Control Panel applet on target |
| Works intermittently | AV scheduled scan interrupting socket | Disable AV and retest; review AV scan window |
| Works on PG, fails on PC Runtime, no AV | WinCC Internet Settings user profile mismatch | Compare HKCU\Software\Siemens\WinCC Flexible settings |
Diagnostic Procedure
Execute the following checks in order. Each step isolates one variable in the email delivery path.
-
Open a raw SMTP session from the target runtime. From a command prompt on the PC running WinCC Flexible runtime, execute
telnet smtp.yourdomain.com 25. A successful connection returns220banner from the mail server. If the connection times out or is reset, the port is blocked at the host or network layer. -
Verify DNS resolution on the target. Run
nslookup smtp.yourdomain.comand confirm the resolved address matches the engineering station. Mismatched DNS suffixes on domain-joined machines are a known cause of intermittent failure. - Confirm the WinCC Internet Settings applet on the target machine points to the project's SMTP profile and not to a user-specific override. Open Start > Settings > Control Panel > WinCC Internet Settings and confirm the Server field matches the engineering station.
- Temporarily disable endpoint protection (McAfee, Norton, Kaspersky, etc.) and re-run the SendEmail test. If mail is delivered, the AV product is the cause. Do not leave AV disabled; proceed to the solution below.
-
Bind the test to a button using the built-in
SendEmailfunction (not a custom VBScript) to confirm the function is wired correctly. A working button-level test rules out scheduler configuration issues.
telnet smtp.server 25 test is the single most reliable isolation step. If the socket cannot be opened from a privileged command prompt, no application-level code change inside WinCC Flexible will fix the problem. Resolve the transport issue first.Solution: Configure Endpoint Security to Permit SMTP
The corrective action is to allow the WinCC Flexible runtime process to make outbound TCP/25 connections through the endpoint protection stack. Apply the configuration that matches the installed product.
McAfee VirusScan / ePolicy Orchestrator
- Open the VirusScan Console.
- Navigate to Access Protection > Properties > Anti-virus Standard Protection.
- Locate the rule Prevent mass mailing worms from sending mail (or equivalent SMTP blocking rule).
- Add an exclusion for the WinCC Flexible runtime executable. The default install path is
C:\Program Files\Siemens\Automation\WinCC Flexible\WinCCFlexibleRT.exe(PC Runtime) or the panel-specificRT.exeon Windows CE panels. - Push the updated policy from ePO if managed centrally.
Windows Firewall (Windows XP SP2 and later)
- Open Control Panel > Windows Firewall > Exceptions.
- Add a program exception for the WinCC Flexible runtime executable.
- If a custom outbound rule is active, add a port exception for TCP 25 to the SMTP server IP address only.
Group Policy (Domain-Joined Targets)
- Open
gpresult /h gp.htmlon the target and review applied policies. - Check for any policy that defines Outbound connection rules under Computer Configuration > Administrative Templates > Network > Windows Firewall.
- Add the runtime executable and TCP/25 to the allow list in the appropriate GPO and run
gpupdate /force.
WinCC Internet Settings Configuration
WinCC Flexible 2005/2007/2008 reads SMTP server configuration from two locations that must agree:
| Location | Path / Setting | Purpose |
|---|---|---|
| Project-level | Project > Device Settings > SMTP Server | Default SMTP host for the compiled runtime |
| Workstation-level | Control Panel > WinCC Internet Settings > Email | Runtime override; takes precedence if present |
Best practice for production deployments:
- Define the SMTP server in Device Settings of the project only.
- Leave WinCC Internet Settings > Email on the target runtime as Default of project (do not enable a user override).
- Use an FQDN for the SMTP server, not an IP address, so DNS changes do not break the deployment.
- If the runtime PC is on a different network segment, confirm the SMTP relay permits relay from that subnet or use a smart host with authentication.
VBScript SendEmail Reference
The minimum working pattern for an email function called by a button or by the WinCC Flexible scheduler is shown below. The scheduler entry in this configuration was a twice-daily trigger reading values from internal tags.
' --- WinCC Flexible VBScript: SendEmail function ---
Function SendStatusEmail()
Dim sTo, sFrom, sSubject, sBody, sServer
sServer = HMIRuntime.SmartTags("SmtpServer") ' e.g. "smtp.example.com"
sFrom = HMIRuntime.SmartTags("MailFrom") ' e.g. "[email protected]"
sTo = HMIRuntime.SmartTags("MailTo") ' e.g. "[email protected]"
sSubject = "HMI Status " & Date & " " & Time
sBody = "Line 1 RPM: " & HMIRuntime.SmartTags("Line1RPM") & vbCrLf & _
"Line 1 Temp: " & HMIRuntime.SmartTags("Line1TempC") & " C" & vbCrLf & _
"Faults: " & HMIRuntime.SmartTags("ActiveFaultCount")
On Error Resume Next
HMIRuntime.Email.Send sServer, sTo, sFrom, sSubject, sBody
If Err.Number <> 0 Then
' Log the failure into an internal tag for diagnostics
HMIRuntime.SmartTags("EmailLastError") = Err.Number & " / " & Err.Description
Err.Clear
Else
HMIRuntime.SmartTags("EmailLastError") = 0
End If
On Error Goto 0
End Function
On Error Resume Next: WinCC Flexible does not expose a structured error object for the Email.Send call. The Err.Number populated after a socket failure is typically -2147220980 (0x80040220) or a generic transport error from the Windows Sockets layer. Treat the absence of an error code as a confirmed transport-layer drop and re-run the telnet test.Simulator vs Runtime Behavioral Differences
| Aspect | Simulator (Engineering Station) | PC Runtime (Target) |
|---|---|---|
| Process context | Runs as interactive user; full network rights | Runs as service or interactive user depending on install mode |
| Windows Firewall | Engineering station typically in dev exception list | Production profile active |
| Endpoint protection | Often disabled or relaxed for PG/PC | Full policy from ePO/SCCM |
| Group Policy | Engineering OU | Production OU, restricted outbound rules |
| User profile | Logged-in developer | Local system or kiosk user |
| SMTP relay permissions | Source IP allowed | Source IP may not be allowed |
Any one of these deltas can produce the exact symptom described in the source case. Treat the engineering station as untrusted for predicting runtime behavior; treat the target PC as the only authoritative environment for sign-off testing.
Verification Procedure
After applying the firewall/AV exclusion, execute the following sequence to confirm the fix is durable, not transient:
- Force a full policy refresh on the target:
gpupdate /forceand restart the WinCC Flexible runtime service. - Re-run the
telnet smtp.server 25test and confirm a220banner. - Trigger the SendEmail function from a button on the runtime project; confirm delivery.
- Trigger the scheduler entry and confirm delivery at the scheduled interval.
- Reboot the target PC and re-run steps 3 and 4 to confirm the exclusion persists across restarts.
- Monitor the AV console for any blocked events against the runtime executable over a 24-hour window.
Edge Cases and Field-Proven Caveats
- Authenticated SMTP: WinCC Flexible 2005/2007 does not support SMTP AUTH (LOGIN/PLAIN/CRAM-MD5). If your mail server requires authentication (e.g., Office 365, Gmail, most ISPs since 2024), use an internal SMTP relay configured for anonymous relay from the runtime's source IP. This is a documented limitation of the older WinCC Flexible scripting API; TIA Portal WinCC (V13+) and WinCC Unified add authenticated SMTP support.
- TLS / Implicit TLS (port 465): Not supported in WinCC Flexible 2005/2007/2008. Use port 25 (STARTTLS optional) or port 587 (submission) only if the relay accepts unencrypted initial handshake.
- Multi-homed PCs: If the runtime PC has more than one NIC, confirm the default route used for outbound SMTP matches the relay's expected source IP. Multi-homed environments are a common source of intermittent relay-denied failures.
-
IPv6 resolution: Force IPv4 resolution on the target if your SMTP server is IPv4-only and the runtime attempts AAAA first. Add an entry to
%windir%\system32\drivers\etc\hostsas a permanent workaround. - Time-skew and SMTP banner: Some relays reject connections if the client clock is skewed by more than 5 minutes. Confirm NTP sync on Windows 2000/XP runtime targets.
- Service-mode runtime on Windows 2000: Windows 2000 lacks the Windows Filtering Platform. On W2K, AV hooks at the TDI driver layer are the only filter path. If port 25 is blocked on W2K, the blocker is always an NDIS/TDI filter, not a user-mode firewall.
Migration Path to Modern Platforms
For new deployments, Siemens TIA Portal WinCC (V15-V18) and WinCC Unified V16+ replace the WinCC Flexible scripting email API with a structured Send mail system function supporting TLS, authentication, and HTML bodies. Engineering effort to migrate an existing SendEmail VBScript is typically under one day per panel, and the move eliminates the unencrypted-port-25 limitation that drives most of the field failures described in this article. For users maintaining WinCC Flexible 2008 SP5 panels in service, the diagnostic and corrective procedures above remain fully applicable.
FAQ
Why does the WinCC Flexible email function work in the simulator but not in runtime?
The simulator runs on the engineering station, which typically has relaxed endpoint protection and no production Group Policy. The runtime PC is governed by the same policy as every other production workstation, and host firewall or antivirus software (McAfee VirusScan is the most common offender) blocks outbound TCP/25 SMTP connections. Disable AV or add an exclusion for the runtime executable, then re-test.
How do I confirm TCP port 25 is open on the WinCC Flexible runtime PC?
Open a command prompt on the target and run telnet smtp.yourdomain.com 25. A successful connection returns a 220 SMTP banner. A timeout or connection reset confirms the port is being filtered at the host or network layer and is the reason WinCC Flexible email fails.
Does WinCC Flexible 2005 SP1 support authenticated SMTP or TLS?
No. WinCC Flexible 2005/2007/2008 only supports unencrypted SMTP on TCP port 25. For deployments requiring authentication or implicit TLS (port 465), use a local SMTP relay that permits anonymous relay from the runtime's IP, or migrate to TIA Portal WinCC V15+ which adds native authenticated/TLS support.
Where are the WinCC Flexible SMTP server settings stored?
Two locations: the project default in Project > Device Settings > SMTP Server and the runtime override in Control Panel > WinCC Internet Settings > Email. For predictable runtime behavior, define the SMTP server in Device Settings only and leave the workstation applet at Default of project.
Does the WinCC Flexible scheduler queue failed emails for retry?
No. The scheduler fires the script once at the configured time; if the SMTP socket cannot be opened or the relay rejects the message, the call returns with no retry and no on-device log. Implement your own retry logic inside the VBScript and write the last error to an internal tag for diagnostics.