WinCC Flexible 2005 SP1 Runtime Not Starting: Apply HF6

Problem Overview

Engineers commissioning Siemens WinCC Flexible 2005 PC-based runtime on Windows XP SP2 frequently encounter an obscure failure mode in which the project compiles cleanly, transfers successfully to the HMI computer, yet the runtime refuses to launch. There are no event log entries, no popup dialogs, and no diagnostic traces; the operator simply never sees a HMI window. The failure typically appears only after the engineering project passes a certain complexity threshold (compiled runtime image beyond approximately 2 MB and source .hmi above 150 MB). Hotfix HF5 shipped with the original Advanced SP1 media contains an initialization regression in the runtime loader that causes a silent exit under these conditions. Siemens published Hotfix HF6 (KB 24376196) to address this exact symptom, along with the MSDE installation prerequisites required to apply the patch successfully.

Symptoms and Error Behavior

The characteristic symptom profile includes:

• PC Runtime does not appear on screen after RTStart.exe launch or a scheduled auto-start.
• No Windows Event Viewer entries under Application or System.
• No WinCC Flexible diagnostics file is created under the configured log directory (typically C:\Program Files\Siemens\WinCC flexible\WinCC flexible RT\Log).
• The STEP 7 / WinCC Flexible integrated engineering project compiles without warnings or errors.
• File transfer to the PC station completes with a green Transfer completed status.
• Project size on disk: .hmi file roughly 150 to 200 MB, generated runtime image in the 2.0 to 2.5 MB range.
• Recent edits added additional screens, scripts, or large tag tables.
• STEP 7 Save As with reorganization and WinCC Flexible Rebuild All have already been attempted without effect.

Before concluding that Hotfix HF6 is required, rule out the following common causes with the diagnostic table below.

Root Cause Analysis

The WinCC Flexible 2005 PC runtime is implemented as a Windows service (SIMATIC WinCC flexible RT) fronted by a launcher (RTStart.exe) that initializes the runtime database, registers connections, then transitions to the configured start screen. The runtime stores tag history, alarm logs, and recipe data inside a Microsoft SQL Server Desktop Engine (MSDE) instance installed by the WinCC Flexible media. Hotfix HF5 shipped a runtime loader patch that inadvertently failed to complete the database authentication handshake on compiled projects whose database transaction count surpassed an undocumented threshold. When this occurs, the service control handler invokes ExitProcess() before any window is created, leaving the operator with no feedback path beyond an empty desktop.

Three contributors converge to trigger the regression:

1. SQL authentication handshake inside the loader (WinCCFlexRT.exe) introduced in the HF5 patch.
2. Project compiler generating a runtime database with more than a critical number of tag transactions or alarm entries (typically above 5,000 configured tags or 20,000 alarm messages).
3. Project loaded from an integrated STEP 7 / WinCC Flexible context (shared symbol table, integrated connection list) that re-imports connections at runtime.

The HF6 patch (KB 24376196) revises the loader's authentication cache and decouples the startup handshake from the transaction-table size, restoring reliable runtime launches on projects that previously triggered the silent-exit failure mode.

Affected Versions and Platforms

Prerequisites

Before starting, gather the following on both the engineering PC and the HMI computer:

• Original WinCC Flexible 2005 Advanced SP1 installation media (DVD or downloaded ISO) including the Support folder for MSDE.
• Local administrator credentials on the HMI PC (the MSDE setup will not install under a non-elevated token).
• Service Pack 1 confirmed on both PCs (verify via Help → About in WinCC Flexible; expected build string ends with V1.3.x HF5).
• A working backup of the .hmi source file plus the compiled runtime image directory.
• Downtime window of 45 to 90 minutes for the HMI PC and approximately 20 minutes for the engineering PC.
• Internet access (or offline pre-staging) to Siemens Support KB 24376196 for the Hotfix HF6 download.
• For Siemens support tickets: ability to export a *.citamis archive of the project (WinCC Flexible Project → Archive) which compresses a 200 MB .hmi to typically 3 to 8 MB.

Step-by-Step Resolution Procedure

The following procedure assumes the HMI PC is running Windows XP SP2 with WinCC Flexible 2005 Advanced SP1 (HF5) already installed. Adapt path references for Windows 2000 installations.

1. Disconnect the HMI PC from any network carrying live PLC traffic to prevent unintended write operations during restart. Stop the runtime service: sc stop "SIMATIC WinCC flexible RT".
2. Uninstall the existing MSDE instance delivered by WinCC Flexible: Control Panel → Add or Remove Programs → Microsoft SQL Server Desktop Engine (WINCCFLEX). Choose Remove rather than Repair.
3. Reboot the HMI PC. Verify that no sqlservr.exe processes remain in Task Manager and that the WINCCFLEX instance is gone.
4. Reinstall MSDE from the WinCC Flexible DVD by running Setup.exe in repair mode, or directly invoke SQL Server Desktop Engine Setup from the Support folder on the DVD. Accept the default instance name WINCCFLEX.
5. Allow the setup to complete and verify that the SQL Server (WINCCFLEX) service is running via net start MSSQL$WINCCFLEX. Confirm a returned state of START_PENDING transitioning to RUNNING.
6. Apply Hotfix HF6 by running HF6_K24376196.exe downloaded from Siemens Support entry 24376196. Choose Repair installation (in-place).
7. When prompted, accept the default Strong SA password policy or supply a password you control. If the policy dialog blocks the installer, resolve via the procedure in Handling the MSDE SA Password Error below.
8. Allow the patch installer to restart the SQL Server (WINCCFLEX) and SIMATIC WinCC flexible RT services automatically.
9. Transfer the compiled runtime project once more from the engineering PC using Project → Transfer → PC Runtime. Choose Overwrite to ensure stale binaries in the runtime directory are replaced.
10. Launch RTStart.exe from the runtime directory and confirm the HMI window appears within 3 to 8 seconds.
11. Reboot the HMI PC end-to-end to validate that the configured auto-start path also works without operator intervention.

Handling the Microsoft SQL Server Desktop Engine SA Password Error

The HF6 installer invokes the Microsoft SQL Server Desktop Engine setup, which refuses to upgrade an instance whose sa (system administrator) login uses a blank password. The exact error string reported by the HF6 setup wizard is reproduced verbatim below so it can be matched against field captures:

Microsoft SQL Server Desktop Engine
Setup has detected that your current SA password is set to blank.
Please use sp_password to set a strong SA password and restart setup
or set BLANKSAPWD=1 to ignore this vulnerability.
Refer to readme for more details. Setup will now exit.

This is a Microsoft MSDE setup hardening policy, not a Siemens code defect; Siemens cannot redistribute a SQL Server setup that overrides Microsoft's hardening rules. The corresponding Siemens FAQ KB 24435650 documents the exact context. Two workarounds exist; choose A if a strong password is acceptable in the environment (preferred), or B for closed networks that cannot maintain a SQL password.

Workaround A: Assign a Strong SA Password via sp_password

1. Open a command prompt as Administrator on the HMI PC.
2. Launch the MSDE command-line tool: osql -S .\WINCCFLEX -E. Authentication is Windows-trusted because -E requests integrated security.
3. At the 1> prompt, run the stored procedure to assign a strong password: 1> sp_password NULL, 'WccFlex@HF6_Str0ng', 'sa'. The first argument is the old password (null), the second is the new password, and the third names the login.
4. Verify by listing logins: 1> select name, password, is_disabled from syslogins where name='sa'. Confirm that the sa account now reports a non-null password hash.
5. Force the login audit log to flush via 1> checkpoint and then type exit to leave osql.
6. Re-run the HF6 installer. The Strong Password dialog now accepts the existing password or allows you to apply a new one for the installer only.

Workaround B: Force the Setup Wizard to Accept a Blank SA Password (Closed Networks Only)

This is acceptable on a closed automation network with no external connectivity, but the configuration must be reverted after the install. Edit the registry as follows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\WINCCFLEX\MSSQLServer]
"LoginMode"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\WINCCFLEX\Setup]
"BLANKSAPWD"="1"

Then relaunch the HF6 installer. After the install completes, restore the recommended LoginMode to 1 (Windows authentication only) if your project does not require SQL login access, and remove the BLANKSAPWD value to harden the registry against later re-install attempts.

Installing Hotfix HF6

The HF6 patch wraps a recompiled WinCCFlexRT.exe, an updated WinCC flexible RT.msi transform, and additional SQL migration scripts. The installer registers with Windows Installer and writes its version to Add or Remove Programs as WinCC flexible 2005 SP1 HF6. Manual verification of patch completeness:

1. Inspect the runtime directory, typically C:\Program Files\Siemens\WinCC flexible\WinCC flexible RT, and confirm that WinCCFlexRT.exe has a file version of 2005.1.6.0 or higher. Older file versions below this threshold indicate the patch failed silently.
2. Compare with the engineering PC: open Help → About in WinCC Flexible on both the engineering PC and the runtime PC. Both should report the same HF revision string.
3. Open Add or Remove Programs; the Hotfix (HF) version entry should read 2005.1.60.0 (or higher if subsequent Siemens updates applied).
4. In Registry Editor, navigate to HKLM\Software\Siemens\WinCC flexible\Runtime and confirm the HFRevision string value matches the version expected by the engineering PC.

If the engineering PC was updated but the runtime PC still shows the old version, re-run the patch on the runtime PC using Modify rather than Repair. Modify re-checks the Windows Installer cache and rewrites the binaries into the runtime directory tree.

Project Size Thresholds and Defensive Practices

The Hotfix HF6 fix removes the loader regression, but underlying project size remains a long-term maintainability concern. Apply the limits below when sizing future projects:

When projects inevitably approach these limits, the canonical workflow to preserve known-good sources is:

1. Maintain a tagged backup of the last green-build .hmi file in a version-control repository (Subversion, Git LFS, or Teamcenter).
2. Use the Save As with reorganization STEP 7 procedure on integrated projects weekly to clear dangling pointer references.
3. Document each batch of changes in a change-log text file inside the project directory; tag each backup with the corresponding date range.
4. When HF6 silently fails again on a future project version, revert to the last tagged backup and re-execute changes one-by-one. This isolates the change that broke the build, which is far faster than diffing two 200 MB binary projects.
5. Export a *.citamis archive (compress to a few MB) before opening any Siemens support ticket; include the change log alongside it.

Alternative Recovery Strategies

If HF6 cannot be deployed (for example, due to media validation policy, air-gapped networks, or asset freeze periods), the following alternative recovery steps restore the runtime without applying the hotfix. Use these as stopgap measures only; HF6 remains the canonical remediation.

Strategy 1: Reorganize Integrated Projects

STEP 7 / WinCC Flexible integrated projects share a single symbol and connection cross-reference. Over many incremental saves the cross-reference can accumulate dangling pointers that WinCC Flexible's project compiler cannot resolve, leading to a runtime whose symbol-handling layer rejects initialization. Run File → Save As in STEP 7 with the with reorganization option checked (also accessible via the command-line S7Reorg.exe), then re-open the project and re-integrate the WinCC Flexible portion. This rebuilds the shared symbol map and connection table without changing any HMI logic.

Strategy 2: Rebuild from Last Good Backup

If a known-good backup from earlier in the commissioning cycle exists, restore it and confirm runtime startup. Reapply the recent changes incrementally with the Rebuild All compilation option enabled in WinCC Flexible (Project → Compiler → Rebuild All). When the runtime fails again, the previously applied change is the breakpoint. Restore the backup and reapply only the changes before that breakpoint to keep the machine operational until HF6 can be installed.

Strategy 3: Reduce Database Transaction Count

For projects well above the 2.5 MB runtime image threshold, temporarily disable unused alarm and audit archive logs. In WinCC Flexible, open Logs → Archives, uncheck Enable for each archive not yet required. Recompile, transfer, and verify runtime startup. This reduces the database transaction table size enough to bypass the HF5 regression while HF6 is being obtained. Re-enable the archives after HF6 deployment.

Strategy 4: Submit a CITAMIS File to Siemens Support

If after all of the above the runtime still fails, open a Siemens support ticket and attach the *.citamis export of the project. Siemens A&D support reproduces the issue in-house against a copy of the same WinCC Flexible SP1 build. The *.citamis is a compressed XML bundle containing tag tables, screen exports, scripts, compiler diagnostics, and runtime logs, designed to ship a 200 MB project as a few MB. For a Siemens CR ticket referencing this issue, the typical turnaround time is 5 to 10 business days; expedite via premium support contracts if the line is at risk.

Recovery Flow Diagram

The flow below summarizes the recommended order of operations when WinCC Flexible 2005 PC Runtime fails silently on a project approaching the 2 MB image threshold. Follow the path top-left to bottom-right and apply each branch in sequence.

Verification Procedure

After HF6 is installed, perform the following checks in order to confirm the runtime is restored:

1. Open Help → About in WinCC Flexible on the runtime PC and confirm the build string includes HF6.
2. Open services.msc and confirm that both SQL Server (WINCCFLEX) and SIMATIC WinCC flexible RT are Started with startup type Automatic.
3. Verify that the SIMATIC WinCC flexible RT service Log On tab still points to the LocalSystem account unless an integration with a domain account has been deliberately configured.
4. Launch RTStart.exe. The runtime window must appear within 3 to 8 seconds. The status bar at the bottom transitions from Connecting to Online.
5. Trigger a forced runtime restart by stopping and starting the SIMATIC WinCC flexible RT service in services.msc. Confirm that the launcher recovers automatically within the configured start delay (typical: 0 to 30 seconds).
6. Power-cycle the HMI PC and confirm that the configured auto-start routine brings up the runtime without operator intervention.
7. Open Event Viewer → Application: there should be no WinCC flexible RT errors within the first 60 seconds of startup.
8. Confirm that tag updates from the PLC (use Tools → Tag Simulation if no PLC is connected) propagate to at least one screen element within 200 ms.
9. If the runtime fails any of the above checks, capture a fresh *.citamis archive plus the contents of %TEMP%\WinCCFlex*.log for Siemens support.

Warning Signs to Monitor in Operation

Watch for the following operational signatures that indicate a runtime is approaching the silent-fail threshold even after HF6 is applied:

• Runtime startup time creeps above 8 seconds; investigate before reaching 15 seconds.
• MSDE transaction log (C:\Program Files\Microsoft SQL Server\MSSQL$WINCCFLEX\Data\*_log.ldf) exceeds 1 GB; schedule DBCC SHRINKFILE.
• Event Viewer shows periodic source SQLServer warning id 19030; database auto-growth hits ceiling.
• WinCC Flexible trace Log\Trace.txt shows tag query times above 500 ms; indicates database index fragmentation.
• Compiled runtime image crosses 2 MB after additional screen or script edits; consider immediate freeze of further edits until project is split or migrated.

Frequently Asked Questions