Diagnosing General Protection Fault Crashes When Opening CEMAT Faceplates in SIMATIC WinCC

A 'General Protection Fault' (GPF) in Gscrt.dll or PdlRuntime.exe when opening a CEMAT faceplate in SIMATIC WinCC is caused by an illegal memory dereference or NULL pointer access in the WinCC Global Script C runtime engine. This occurs when CEMAT C-scripts attempt to access structured tags, UDT parameters, or string buffers that differ in size or memory layout from the structure compiled in AS-OS Tag Management, frequently after upgrading CEMAT libraries without regenerating script headers. To resolve the crash, regenerate header files in the Global Script C editor, compile AS-OS with memory reset, and inspect the WinCC diagnostic console (APDIAG.exe) to trace the failing script pointer.

Anatomy of a WinCC Script Engine General Protection Fault (GPF)

In SIMATIC WinCC (e.g. V7.0, V7.3, V7.4, or V7.5), the Global Script C runtime engine (gscrt.dll) and Graphics Runtime container (PdlRuntime.exe) execute dynamic actions compiled from ANSI-C. When a script attempts to read from or write to a memory address outside its allocated memory space, or dereferences a NULL pointer, the Windows operating system intervenes and issues an unhandled hardware exception: EXCEPTION_ACCESS_VIOLATION (0xC0000005).

In classic WinCC versions, this exception manifests as a popup dialog titled:
Application Error: PdlRuntime.exe - General Protection Fault in module Gscrt.dll
or terminates Graphics Runtime abruptly, returning the operator station to the Windows desktop. In safety-critical facilities such as cement kilns, mining mills, and chemical processing units, faceplate-induced GPFs severely jeopardize operational safety by blinding operators during active sequence manipulation.

Why CEMAT Faceplate Scripts Cause Memory Access Violations

Unlike standard SIMATIC PCS 7 APL faceplates, which rely heavily on VBScript or modernized picture window objects, the CEMAT library relies extensively on compiled ANSI-C functions (c_group.c, c_drv_1d.c, cemat_user_auth.c) that manipulate low-level C pointers to query WinCC structure tags.

The three primary architectural triggers of CEMAT faceplate GPFs are:
1. Mismatched UDT Structure Layouts: Following a library migration or hotfix (e.g., upgrading CEMAT blocks in STEP 7 without performing a full AS-OS compile with memory reset), the S7 block tag structure in WinCC Tag Management differs from the internal C struct definitions declared in header file cemat.h. When a script reads an offset that exceeds the buffer length, a pointer dereference fault occurs.
2. Stale or Corrupt C-Script Headers: The WinCC Global Script engine caches compiled function declarations in header files inside the project's Library directory. If block types were modified but Options -> Regenerate Header was omitted, the runtime attempts to pass mismatched argument lists on the stack.
3. Null Pointer Dereference on Unlinked Block Icons: If a CEMAT block icon in @PG_C_GROUP.PDL is placed on a screen without a valid tag connection (empty or invalid TagPrefix), the C-script calls GetTagChar() or GetTagDWord() which returns NULL. If the script omits a defensive if (pTag != NULL) check before passing the pointer to string manipulation functions (strcpy, sprintf), the runtime crashes instantly.

Comparison of Script Crash Symptoms in SIMATIC WinCC

The following table details the symptoms, error codes, and root causes of script runtime failures in WinCC:

Error SymptomFaulting ModulePrimary Root CauseRemediation ProcedureGeneral Protection FaultGscrt.dll / PdlRuntime.exeNull pointer dereference or structure memory mismatchRegenerate script headers; compile AS-OS with memory resetScript Execution TimeoutGscrt.dllInfinite while loop or blocked database call in C-scriptTrace with APDIAG.exe; optimize script loop terminationPicture Window Remains BlankPdlRuntime.exeMissing system picture file (@PG_*.PDL) in GraCSRun CEMAT_Update_OS.bat to restore factory PDLsTag Prefix Not FoundWinCC_Sys.logUnassigned or truncated TagPrefix property on block iconRe-assign block icon tag connection via Dynamic WizardUser Authorization Denialcemat_user_auth.cInsufficient WinCC User Administrator permissionsAssign User Authorization Level 5/6 to operator group

Step-by-Step Procedure to Diagnose and Resolve WinCC Faceplate GPFs

Follow this diagnostic procedure to capture the failing script and permanently eliminate faceplate GPF crashes:

Launch the WinCC Diagnostics Tool (APDIAG.exe):
- Navigate to C:\Program Files (x86)\Siemens\WinCC\bin\ and launch APDIAG.exe.
- In APDIAG, select Output -> Output Window to open the real-time C-script trace console.
- Select Diagnose -> First Error Break to trap access violations at the exact line of execution.
Reproduce the Faceplate Crash and Capture Trace Data:
- Open WinCC Runtime and click the problematic CEMAT block icon (e.g. C_GROUP).
- In the APDIAG Output Window, observe the captured trace: note the exact C function name (e.g., c_group_open()) and the line number where memory fault occurred.
- Check the diagnostic log file: C:\Program Files (x86)\Siemens\WinCC\Diagnose\WinCC_Sys_01.log.
Regenerate Global Script Headers:
- Close WinCC Runtime.
- In WinCC Explorer, open Global Script -> C-Editor.
- Select Options -> Regenerate Header. Ensure compilation completes with 0 errors.
- Re-compile all project functions (Options -> Compile All Functions).
Recompile AS-OS with Memory Reset:
- In SIMATIC Manager, right-click the OS project and select Compile.
- Select the option With memory reset (Mit Urlöschen der OS-Variablen) to force a complete rebuild of all CEMAT structure tags.
- Download the recompiled OS to the runtime station.
Verify Defensive Null Checks in Custom C-Scripts:
- If plant-customized C-scripts exist in <Project>\Library, inspect pointer handling:
- Ensure all GetTagChar() calls verify that returned pointers are non-null before executing string manipulations: if (pszTag != NULL && strlen(pszTag) > 0).

Verification

Verify system stability after applying the resolution:
1. Start WinCC Runtime on the operator station.
2. Click the C_GROUP block icon repeatedly across multiple process graphics.
3. Confirm that the faceplate opens instantaneously without causing script lag or GPF errors.
4. Check the APDIAG Output Window: verify that trace messages report clean memory allocation and zero access violation exceptions.
5. Verify that subordinate group views (diagnostics, dampers, drives) open and close smoothly.

Limitations and Operational Precautions

Never Modify Core CEMAT System Headers: Never manually alter header files located in C:\Program Files (x86)\Siemens\WinCC\aplib\ or core CEMAT include directories. Doing so creates undocumented library forks that will break during future Siemens service pack upgrades.
Crash Risk to Running Operations: Testing faceplate clicks while troubleshooting GPF issues should be performed on a dedicated Engineering Station or Standby OS Server. A GPF in PdlRuntime.exe terminates graphics runtime on that workstation.
OS Compilation Downtime: Compiling AS-OS 'With memory reset' requires a subsequent full OS project download to runtime servers, which requires a planned maintenance window.

Engineer FAQ

What does 'General Protection Fault in Gscrt.dll' mean in WinCC?

It indicates an unhandled hardware access violation (EXCEPTION_ACCESS_VIOLATION) within the WinCC Global Script C runtime engine. A C-script attempted to read from or write to unallocated memory, usually due to a NULL pointer or a mismatched structure tag.

Why did the GPF only appear after migrating from PCS 7 V6 to V9?

During version migration, internal CEMAT block structures and data types were updated. If the WinCC project retained legacy C header files or structure tags from V6 without a memory reset compilation, the updated scripts accessed obsolete memory offsets, causing an immediate GPF.

How do I use APDIAG to stop WinCC on the first script error?

Launch APDIAG.exe from WinCC\bin, select the menu command Diagnose -> First Error Break, and ensure the Output Window is open. When a script throws an access violation, APDIAG freezes execution and outputs the function name and line number.