Preventing CFC Editor Online Crashes Caused by Server NIC Teaming and Bridging on the PCS 7 Plant Bus

In SIMATIC PCS 7, crashes of the CFC Editor when going online or modifying block parameters while OS Servers are connected to the plant bus are caused by non-deterministic network packet handling introduced by unauthorized NIC Teaming or Network Bridging on server network adapters. S7-400 ISO-on-TCP communication requires dedicated physical network interfaces. To resolve the crashes, disable all software bridging and NIC teaming on the plant bus, configure dedicated industrial network adapters, and isolate plant bus and terminal bus subnets.

Industrial Ethernet Plant Bus Architecture vs. Standard IT Bridging

In SIMATIC PCS 7, plant communications are divided strictly into two deterministic hierarchical subnets:
1. Terminal Bus: Connects OS Clients, OS Servers, Engineering Stations (ES), and management systems. Communication is standard commercial Ethernet TCP/IP.
2. Plant Bus (Industrial Ethernet): Connects Engineering Stations, OS Servers, and Automation Stations (S7-400 AS, e.g., CPU 410-5H MLFB 6ES7410-5HX08-0AB0 or CP 443-1 MLFB 6GK7443-1EX30-0XE0). Communication relies on deterministic Siemens S7 protocols: ISO-on-TCP (RFC 1006) or raw ISO Transport (Layer 2 MAC-based communication via SIMATIC NET Softnet/Hardnet CP 1623 6GK1162-3AA00).

A critical operational violation occurs when IT personnel attempt to implement high-availability or link aggregation on OS Servers using commercial NIC Teaming (IEEE 802.3ad / LACP / switch-independent bonding) or Windows Network Bridging across adapters connected to both the plant bus and terminal bus. While common in IT enterprise networks, bridging and teaming drivers alter MAC address tables, reorder Layer 2 Ethernet frames, and introduce broadcast loops. When the ES attempts to establish an online CFC session while OS Servers are cyclically querying multiple AS controllers over a bridged adapter, the deterministic S7 communication stack crashes.

Network Adapter Configuration Comparison Matrix

Compare supported industrial networking topologies against prohibited IT teaming configurations:

Network Architecture FeatureApproved PCS 7 ConfigurationProhibited IT ConfigurationImpact on S7 / CFC Online CommunicationPlant Bus AdapterDedicated Industrial NIC (CP 1623 / BCE)Teamed NICs (Intel PROSet / Broadcom)Frame reordering causes S7 protocol connection resetsTerminal Bus AdapterStandard commercial Gigabit NICBridged to Plant Bus NICPacket leakage between subnets; broadcast stormsRedundancy ProtocolRedundant Industrial Ethernet rings (MRP)Software Teaming / LACP bondingMRP handled in hardware switches; teaming breaks ISO layerS7 Connection MultiplexingDeterministic SAP / TSAP addressingDynamically altered virtual MACsCFC online driver fails with access violation crashIP Subnet SeparationPlant Bus & Terminal Bus on isolated subnetsBridged into a single flat broadcast domainBroadcast flooding overloads S7-400 CP communications

Industrial networking notice: Verify all network switch configurations and CP 1623 communication modules against authorized Siemens distributor specifications.

Root Cause of CFC Editor Memory Access Violations During Online Sessions

When an engineer clicks Test > Watch On or attempts to modify a parameter in CFC Editor, the engineering station opens an online PG/AS connection to the target S7-400 CPU via the S7 communication DLL (s7epa60x.dll / s7tgtopx.dll).

If the OS Servers on the plant bus utilize bridged or teamed adapters:
1. ARP and MAC Jitter: The teamed virtual adapter dynamically rotates source MAC addresses or load-balances frames across physical ports. S7-400 CP communication processors reject out-of-order packets or duplicate sequence numbers.
2. Connection Starvation on S7-400 CPU: The S7-400 controller has a finite number of S7 connection resources (typically 32 to 64 connections). Bridged adapters multiply connection retries and flood the controller's communication buffer.
3. CFC Online Driver Buffer Overflow: When the OS Server's cyclic data polling (thousands of WinCC tag queries per second) collides with the ES online debugger packets on an unstable bridged segment, the controller sends intermittent communication reset frames. The CFC Editor's online thread encounters an unexpected null pointer or corrupted response buffer, producing the Windows crash dialog: CFC Editor for s7/m7 has stopped working.

Remediation Procedure: Eliminating Teaming and Restoring Dedicated Subnets

Execute the following network reconfiguration on the OS Servers and Engineering Station:

Remove Network Bridges in Windows:
* On all OS Servers and the ES, open Network Connections (ncpa.cpl).
* If a Network Bridge object exists, right-click it and select Delete.
* Ensure that physical network adapters return to standalone interfaces.
Disable NIC Teaming on Plant Bus Adapters:
* Open the NIC vendor configuration utility (e.g., Intel PROSet or Server Manager NIC Teaming).
* Delete any team containing the Plant Bus adapter.
* If teaming is required for corporate network redundancy, it may only be deployed on the Terminal Bus adapters, provided the switch supports static LACP and the virtual adapter is strictly isolated from the plant bus.
Configure Dedicated Physical Adapters:
* Assign Adapter 1 strictly to the Terminal Bus (e.g., IP 192.168.1.x, Subnet 255.255.255.0, Gateway configured).
* Assign Adapter 2 strictly to the Plant Bus (e.g., IP 192.168.2.x, Subnet 255.255.255.0, No Default Gateway).
* In SIMATIC NET configuration console (Set PC Station), bind the S7 communication access point S7ONLINE exclusively to the dedicated Plant Bus adapter.
Physically Isolate Subnets on Managed Switches:
* Ensure Plant Bus and Terminal Bus traffic pass through physically separate SCALANCE switches (e.g., SCALANCE X204-2 6GK5204-2BB10-2AA3) or isolated IEEE 802.1Q VLANs with no inter-VLAN routing.

Verification

Verify stability after network cleanup:
1. Reconnect all OS Servers to the Plant Bus with the corrected adapter configuration.
2. Open SIMATIC Manager and launch the CFC Editor.
3. Open multiple CFC charts across different AS controllers and switch to Test > Watch On.
4. Modify dynamic parameters online (e.g., change an analog setpoint or timer preset). Confirm that parameter writing executes instantly with zero lag.
5. Monitor Windows Event Viewer on the Engineering Station: Confirm that s7epa60x.dll or CFC crash events are completely eliminated.

Limitations and Operational Precautions

Never bridge the Plant Bus and Terminal Bus network adapters under any circumstances. Bridging exposes real-time industrial controllers to commercial network broadcast storms and malware propagation.
Always ensure that the Plant Bus network adapter has no default gateway configured in its IPv4 properties; having two default gateways on a dual-homed industrial PC creates erratic TCP/IP routing tables.
Do not exceed the maximum S7 connection budget of the S7-400 CPU; leave at least 2 to 4 unreserved connections dedicated for PG/ES engineering access.

Engineer FAQ

Why did CFC only crash when the OS Servers were plugged into the plant bus?

When OS Servers were disconnected, the plant bus had zero cyclic WinCC SCADA traffic. Only the ES and AS were communicating, which did not trigger the packet collisions caused by the server's teamed/bridged NICs. Once the servers were connected, their high-frequency cyclic traffic through the bridged adapter saturated the communication stack and triggered the crash.

Can I use NIC teaming for Terminal Bus redundancy?

Yes, teaming is permissible on the Terminal Bus using vendor-qualified server NICs and switches. However, it must never share physical ports, virtual switches, or bridging with the Plant Bus.

What hardware is recommended for high-availability Plant Bus connections?

For fault-tolerant plant bus redundancy, Siemens recommends redundant Industrial Ethernet rings using SCALANCE X switches with Media Redundancy Protocol (MRP), combined with CP 1623 cards and the S7-REDCONNECT software package.