Resolving 100% CPU Consumption by s7epatsx.exe and s7oiehsx.exe on Virtualized Windows XP in PCS 7 V7.0

When running a legacy SIMATIC PCS 7 V7.0 SP3 engineering or operator station inside a VMware virtual machine (such as Windows XP SP3 hosted on VMware ESXi 6.5), background services s7epatsx.exe and s7oiehsx.exe frequently spike to 100% CPU utilization following a reboot. This occurs because PCS 7 V7.0 and WinCC V6.2 were never engineered, tested, or released for virtualization (virtualization release began with PCS 7 V7.1 SP2 / ESXi 4.0). Modern ESXi 6.5 virtual hardware floods the legacy Windows XP network layer with unhandled Plug-and-Play event interrupts. To stabilize the system, disable or stop the two offending non-essential background services in Windows Services (services.msc): s7oiehsx.exe (SIMATIC IEPG Help Service) and s7epatsx.exe (SIMATIC NET P&P Manager), and downgrade the VM Hardware Compatibility to Version 7 or 8.

Virtualization Boundaries in Legacy PCS 7 V7.0 Architecture

Industrial asset owners frequently virtualize aging physical engineering laptops and OS workstations to preserve legacy software baselines (such as PCS 7 V7.0 SP3 with WinCC V6.2 SP3 on Windows XP). By hosting the legacy OS inside modern enterprise hypervisors like VMware ESXi 6.5, facilities protect against physical PC hardware obsolescence.

However, as confirmed by Siemens Technical Support, SIMATIC PCS 7 V7.0 was never released for virtualized environments. The very first version of SIMATIC PCS 7 officially qualified for VMware ESXi was PCS 7 V7.1 SP2 (featuring WinCC V7.0 SP2 on ESXi 4.0). Legacy SIMATIC communication drivers built in 2006 expect physical motherboard interrupts, classic PCI busses, and static ACPI hardware. When placed inside a modern ESXi 6.5 virtual machine utilizing Virtual Hardware Version 11 or 13, the hardware emulation layer triggers severe driver polling loops.

Process Identification: s7oiehsx.exe and s7epatsx.exe Functions

Investigating Task Manager on the virtualized Windows XP workstation reveals two specific executables consuming all available vCPU cores:

Executable NameWindows Service NameIntended Role in SIMATIC SoftwareWhy it Spikes to 100% CPU on ESXis7oiehsx.exeSIMATIC IEPG Help ServiceAssists with Industrial Ethernet PG/PC interface browsing and MAC discoveryContinuous polling loop across virtualized E1000/VMXNET3 network adapterss7epatsx.exeSIMATIC NET P&P ManagerPlug-and-Play detection for external CP communication processorsFlooded by modern hypervisor ACPI and hot-plug event interruptsCCDataMgr.exeWinCC Data ManagerCore runtime process tag managementStarved of CPU cycles by the two looping helper services

Neither service is required for standard, static Ethernet communication (ISO / TCP) between the Engineering Station and automation controllers. Stopping them restores normal CPU utilization instantly without breaking project engineering.

Step-by-Step Remediation on Modern VMware ESXi Hypervisors

To resolve the CPU lockup permanently on the virtualized station, execute the following technical measures:

1. Disable Looping Services in Windows XP:
- Open the Windows Run dialog (Win+R), type services.msc, and press Enter.
- Locate SIMATIC IEPG Help Service (s7oiehsx.exe). Right-click, select Properties, click Stop, and change Startup type to Disabled.
- Locate SIMATIC NET P&P Manager (s7epatsx.exe). Right-click, select Properties, click Stop, and change Startup type to Disabled.
- Click Apply and restart the virtual machine.

2. Optimize VMware Virtual Hardware Configuration:
- In VMware vSphere Client, power off the VM.
- Right-click the VM, select Compatibility -> Upgrade VM Compatibility or set compatibility to ESXi 5.0 / Workstation 8 (Hardware Version 8). Avoid using Hardware Version 13 for Windows XP.
- Ensure the virtual network adapter is configured as E1000 (standard Intel 82545EM emulation) rather than VMXNET3, as legacy SIMATIC drivers lack native VMXNET3 kernel bindings.

3. Plan Lifecycle Modernization:
- Because Windows XP and PCS 7 V7.0 are discontinued, plan a structured migration to PCS 7 V9.0 on Windows 10 / Server 2016.

Verification

Confirm that the CPU throttling issue is fully eliminated using these diagnostic checks:

Task Manager CPU Utilization Audit: Open Windows Task Manager after a clean system reboot. Verify that overall CPU usage drops to 1% - 5% during idle conditions.
Process List Inspection: Confirm that neither s7epatsx.exe nor s7oiehsx.exe appears in the running processes tab.
AS Online Communication Test: Open SIMATIC Manager. Open Accessible Nodes or open HW Config online. Confirm that the ES communicates with physical S7-400 CPUs smoothly across the PG/PC interface.

Limitations and Operational Precautions

When operating legacy unreleased virtual environments, observe these operational caveats:

No Manufacturer Support: Siemens Technical Support does not provide bug fixes or patches for PCS 7 V7.0 running in virtual machines. Any issues encountered must be solved via community engineering knowledge or migration.
PG/PC Interface Auto-Search: Disabling the IEPG Help Service prevents automated searching of nodes across unconfigured subnets in 'Accessible Nodes'. Engineers must enter IP addresses directly in STEP 7.
Commercial Procurement and Licensing Disclaimer: Virtualized workstations still require valid Automation License Manager licenses. Verify legacy license entitlements and plan migration packages with an authorized Siemens distributor.

Engineer FAQ

Will disabling SIMATIC IEPG Help Service break WinCC Runtime?

No. WinCC Runtime communicates with the AS using configured Named Connections managed by SIMATIC NET (s7oiehsx.exe is purely a discovery helper for the engineering interface). Runtime communications are unaffected.

Why does the problem only appear on ESXi 6.5 and not on older ESXi 4.0?

ESXi 6.5 introduced modern ACPI power states, virtual CPU scheduling enhancements, and advanced interrupt handling designed for 64-bit multi-core operating systems, which flood older 32-bit Windows XP interrupt handlers.