Resolving Blank Safety Matrix Viewer Displays and Stale Matrix Data on OS Clients

When the SIMATIC Safety Matrix Viewer in WinCC OS opens displaying a blank screen (no causes, effects, or intersections) or opens an outdated matrix version after modifying interlocks, the issue stems from desynchronized Matrix XML data distribution across OS Servers. When Safety Matrix is transferred and compiled, an XML export defining matrix logic is generated for the OS. OS Clients retrieve this XML file strictly from OS Server 1 (Server A), ignoring preferred server settings. To fix the issue, re-transfer the matrix with 'Position alarm blocks and update all', compile the Entire OS with memory reset, and download the full OS project to Server 1 first.

Architecture of Safety Matrix Viewer and OS Data Transfer

The SIMATIC Safety Matrix provides a Cause-and-Effect methodology for configuring, commissioning, and operating safety instrumented functions (SIF) compliant with IEC 61508 / IEC 61511. When a matrix is compiled and transferred:

AS Safety Logic: Safety Matrix Engineering Tool instantiates certified fail-safe CFC blocks (F_SC_MA, F_SC_CA, F_SC_EF) in the AS safety runtime group.
OS Visualization Data: Unlike standard technological blocks whose status is driven entirely by tags, the Safety Matrix Viewer requires the complete structural grid of causes, effects, descriptions, and intersection types. This grid is exported as an XML configuration file located in the OS project folder (...\wincproj\OS\GraCS\<MatrixName>.xml).

Root Causes: Outdated XML Files vs Server Redundancy Mismatch

When an engineer updates the Safety Matrix and encounters a stale or blank viewer in runtime:

Stale Matrix Displayed: The AS was downloaded with the new matrix logic, but the OS compilation was executed as Changes only without re-transferring the matrix OS data. The OS continues referencing the previous XML file.
Blank Matrix Viewer: An incomplete OS compile or missing XML file causes the Safety Matrix ActiveX control (SafetyMatrixViewer.ocx) to open an empty grid devoid of rows and columns.
Redundant Server Desynchronization: On redundant OS servers (Server A and Server B), the Safety Matrix Viewer client component contains an architectural limitation: it hardcodes queries for the matrix XML data file from Server 1 (Server A), disregarding the client's configured 'Preferred Server'. If the engineer downloaded changes only to Server B to test while Server A remained un-updated, all clients query Server A and display the old or missing matrix!

Why OS Clients Query Server 1 (Server A) Exclusively

In redundant WinCC OS architectures, OS Clients normally balance query loads between Server A and Server B based on the configured Preferred Server. However, the Safety Matrix Viewer component queries the primary server package path registered during initial AS-OS compilation. If Server A is offline or holds an outdated XML file, the viewer fails to fall back gracefully to Server B, displaying a blank grid.

Step-by-Step Matrix Transfer, Compilation, and Deployment Workflow

Execute the following complete refresh workflow to guarantee synchronized matrix visualization:

Transfer Safety Matrix:
- In the Safety Matrix Engineering Tool, open the matrix and select Matrix > Transfer....
- Check Position alarm blocks and update all.
- Execute the transfer; verify 0 Errors, 0 Warnings.
Compile AS Safety Program:
- In SIMATIC Manager, compile the CFC chart folder with Generate module drivers.
- Download the safety program changes to the AS.
Compile Entire OS with Memory Reset:
- Right-click the OS Server project in SIMATIC Manager and select Compile.
- Select Entire OS and check the box With memory reset (rebuilds all tag and picture packages).
Download to Redundant Servers in Order:
- Download the full OS project to Server 1 (Server A) first.
- Download the OS project to Server 2 (Server B).
Update OS Clients: Execute OS Client download on all client stations.

Troubleshooting Matrix for Safety Matrix Viewer Faults

The table below correlates observed symptoms with underlying failure modes:

Observed SymptomUnderlying Root CauseVerification MethodCorrective RemedyBlank Safety Matrix ViewerMissing or zero-byte XML fileCheck wincproj\OS\GraCS\*.xmlRe-transfer matrix and compile Entire OSOpens Old Matrix VersionServer A holds stale XML fileCompare file timestamps on Server A & BUpdate Server A first; download to both serversActiveX control error on clickUnregistered SafetyMatrixViewer.ocxCheck Windows registry on clientRun Register-DLL.bat as AdministratorTag values show '????'OS tags not compiled into Tag MgmtInspect WinCC Tag ManagementCompile OS with 'Tags and messages' enabledBypass button disabledMissing operator authorizationCheck user rights in User AdministratorGrant Authorization Level 5 / 6 to user

Verification

Confirm that Safety Matrix Viewer operates correctly in runtime:

On an OS Client station, open the process graphic containing the Safety Matrix block icon (@F_SC_MA).
Click the block icon; confirm the Safety Matrix Viewer opens immediately.
Verify that all newly added Causes, Effects, and intersection intersections are rendered with correct tags and descriptions.
Verify that live analog and digital status indicators reflect active process inputs (e.g. green for healthy, red for tripped).
Repeat the verification from a secondary OS Client and the local OS Server console.

Limitations and Operational Precautions

Observe the following safeguards when working with Safety Matrix:

F-Safety Password Required: Modifying interlocks or transferring matrices requires the authorized safety engineer password.
Bypass Logging: In runtime, any cause or effect bypass initiated from the Safety Matrix Viewer is recorded in the audit trail and triggers a high-priority safety maintenance alarm.
Version Matching: Ensure the installed versions of Safety Matrix Engineering Tool and Safety Matrix Viewer match identically across the ES, OS Servers, and OS Clients (e.g. both running V6.2 SP1).

Engineer FAQ

Why did Safety Matrix Viewer open an outdated matrix after OS compile changes?

Because Safety Matrix Viewer on clients queries Server 1 (Server A) for its XML grid file. If Server A was not updated or if the matrix was not re-transferred with OS data export, the client displays Server A's older XML file.

Where are the Safety Matrix XML files stored in the OS project?

They are stored in the OS project directory path wincproj\OS\GraCS under the name of the matrix with a .xml extension.

Does a blank Safety Matrix Viewer mean the safety logic in the CPU stopped working?

No. The safety logic executes deterministically in the AS controller regardless of OS graphics. A blank viewer is purely an HMI visualization defect caused by a missing XML data file.