Resolving HW Config Crashes and Antivirus Exclusions in SIMATIC PCS 7 Engineering Stations

In SIMATIC PCS 7 Engineering Stations, recurring crashes of the hardware configuration editor (S7 hardware configuration has stopped working) when opening or saving HW Config are caused by unauthorized third-party antivirus software intercepting and locking temporary database files (.s7p, .hwh, .dat). To resolve this, configure strict antivirus exclusions according to Siemens Industrial Security guidelines for all STEP 7/PCS 7 executables, temporary directories, and project storage folders, or deploy an approved antivirus solution.

Root Cause Analysis of s7hcfgx.exe File Lock Crashes

In SIMATIC PCS 7 Engineering Stations (utilizing controllers such as CPU 410-5H MLFB 6ES7410-5HX08-0AB0 or CPU 417-5H MLFB 6ES7417-5HT06-0AB0), opening the hardware configuration editor launches the STEP 7 binary s7hcfgx.exe.

During startup and saving, s7hcfgx.exe performs complex file system operations across the STEP 7 project database structure:
1. It queries the central hardware catalog databases (C:\Program Files (x86)\Siemens\Step7\S7DATA\).
2. It generates temporary XML and binary scratch files (.hwh, .dat, .tmp) in the Windows temporary directory (%TEMP%).
3. It performs an atomic rewrite of project hardware descriptor tables (.dbf, .cdb, .s7p).

When unmanaged commercial antivirus or Endpoint Detection and Response (EDR) software (e.g., Windows Defender, Symantec, McAfee, Trend Micro, CrowdStrike) runs with real-time heuristic scanning enabled on the engineering station, the antivirus scanner places an exclusive file lock on these temporary files the moment s7hcfgx.exe flushes data to disk. When s7hcfgx.exe attempts to re-read or delete the file handle, Windows returns ERROR_SHARING_VIOLATION. Unable to handle the unexpected file lock, s7hcfgx.exe triggers an unhandled memory access violation, crashing with the error dialog: S7 hardware configuration has stopped working.

Antivirus Exclusion and File Extension Compatibility Matrix

The following matrix specifies mandatory exclusions required by Siemens Industrial Security guidelines for PCS 7:

Antivirus Exclusion CategoryTarget File Path / Process NameExclusion TypeOperational Risk if ExcludedRisk if NOT ExcludedSTEP 7 Hardware Config Processs7hcfgx.exeProcess / ExecutableNegligible (Signed Siemens binary)Fatal crash during HW Config open/saveSTEP 7 CFC Editor Processs7tgtopx.exe, s7epa60x.dllProcess / ExecutableNegligible (Signed Siemens binary)CFC crash during online monitoringWinCC Core ProcessCCProjectMgr.exe, WinCCSys.exeProcess / ExecutableNegligible (Signed Siemens binary)OS project corruption / IDispatch errorsProject Storage PathsC:\SIEMENS\STEP7\S7PROJ\*Folder / Directory TreeManaged via physical network securityDatabase lockup and archive corruptionWindows Temp Directories%TEMP%\*, C:\Windows\Temp\*Folder / Directory TreeLow (Scoped to engineering sessions)Temporary hardware file lockingCritical File Extensions.s7p, .s7s, .hwh, .dbf, .mdf, .ldfFile Extension FilterLowReal-time file locking crashes compilers

Security notice: Only deploy antivirus solutions officially qualified and white-listed in the PCS 7 compatibility tool.

Configuring Mandatory Antivirus Folder and Process Exclusions

Execute the following configuration in the endpoint protection console on all PCS 7 engineering stations:

Configure Directory Exclusions:
* Add the following permanent folder exclusions (including all subfolders):
- C:\Program Files (x86)\Siemens\
- C:\Program Files (x86)\Common Files\Siemens\
- C:\ProgramData\Siemens\
- C:\SIEMENS\ (and all drive partitions hosting PCS 7 multiprojects, e.g., D:\Projects\)
- C:\Users\<User>\AppData\Local\Temp\
Configure Process / Executable Exclusions:
* Exclude the following binaries from real-time behavior monitoring:
- s7hcfgx.exe (Hardware Configuration)
- s7tgtopx.exe (CFC Editor)
- s7subtopx.exe (SFC Editor)
- s7ubtstx.exe (SIMATIC Manager)
- CCProjectMgr.exe (WinCC Project Manager)
Configure File Type Exclusions:
* Add file extensions to the exclusion list:
.s7p, .s7s, .s7f, .hwh, .dat, .dbf, .cdb, .mdf, .ldf, .pdl.

Repairing Corrupted Hardware Configurations via Project Reorganization

If an antivirus crash corrupted an existing project configuration:

Attempt Open via NetPro:
* As demonstrated in field diagnostics, NetPro uses an alternate internal parser. Open NetPro.
* If NetPro opens, select Network > Save and Compile > Check and compile all.
* If consistency passes, close NetPro and retry opening HW Config.
Execute Slow Reorganization in SIMATIC Manager:
* Close all editors (HW Config, CFC, WinCC).
* In SIMATIC Manager, select File > Reorganize.
* Select the affected project and check Reorganize (slow).
* This rebuilds internal database pointers and purges orphaned file fragments caused by the crash.
Restore from Clean Archive:
* If reorganization fails, retrieve the last verified project .zip archive.
* Dearchive the project to a directory covered by the new antivirus exclusions.

Verification

Verify stability of the hardware configuration editor:
1. Open SIMATIC Manager and double-click the Hardware object of the target CPU.
2. Confirm that HW Config launches instantly without Windows error prompts.
3. Make a minor modification (e.g., edit an I/O comment or spare slot), then click Save and Compile.
4. Confirm that saving completes within 5 to 15 seconds with zero crashes.
5. Close HW Config and re-open it immediately: Confirm that the window opens cleanly every time.

Limitations and Operational Precautions

Never completely disable antivirus protection on networked engineering stations; instead, apply strict, documented exclusions to protect industrial intellectual property while maintaining system stability.
Avoid using consumer-grade antivirus suites (e.g., Avast, AVG, Norton); deploy enterprise-managed solutions qualified by Siemens (such as McAfee Endpoint Security, Trend Micro Apex One, or Symantec Endpoint Protection).
Automatic signature updates must be staged and tested in an offline simulation environment before deploying to active plant engineering stations.

Engineer FAQ

Why did HW Config open through NetPro but crash from SIMATIC Manager?

SIMATIC Manager launches 's7hcfgx.exe' in full graphical editing mode, creating temporary scratch files. NetPro opens hardware in a restricted topology view using a different DLL instance, bypassing the specific file locks that triggered the crash.

Can Windows Defender cause this issue on Windows 10 / Server 2016?

Yes. Windows Defender Real-Time Protection frequently locks '.hwh' and '.dbf' files during HW Config compilation unless the project directories and Siemens processes are explicitly excluded.

What should I do if uninstalling the antivirus is against corporate IT policy?

Engage corporate IT to implement the official Siemens whitelist exclusions rather than uninstalling the software. Siemens publishes exact exclusion guides for all enterprise EDR platforms.