Resolving WinCC Auto-Diagnosis Alarm OS Handles Count Exceeded HIGH Alert Threshold

The WinCC runtime alarm 'Auto-diagnosis: OS.Handles - OS Handle Count exceeded the HIGH alert threshold' indicates an operating system kernel object leak within one or more SIMATIC PCS 7 OS processes. The WinCC Performance Monitor service continuously tracks kernel handles—including file descriptors, thread handles, event objects, and registry keys—and generates a system alert when the cumulative or process handle count breaches safe thresholds (typically 10,000 handles). Unresolved handle leaks exhaust the Windows Non-Paged Pool, resulting in unresponsive graphics designer windows, script execution lockups, or abrupt process crashes. Isolating the offending process in Task Manager and capturing a 32-bit user-mode memory dump provides the root cause evidence required for remediation.

Handle Leak Mechanics in WinCC

In Windows operating systems, a 'handle' is an opaque reference to internal kernel-managed objects such as Files, Sockets, Threads, Events, Mutexes, and Registry Keys. SIMATIC PCS 7 OS incorporates an internal diagnostic supervisor (CCPerfMon.exe / WinCC Auto-diagnosis) that registers performance counters for system health.

When an application opens an object (such as opening an ADO recordset in VBScript, opening an archive file via C-script fopen(), or querying Windows API functions) and fails to explicitly release it (Close(), fclose(), Set obj = Nothing, or CloseHandle()), the operating system retains the handle table entry indefinitely.

Process Resource Thresholds

The operating system enforces strict quotas on Windows desktop heaps and kernel resources:

Resource MetricNormal Baseline per ProcessWarning ThresholdHIGH Alert ThresholdOperational ConsequenceProcess Handles500 – 3,0008,000> 10,000 (or rapid delta)WinCC Auto-diagnosis alarm generated; risk of kernel pool exhaustionUSER Objects200 – 1,0005,000> 9,000 (Windows hard limit 10,000)GUI freezes; faceplates fail to render; window creation failureGDI Objects300 – 1,5005,000> 9,000 (Windows hard limit 10,000)Fonts corrupt; static text disappears; graphics runtime crashes

Diagnostic Procedure and Isolation

To identify which process is leaking handles in the runtime environment:

On the affected WinCC OS Server or Client station, press Ctrl + Shift + Esc to launch Windows Task Manager.
Navigate to the Details tab (Windows 10 / Server 2016) or Processes tab (Windows 7 / Server 2008 R2).
Right-click any column header and select Select columns.
Enable the checkboxes for Handles, USER Objects, GDI Objects, Threads, and Commit size.
Click the Handles column header to sort all processes in descending order.
Identify which process exhibits an abnormally high handle count (> 10,000) or displays a continuously increasing count every minute.

Common Offending WinCC Processes:
- Script.exe / GSCrt.exe: Leaks in Global Script C or VB Script routines (cyclic execution).
- PdlRuntimeHost.exe: Leaks in custom ActiveX controls or .NET controls hosted in pictures.
- CCSysHst.exe: WinCC System Historian / Alarm Logging communication buffers.
- PassMess.exe: Process Alarm / Message server handle queues.
- CCProjectMgr.exe: Project Manager database connection handles.

Capturing 32-bit Process Memory Dumps

When the leak originates within core Siemens binaries (CCSysHst.exe, PassMess.exe, CCProjectMgr.exe), an official user-mode memory dump must be collected and submitted to Siemens Technical Support via a Service Request.

[!WARNING]
Because WinCC processes are 32-bit processes executing under the WOW64 subsystem on 64-bit Windows, standard 64-bit Task Manager memory dumps capture 64-bit execution wrappers, rendering the WinCC call stack unreadable to debugging tools. You must generate a 32-bit dump.

Method 1: Using 32-bit Task Manager

Close the standard 64-bit Task Manager.
Launch 32-bit Task Manager explicitly from command line:
C:\Windows\SysWOW64\taskmgr.exe
Locate the leaking process (e.g., PassMess.exe *32).
Right-click the process name and select Create Dump File.
The dump file is written to %LOCALAPPDATA%\Temp\<process_name>.dmp.

Method 2: Using Microsoft Sysinternals ProcDump (Preferred)

Execute ProcDump directly against the target Process ID (PID):

procdump.exe -ma <PID> C:\Dumps\LeakingProcess.dmp

The -ma parameter writes a full memory dump including all handle tables, thread stacks, and heap allocations.

Verification

To verify effective remediation and confirm system stability:

After deploying script corrections or applying the relevant WinCC Update hotfix, open Windows Task Manager Details tab.
Monitor the target process handle count over an extended runtime observation window (minimum 4 to 8 hours).
Confirm that the handle count plateaus at a stable baseline (typically 1,500 – 3,500 handles) rather than continually climbing.
Open WinCC Runtime Alarm Journal (@AlarmJournal.pdl) and confirm that no further Auto-diagnosis: OS.Handles warning or high alert alarms are logged.

Limitations and Operational Precautions

Operational boundaries and diagnostic precautions:

Avoid Forcing Immediate Restarts Without Dumps: If an engineering team immediately restarts the OS server or terminates the leaking process without collecting a memory dump or handle log, the evidence required to identify the root cause is completely erased.
Do Not Disable Auto-Diagnosis: Suppressing or filtering the auto-diagnosis alarm in the WinCC Alarm Logging editor masks the underlying problem. Ignoring a handle leak will eventually crash the OS server during critical plant operations when kernel memory is exhausted.
Redundant OS Impact: If both redundant OS servers execute the same flawed cyclic client script, both servers may exhaust handles simultaneously, causing a total loss of operator visibility.

Engineer FAQ

Can an antivirus scanner cause the OS.Handles alert?

Yes. If an antivirus scanner or endpoint detection software is actively scanning WinCC runtime working directories (*.mdf, *.ldf, *.pdl, *.csv), the antivirus filter driver may hook process threads and leak file/object handles inside WinCC processes. Verify that all Siemens-specified antivirus exclusion folders and file extensions are properly configured.

At what exact number of handles does the HIGH alert threshold trigger?

The default alert threshold configured in WinCC performance monitoring is typically 10,000 handles for individual processes, or a continuous rate of increase exceeding 1,000 handles per hour.

Can custom C-scripts leak handles?

Yes. Calling OpenProcess(), CreateEvent(), or WinCC ODK API functions like DMConnect() or TLConnect() without calling the corresponding CloseHandle() or DMDisconnect() will steadily leak kernel handles on every script cycle.

What tool can inspect which specific handles are leaking?

Download Process Explorer or Handle from Microsoft Sysinternals. In Process Explorer, select the leaking process, press Ctrl + H (View Lower Pane -> Handles), and inspect whether the leaking objects are Event, Mutex, Key, File, or Directory objects.