C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Resolving WinCC Runtime Freeze and SCRIPT.EXE Crash 0xc0000374 in Maintenance Station Diagnostic Screens

Resolving WinCC Runtime Freeze and SCRIPT.EXE Crash 0xc0000374 in Maintenance Station Diagnostic Screens

In SIMATIC PCS 7 V9.0 SP3, when clicking diagnostic group display buttons (such as PC_STAT_OV or Field_COMP_OV) causes WinCC Runtime to freeze and crash SCRIPT.EXE with exception code 0xc0000374 (ntdll.dll heap corruption), the fault is caused by an unassigned Maintenance Station Host in the multiproject. When S7Project.MaintenanceHost is empty, the Asset Management engine (COSStateMachineApp) fails to initialize its IVAR2 interface, attempting to query uninitialized pointer memory and crashing the C-script thread. To resolve this: 1) In SIMATIC Manager Plant Hierarchy or Component View, assign a valid Maintenance Station Host to the MS project properties; 2) Ensure valid Maintenance RT licenses are installed in ALM; 3) In SIMATIC Manager, re-execute 'Creating/updating the diagnostic screens'; and 4) Recompile and download the OS.

Table of Contents

Executive Summary

Plant asset management in SIMATIC PCS 7 relies on the Maintenance Station (MS) to monitor controller hardware, remote I/O modules, intelligent field instruments, and industrial PC stations. On an OS Single Station running PCS 7 V9.0 SP3 UC03 on Windows Server 2016 Datacenter, engineers observed that navigating to diagnostic overview screens by clicking group display buttons (PC_STAT_OV, Field_COMP_OV) caused WinCC Runtime to freeze completely. Attempting to deactivate runtime deadlocked on Script Server. Windows Event Viewer recorded SCRIPT.EXE crashing in ntdll.dll with exception code 0xc0000374 (Heap Corruption). This guide analyzes the OSSTATEMACHINEX_1.log diagnostic traces, identifies the unassigned Maintenance Host vulnerability, and details the restoration procedure.

Architecture and Fundamental Mechanics

Maintenance Station State Machine Architecture and Heap Crash Analysis

+-------------------------------------------------------------------------+
|                        WinCC Operator Station Runtime                   |
|                                                                         |
|   [Operator clicks 'PC_STAT_OV' (PC Station Diagnostic Overview)]       |
+-----------------------------------|-------------------------------------+
                                    |
                                    v C-Action Call: GTI APEndAct
+-------------------------------------------------------------------------+
|               Maintenance State Machine: COSStateMachineApp             |
|                                                                         |
|   Diagnostic Log (OSSTATEMACHINEX_1.log):                               |
|   - [SAM ASOS] Critical error: 'S7Project.MaintenanceHost' is empty!    |
|   - [SAM OSStateM] COSStateMachineApp::WriteLicenceTag() failed: @LCvalid|
|   - [SAM] ReadWinCCTag() failed: <DIAG_OWS1.MaintenanceState>          |
|   - COSStateMachineApp::InitIVAR2Interface() returns Null Pointer       |
+-----------------------------------|-------------------------------------+
                                    |
                                    v Memory Buffer Overrun
+-------------------------------------------------------------------------+
|                      Windows ntdll.dll Heap Corrupter                   |
|                                                                         |
|   SCRIPT.EXE attempts to read string buffer from NULL pointer:          |
|   - Exception Code: 0xc0000374 (STATUS_HEAP_CORRUPTION)                 |
|   - SCRIPT.EXE process terminates abruptly                              |
|   - WinCC Runtime graphics freeze / Deactivation hangs indefinitely!    |
+-------------------------------------------------------------------------+

The Anatomy of the 0xc0000374 Crash

  1. S7Project.MaintenanceHost is empty!: When diagnostic screens are generated, the compilation wizard embeds internal tag queries to evaluate the overall health of PC stations and network components. If the Engineering Station multiproject does not have a designated Maintenance Station Host configured in the Plant Hierarchy, the target tag @MaintenanceHost is created with an empty or uninitialized string.
  2. License Tag Failure (@LCvalid): The maintenance state machine checks for the runtime license SIMATIC PCS 7 Maintenance Station RT. If the license is missing or if the query fails, the script continues down an unhandled failure path.
  3. Heap Corruption: In PCS 7 V9.0 SP3 base scripts, COSStateMachineApp lacked null-pointer validation when reading IVAR2 callback interfaces for unconfigured IPC stations. Passing an uninitialized tag handle into ntdll.dll corrupts the WinCC script heap, causing the immediate crash.

Step-by-Step Implementation Procedure

Step 1: Designate Maintenance Station Host in SIMATIC Manager

  1. On the Engineering Station, open SIMATIC Manager.
  2. In Component View, locate the PC Station intended to act as the Maintenance Station (e.g., your OS Single Station).
  3. Right-click the PC Station and open Object Properties.
  4. Ensure the station is assigned the role Maintenance Station (or verify that under Plant Hierarchy Properties, the Maintenance Station tab assigns this PC as the central Maintenance Host).
  5. Open the Plant Hierarchy folder, right-click the top-level plant node, and select Plant Hierarchy > Settings....
  6. Under the Maintenance Station section, ensure Maintenance Host is explicitly selected from the dropdown (do not leave blank).

Step 2: Verify Maintenance Station Licenses in ALM

  1. Open Automation License Manager (ALM) on the Engineering Station and target OS stations.
  2. Verify the following licenses are installed and valid (OK):
    - On ES: SIMATIC PCS 7 Maintenance Station Engineering
    - On OS Single Stations / Servers: SIMATIC PCS 7 Maintenance Station Runtime
  3. Note: If maintenance licenses are missing, order the appropriate package through an authorized Siemens distributor or the Siemens Industry Mall.

Step 3: Regenerate Diagnostic Screens via Wizard

  1. In SIMATIC Manager, select the top-level plant folder in the Plant Hierarchy.
  2. In the menu bar, select Options > Plant Hierarchy > Create/Update Diagnostic Screens....
  3. In the diagnostic screen wizard:
    - Select the target OS where diagnostic screens will reside.
    - Ensure all AS controllers and PC stations are included in the asset scope.
  4. Click OK to run the complete diagnostic generation.
  5. The wizard will regenerate @PC_STAT_OV.pdl, @Field_COMP_OV.pdl, and correctly initialize all @MaintenanceHost structure tags.

Step 4: Recompile and Delta Download the OS

  1. Right-click the OS project in SIMATIC Manager and select Compile.
  2. Choose Scope: Entire OS (to ensure all diagnostic tags and pictures refresh) or Changes only if previously compiled.
  3. Download the OS project to the target PC station.
  4. Restart WinCC Runtime.

Verification

  1. Log Inspection: On the OS station, open C:\Program Files (x86)\Siemens\WinCC\Diagnostics\OSSTATEMACHINEX_1.log. Confirm that the line S7Project.MaintenanceHost is empty! no longer appears and that initialization reports Status: Connected.
  2. Diagnostic Screen Navigation: In WinCC Runtime, click on PC_STAT_OV and Field_COMP_OV. Confirm that the diagnostic overview pictures open instantly without freezing or lagging.
  3. Process Monitor Audit: In Windows Task Manager, monitor SCRIPT.EXE. Verify that memory utilization remains stable and CPU usage settles back to <1% after opening asset faceplates.

Limitations and Operational Precautions

  1. Update Collection Prerequisite: Siemens addressed internal string buffer overflows in SCRIPT.EXE across subsequent update collections; always ensure PCS 7 V9.0 SP3 has the latest Update Collection (e.g., UC04 or higher) applied.
  2. Virtual Machine Graphics Rendering: On virtualized Windows Server 2016 Datacenter instances, verify that VMware Tools graphics acceleration is enabled to prevent GDI rendering timeouts.

Engineer FAQ

What does exception code 0xc0000374 mean?

It is the Windows NT status code for STATUS_HEAP_CORRUPTION, indicating that a process corrupted memory heap structures before crashing.

Why does clicking PC_STAT_OV freeze WinCC Runtime?

SCRIPT.EXE crashes in ntdll.dll due to heap corruption caused by an unassigned Maintenance Station Host, deadlocking the C-script engine.

What does 'S7Project.MaintenanceHost is empty' mean?

The Plant Hierarchy properties do not have a designated Maintenance Station Host assigned to manage diagnostic asset screens.

Where do I assign the Maintenance Station Host?

In SIMATIC Manager under Plant Hierarchy > Settings > Maintenance Station tab, or in PC Station Properties.

What licenses are required for Maintenance Station?

Maintenance Station Engineering license on the ES and Maintenance Station Runtime license on each OS server or single station.

What does 'Creating/updating the diagnostic screens' do?

It parses the hardware configuration and plant hierarchy to automatically generate all WinCC maintenance screens and diagnostic tags.

Why did deactivating runtime hang on Script Server?

Because SCRIPT.EXE had crashed in a deadlock, preventing the WinCC shutdown manager from safely unloading the script engine.

Does this issue occur in PCS 7 V8.2?

PCS 7 V8.2 on Windows 7 used different C-runtime libraries that did not crash with heap corruption under identical unassigned conditions.

Where is OSSTATEMACHINEX_1.log located?

In the WinCC project directory or inside C:\Program Files (x86)\Siemens\WinCC\Diagnostics\.

How do I update diagnostic screens after adding new hardware?

Re-run Options > Plant Hierarchy > Create/Update Diagnostic Screens in SIMATIC Manager.

Technical References

Related Articles

Related Tags

  • Maintenance Station
  • SCRIPT.EXE
  • 0xc0000374
  • Heap Corruption
  • PC_STAT_OV
  • Diagnostic Screens
  • PCS 7 V9.0 SP3
20 respuestas