Architectural Strategies for Remote Monitoring Across Disparate PCS 7 V8.0 and V9.0 Systems

Integrating remote, view-only monitoring across geographically separated PCS 7 systems running disparate software versions (such as PCS 7 V8.0 and V9.0 located 2 kilometers away) cannot be accomplished using native OS Client multi-server packages, because PCS 7 strictly prohibits client-server communication across different major versions. The manufacturer-approved architecture requires deploying SIMATIC PCS 7 Web Option (WinCC WebNavigator / WebUX) servers on each respective OS Server cluster, connected across an industrial fiber optic network (via SCALANCE X-300 managed switches) and segregated by a SCALANCE S security firewall. The remote monitoring workstation runs multiple browser tabs or independent WinCCViewerRT sessions connecting to the V8.0 and V9.0 web servers simultaneously, with user accounts assigned strictly read-only authorization.

Executive Summary

Process industrial facilities frequently expand over decades, resulting in distinct production units operating on different PCS 7 software generations (for instance, an older plant area on PCS 7 V8.0 SP1 and a new unit on V9.0 SP3). When operators or plant management require consolidated, view-only monitoring at a centralized control center or administrative office 2 km away, naive approaches—such as connecting a single PCS 7 OS Client to both servers or opening unconstrained Remote Desktop (RDP) sessions—violate engineering guidelines and risk runtime crashes. Deploying WinCC WebNavigator servers in each environment, interfaced through industrial security appliances and managed fiber switches, provides seamless, concurrent multi-version visualization without compromising plant safety or control authority.

Architecture and Fundamental Mechanics

The communication architecture for cross-version remote monitoring is governed by strict compatibility, networking, and visualization boundaries:

Version Isolation and OS Client Constraints:
* In PCS 7 distributed systems, an OS Client loads Server Data packages (.pck) generated by OS Servers. Internal communication relies on proprietary WinCC channel protocols and DCOM interfaces.
* Siemens compatibility guidelines mandate that OS Clients and OS Servers must share the identical PCS 7 version, service pack, and update level. An OS Client cannot concurrently load or visualize packages from both a V8.0 and a V9.0 server.
RDP Hazards in WinCC Runtime:
* Microsoft Remote Desktop Protocol (RDP) establishes a virtual user session (Session 1+) that detaches the local console display (Session 0). In PCS 7 OS Single Stations or OS Servers, initiating an RDP session interrupts WinCC Graphics Runtime (pdlrt.exe) and breaks OPC server connections.
* RDP is only permitted for engineering maintenance on dedicated Engineering Stations or when accessing a specialized WebNavigator Terminal Server.
WinCC WebNavigator / WebUX Solution:
* Decoupled Client Execution: WebNavigator servers translate WinCC graphic screens (.pdl) into web-deliverable vector/ActiveX objects, while WebUX delivers HTML5/SVG pages.
* Multi-Instance Capability: A standard Windows 10/11 workstation at the remote site can execute two independent WinCCViewerRT.exe processes or browser instances—one connected to https://os_server_v80/ and the other to https://os_server_v90/. Because the client relies on HTTP/HTTPS, version differences between the back-end servers do not conflict on the client workstation.
Long-Distance Physical and Network Infrastructure (2 km):
* Standard twisted-pair copper Ethernet (100Base-TX) has a strict 100-meter physical distance limit.
* Bridging a 2-kilometer span requires Single-Mode (9/125 µm) or Multi-Mode (50/125 µm) industrial optical fiber cables terminated into SCALANCE X-200 or X-300 managed industrial Ethernet switches equipped with optical transceiver ports (SFP modules).
* Network segregation must be enforced using a perimeter security appliance (e.g., SCALANCE S615 or SC636-2C) implementing stateful firewall rules to isolate the plant bus/terminal bus from administrative networks.

Step-by-Step Implementation Procedure

Follow these architectural and configuration steps to implement cross-version remote monitoring:

Physical and Network Infrastructure Setup:
* Install single-mode fiber optic cabling between the automation server rooms and the remote monitoring building (2 km distance).
* Terminate fiber into industrial managed switches: deploy a SCALANCE X308-2 or XC206-2SFP at each location.
* Configure dedicated VLANs for terminal bus traffic and remote monitoring traffic.
* Place a SCALANCE S615 firewall at the network boundary, configuring firewall rules to permit only HTTPS (TCP port 443) or WebNavigator communication (TCP port 80/443) from the remote monitoring subnet.
Configure WinCC WebNavigator on OS Server V8.0 and V9.0:
* On both the V8.0 OS Server (or dedicated Web Server) and the V9.0 OS Server, install the WinCC WebNavigator Server package matching the local PCS 7 version.
* Run the Web Configurator in WinCC Explorer to create the default IIS web site and bind the SSL/TLS certificate.
* Open the WinCC graphics editor (Graphics Designer) and publish the desired process screens (.pdl) using the Web Publishing Wizard.
Configure User Authorization (View-Only Rights):
* In WinCC Explorer on each server, open User Administrator.
* Create a dedicated user account (e.g., Remote_Monitor).
* Grant authorization for 1: User Administration (disabled), 2: Authorization for area (enabled for viewing), and leave 5/6: Process controlling / Higher process controlling unchecked.
* In WebNavigator user properties, set the start screen and verify that operator input controls are deactivated.
Set Up the Remote Monitoring Workstation:
* Deploy a multi-monitor industrial PC or commercial workstation at the remote monitoring facility.
* For WebNavigator: Install the matching WebNavigator client components or use WinCCViewerRT.
* Create two desktop shortcuts pointing to independent configurations:
- Shortcut 1: WinCCViewerRT.exe connecting to https://<V8_Server_IP>/
- Shortcut 2: WinCCViewerRT.exe connecting to https://<V9_Server_IP>/
- Arrange the display windows across the multi-monitor setup for concurrent real-time viewing.

Verification

Test the remote station by launching both viewer instances simultaneously. Confirm that process values update dynamically from both the V8.0 and V9.0 systems without network lag or dropouts. Attempt to click an APL faceplate or setpoint entry field from the remote viewer; verify that the user authorization system prevents any operator commands or setpoint modifications, confirming strict view-only compliance.

Limitations and Operational Precautions

Do not attempt to use commercial remote access tools (such as TeamViewer, AnyDesk, or standard VNC) on critical plant servers without network firewalls and Siemens compatibility approval (Kompatool). If using RealVNC, ensure it is configured for console mirroring only and restricted by firewall policies. For legal and cybersecurity compliance, remote access networks must conform to IEC 62443 defense-in-depth principles.

Engineer FAQ

Can a single PCS 7 OS Client connect to both a V8.0 and V9.0 server?

No. PCS 7 OS Clients and OS Servers must share the exact same software version and service pack. Cross-version client-server package loading is unsupported.

Why is Windows RDP forbidden on WinCC OS Servers?

RDP creates an independent virtual session (Session 1+) that disconnects the console session (Session 0), freezing WinCC runtime graphics and disrupting internal communication channels.

Can WebUX be used instead of WebNavigator?

Yes. WinCC WebUX delivers pure HTML5 and SVG graphics that run on modern web browsers (Chrome, Edge, Safari) without requiring ActiveX plugins or client software installations.

What optical fiber is required for a 2 km distance?

Single-mode fiber (9/125 µm) with 1000Base-LX transceivers is recommended for a 2 km industrial run to ensure high bandwidth, zero electromagnetic interference, and low signal attenuation.