Compatibility and Guidelines for Using UltraVNC and RealVNC with SIMATIC PCS 7

While RealVNC Enterprise Edition has historically been the sole certified remote desktop application for SIMATIC PCS 7 OS Servers, Siemens officially released UltraVNC V1.3.8.1 starting with PCS 7 V9.1 SP2. On critical stations hosting server services (OS Servers, Maintenance Stations, and WebNavigator hosts), using unreleased remote desktop or generic VNC software risks terminating WinCC background services, causing DCOM disconnections, and corrupting graphic rendering. For standard OS Clients without server roles, remote access restrictions are less critical, but production installations must adhere to the Siemens Compatibility Tool.

Certified Remote Desktop Architectures for Industrial Systems

In SIMATIC PCS 7 Distributed Control Systems, establishing remote engineering and operator access requires strict software compatibility validation. Unlike standard IT environments, industrial Human-Machine Interface (HMI) servers execute low-latency graphic subsystems, direct hardware video rendering, and multi-threaded database transactions.

Siemens publishes certified remote access guidelines documented under SIOS Entry ID 78463889:
* RealVNC (Enterprise Edition): Historically the sole remote access software officially tested and approved by Siemens for connection to PCS 7 Engineering Stations (ES), OS Servers, OS Clients, and WebNavigator servers.
* Standard Windows Remote Desktop Protocol (RDP): Prohibited on active OS Servers and ES because opening a standard Windows RDP session creates a virtual desktop session that disconnects the console session (Session 0), suspending WinCC DirectX screen management and terminating active alarm horn annunciators.
* UltraVNC: Long considered an unreleased third-party tool, UltraVNC gained formal Siemens testing and was officially released starting with PCS 7 V9.1 SP2 (specifically version UltraVNC V1.3.8.1).

Technical Risks of Unapproved VNC Software on OS Servers

Deploying open-source or uncertified VNC distributions (such as TightVNC or legacy UltraVNC builds) on PCS 7 V9.0 stations introduces measurable operational hazards:

Mirror Driver and DirectX Surface Collisions: Many VNC packages install virtual display mirror drivers that intercept Windows Graphical Device Interface (GDI) calls. These drivers can conflict with the WinCC Graphics Designer engine (GCSAdmin.exe) and DirectX rendering pipelines, causing graphic tearing, black screens, or WinCC Explorer crashes.
Destabilization of WinCC Server Services: OS Servers host critical background services (CCProjectMgr.exe, CCDataServer.exe, and SQL Server instances). A remote application that crashes or mismanages Windows user session handles can terminate parent server processes, severing client-server communication across the entire plant.
Keyboard and Mouse Event Deadlocks: Industrial faceplates and interlocks rely on precise mouse-down and mouse-up event tracking. Unreleased VNC servers can drop mouse-release events during network packet jitter, inadvertently latching jog buttons or manual valve open commands in the PLC.

Release Status: RealVNC vs. UltraVNC across PCS 7 Versions

When selecting remote software, adhere to the certified matrix:

PCS 7 VersionRealVNC SupportUltraVNC SupportMicrosoft RDP SupportPCS 7 V8.x / V9.0RealVNC Enterprise (Released)Not Approved / UnreleasedRestricted to Web/Office ClientsPCS 7 V9.1 / V9.1 SP1RealVNC Enterprise (Released)Not Approved / UnreleasedRestricted to Web/Office ClientsPCS 7 V9.1 SP2+RealVNC Enterprise (Released)UltraVNC V1.3.8.1 (Released)Restricted to Web/Office Clients

For OS Clients that do not host server services, WebNavigator engines, or engineering databases, the risk of remote tool conflicts is significantly lower. However, maintaining uniformity across the fleet simplifies cybersecurity compliance and software lifecycle auditing.

Verification

Open the Siemens Compatibility Tool (https://support.industry.siemens.com/kompatool).
Select your exact PCS 7 release (e.g., V9.1 SP2) and add UltraVNC or RealVNC to the evaluation list. Confirm that the tool reports Compatible.
After installing the approved VNC version, establish a remote session to the OS Server while WinCC Runtime is active.
Verify that:
WinCC OnlineTrendControl curves render smoothly without frame rate drops.
Clicking and holding operator faceplate buttons tracks release events deterministically.
Windows Event Viewer logs no GDI32.dll or WinCC crash events.

Limitations and Operational Precautions

Always configure VNC encryption (e.g., SecureVNC plugin or SSH/TLS tunneling). Transmitting unencrypted RFB protocol packets across corporate networks exposes operator passwords and plant screens to network sniffing.
Restrict VNC server listening ports (default TCP 5900) to authorized management subnets using Windows Defender Firewall rules.
Never use Windows RDP to access an active single-station OS or redundant OS server during plant operations.

Engineer FAQ

Why does Microsoft Remote Desktop (RDP) cause problems on WinCC servers?
RDP creates a separate, virtualized user session (Session 1+) and locks the physical console (Session 0). WinCC Runtime is tightly coupled to Session 0; shifting sessions suspends graphical scripts and alarm horn drivers.
Can I use UltraVNC on PCS 7 V9.0 if purchasing RealVNC is delayed?
While many integrators report success using UltraVNC on V9.0 without incident, it is technically unreleased for that version. If a server crash occurs, Siemens Customer Support will require reproducing the issue without UltraVNC installed.
Does WebNavigator require VNC?
No. WinCC WebNavigator provides thin-client browser access over HTTPS/HTTP without requiring any VNC software on the server.

Technical References

Siemens Industry Online Support Entry ID 78463889: Remote Access to PCS 7 Systems (VNC, RDP, and Thin Clients).
Siemens Compatibility Tool for Industrial Software and Operating Systems.
SIMATIC PCS 7 Security Concept and Remote Access Guidelines.