Deploying SIMATIC PCS 7 on Virtual Machines (SIVaaS) with HP Thin Clients and Remote Access Guidelines

In SIMATIC PCS 7 virtualized environments (such as SIMATIC Virtualization as a Service - SIVaaS with VMware ESXi), connecting operator HP Thin Clients to active WinCC OS stations via Microsoft Remote Desktop Protocol (RDP) is strictly prohibited because RDP hijacks the console session, disrupts WinCC graphics hardware rendering, and can cause runtime script crashes. Certified remote access methodologies require either VMware Horizon View (using PCoIP or Blast Extreme) or RealVNC Enterprise Edition, which mirror the physical console session without display driver disruption. On HP Thin Clients running Windows Embedded, installation failures are resolved by redirecting the TEMP environment variable to the uncompressed local drive.

Why Microsoft RDP is Strictly Prohibited on Active WinCC Stations

As industrial facilities adopt SIMATIC Virtualization as a Service (SIVaaS) and VMware ESXi, physical operator PCs are increasingly replaced with centralized virtual machines (VMs) running on datacenter hypervisors, paired with HP Thin Clients on the plant floor.

A frequent and dangerous commissioning mistake occurs when engineers attempt to connect thin clients to WinCC OS Servers or Single Stations using standard Microsoft Remote Desktop Protocol (RDP):
* Siemens official documentation explicitly and strictly prohibits RDP connections to active WinCC runtime stations.
* Session Takeover Mechanism: RDP does not mirror the active display; it creates an isolated virtual terminal session and locks the local console.
* Graphics Driver Virtualization: RDP swaps out the active graphics driver for the Microsoft RDP display driver, terminating hardware acceleration, corrupting DirectDraw buffers, and causing WinCC Graphics Designer or runtime controls (@PG_... faceplates) to freeze or fail.
* Sound and Script Disruption: When an RDP session disconnects, audio devices detach, silencing critical acoustic horn alarms. WinCC background C-scripts and VBScripts that query window handles can crash, causing loss of plant visualization.

Certified Remote Access Technologies in SIVaaS (Horizon View vs RealVNC)

Siemens has rigorously validated and certified two remote access solutions for virtualized PCS 7 environments:

1. VMware Horizon View (PCoIP / Blast Extreme)

The primary enterprise thin-client delivery solution in SIVaaS architectures.
Uses the high-performance PC-over-IP (PCoIP) or VMware Blast Extreme protocols.
Communicates directly with the hypervisor frame buffer without session hijacking.
Delivers high-frame-rate, sub-millisecond operator mouse responsiveness and lossless vector graphic rendering across the Terminal Bus.

2. RealVNC Enterprise Edition

Documented in Siemens Industry Online Support Entry ID 109485969.
RealVNC Enterprise Edition is officially certified for WinCC OS Stations.
Console Mirroring: Unlike RDP, VNC connects directly to Session 0 (the console session), acting as a physical monitor extender.
Does not alter graphics drivers, preserves audio horn alerts, and allows seamless multi-operator interaction without triggering script terminations.

Comparison Table - Remote Access Technologies for PCS 7

The following table compares remote access technologies evaluated for SIMATIC PCS 7 virtualized systems.

Remote Access ProtocolConsole Session 0 MirroringAlters Display Drivers?Acoustic Horn SupportSiemens Certification StatusRecommended Use CaseVMware Horizon ViewYes (Direct frame buffer)NoFully SupportedCertified (SIVaaS Standard)Dedicated thin-client operator consolesRealVNC EnterpriseYes (Pure Session 0)NoFully SupportedCertified (SIOS 109485969)Thin clients, diagnostic laptops, remote ESMicrosoft RDPNo (Creates terminal session)Yes (Replaces driver)Drops on disconnectStrictly ProhibitedNever on active WinCC RuntimeWinCC Web NavigatorNot applicable (Web client)No (Local IE engine)SupportedCertified (Web Thin Client)Office users, supervisors, tablets

Resolving HP Thin Client Installation and RAM Disk Bottlenecks

When deploying HP Thin Clients (such as HP t520, t620, or t630) running Windows Embedded Standard 7 (WES7) or HP ThinPro Linux, engineers frequently encounter installation failures when attempting to install the VMware Horizon View Client or vSphere Client:
* The installer fails silently or throws an Insufficient disk space error despite the system showing available storage.

The Underlying Bottleneck

Windows Embedded utilizes an active RAM Disk for temporary storage to protect the write-protected flash memory (File-Based Write Filter - FBWF):
* The system %TEMP% and %TMP% environment variables point to Z:\Temp (a volatile RAM drive typically sized at only 512 MB).
* Large enterprise client installers (like vSphere Client or Horizon View) extract multi-gigabyte installer payloads, overflowing the RAM disk and aborting without descriptive error messages.

The Resolution Procedure

Disable the File-Based Write Filter (FBWF):
* Click the FBWF lock icon in the Windows taskbar and select Disable Write Filter & Reboot.
Relocate Windows TEMP Environment Variables:
* Open Control Panel -> System -> Advanced System Settings -> Environment Variables.
* Under System Variables, edit TEMP and TMP.
* Change paths from Z:\Temp to a permanent folder on the local drive: C:\Temp.
Install Client in Uncompressed Directory:
* In C:\Program Files, ensure the target directory is uncompressed (disable NTFS folder compression).
* Run the VMware Horizon View or vSphere installer with administrative rights. The installation proceeds smoothly.
Re-Enable the Write Filter:
* Once software installation and network configuration are verified, re-enable the FBWF to protect thin client flash storage from wear.

Verification

Confirm that thin-client remote visualization is fully functional and compliant:

Verify Session 0 Console Connection:
* Connect to the WinCC VM from the HP Thin Client using VMware Horizon View or RealVNC.
* Open a command prompt (cmd.exe) in the VM and run: query user.
* Confirm that the active session is designated as Console (Session ID 0), not an RDP-TCP session.
Test Operator Faceplate Responsiveness:
* In WinCC Runtime, open multiple high-density graphics pictures and APL faceplates (@PG_MotSpdCL.pdl).
* Confirm smooth slider movement, instantaneous button responsiveness, and zero graphical tearing.
Verify Acoustic Horn Functionality:
* Trigger a high-priority plant alarm.
* Confirm that the audible alarm tone sounds crisply through the HP Thin Client internal speaker or connected audio output.

Limitations and Operational Precautions

Prohibition of Commercial VNC Variants: Use only RealVNC Enterprise Edition officially released by Siemens. Freeware VNC variants (TightVNC, UltraVNC) lack verified encryption, security auditing, and compatibility with WinCC service architectures.
Bandwidth Allocation on Terminal Bus: Ensure each VMware Horizon thin client session is provisioned with 10 to 20 Mbps of dedicated network bandwidth on the Terminal Bus to guarantee seamless graphic streaming.
Redundant VM Host Placement: Never host both redundant WinCC OS Servers (OS1 and OS1_Stby) on the same physical ESXi hypervisor server; host hardware failure would result in a total plant blackout.

Engineer FAQ

Can I use VMware vSphere Client as an operator interface?

While vSphere Client console provides direct VM access, it is designed strictly for hypervisor administration, not process operation. It lacks multi-monitor layout management, full-screen kiosk locking, and optimal audio redirection.

Why does WinCC crash when RDP is disconnected?

When an RDP window is closed without logging off, Windows suspends the GDI display device context. WinCC runtime graphics engines attempting to render animations into a suspended display context trigger unhandled memory exceptions.

Does VMware Horizon View require additional licenses?

Yes. VMware Horizon View is licensed per concurrent user or per device. When procured through Siemens SIVaaS, these licenses are bundled as part of the virtualization package.

Can HP Thin Clients boot directly into WinCC full-screen kiosk mode?

Yes. Using the HP ThinUpdate utility and Windows Embedded Shell Launcher, thin clients can be configured to auto-logon and launch VMware Horizon directly into full-screen WinCC without exposing the underlying desktop.