C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Hardware Homogeneity and Lifecycle Requirements for Redundant WinCC OS Servers

Hardware Homogeneity and Lifecycle Requirements for Redundant WinCC OS Servers

In SIMATIC PCS 7 and WinCC SCADA systems, redundant OS Servers must be configured with identical hardware and software specifications. Siemens strictly prohibits 'hybrid' redundancy configurations combining an older or obsolete industrial PC (such as a legacy SIMATIC IPC) with a newer computer model. Discrepancies in CPU clock frequency, RAM bandwidth, disk I/O latency, or network interface controllers disrupt real-time archive synchronization, leading to split-brain states and failover timeouts. When expanding a single OS Server to a redundant pair whose original PC is discontinued, both stations must be replaced with two identical current-generation SIMATIC IPCs validated through an authorized Siemens distributor or the Siemens Industry Mall.

Table of Contents

Executive Summary

When expanding a standalone SIMATIC PCS 7 OS Single Station or Server (e.g., an IPC647D or IPC547E) into a high-availability redundant server architecture, engineering teams frequently attempt to procure a single modern PC (e.g., an IPC647E or IPC547J) to pair with the existing server. Because the older model is typically discontinued by Siemens, the resulting configuration is a 'hybrid' pairing of two machines with differing processor architectures, memory speeds, and storage controllers. Siemens official system specifications ('Redundancy in WinCC V7.x and WinCC Professional') explicitly mandate that redundant servers must be identical in both hardware and software. Violating this requirement compromises fault-tolerant failover, leads to tag logging synchronization failures, and renders the system unsupportable under Siemens customer service agreements.

Architecture and Fundamental Mechanics

The operational integrity of WinCC Redundancy relies on continuous, microsecond-synchronized background transactions:

1. The Redundancy Synchronization Engine

WinCC Redundancy coordinates Master and Standby OS Servers using two dedicated mechanisms:
- Cyclic Redundancy Heartbeat: Transmitted across an isolated serial or Ethernet redundancy link (using dedicated network adapters).
- Runtime Archive Synchronization: When one server experiences an outage or process perturbation, the surviving server logs all process alarms, operator actions, and Tag Logging process values into Microsoft SQL Server. Upon reconnection, the WinCC Redundancy synchronization service identifies archive gaps and executes high-speed bulk database replication across the terminal bus.

2. Failure Modes of Hybrid Hardware Architectures

Pairing disparate hardware configurations introduces severe operational instabilities:
- Database Commit Timing Skew: A newer server equipped with NVMe solid-state storage and faster RAM commits SQL transactions significantly faster than a legacy hard-drive-based machine. During bulk archive synchronization, the slower server can encounter buffer overruns, causing the database replication engine to timeout and abort synchronization repeatedly.
- Dynamic Failover Delays: If the master server fails, the standby must detect the loss within configured timeouts (typically 2 to 5 seconds). Hardware latency discrepancies can cause race conditions where both servers declare themselves Master or both remain in Standby.
- Driver and Operating System Incompatibilities: Differing motherboard chipsets and network interface controllers (NICs) mandate different Windows driver stacks, precluding unified system image backups and synchronized patch management.

Step-by-Step Implementation Procedure

To properly expand a standalone OS Server to a compliant redundant architecture:

Step 1: Perform System Life Cycle Evaluation

  1. Inspect the MLFB and serial number of the existing OS Server (e.g., 6AG4104-2AR22-4PX0).
  2. Check the product lifecycle status in the Siemens Industry Mall. If the model is marked 'End of Lifecycle' or 'Discontinued', plan for full replacement.
  3. Procure two identical current-generation SIMATIC IPC server stations (e.g., two SIMATIC IPC647E or IPC547J units) featuring identical CPU, RAM, storage, and CP1623 communication cards.

Step 2: Procure and Transfer Redundancy Licenses

  1. Procure the SIMATIC PCS 7 OS Software Server Redundancy option license package (6ES7658-2CX...).
  2. Note that each redundant server requires its own base SIMATIC PCS 7 OS Software Server runtime license matching the required Process Object (PO) count.
  3. Install the licenses onto both servers using Automation License Manager (ALM).

Step 3: Hardware and Network Setup

  1. Install identical Windows operating system versions and service packs (e.g., Windows Server 2016 or Server 2019 Standard) on both machines.
  2. Configure identical network interface cards (NICs):
    - Terminal Bus NIC on each server.
    - Plant Bus CP1623 on each server.
    - Redundancy link NIC (cross-cable or dedicated switch connection).
  3. Ensure computer names, IP addressing schemes, and Windows user accounts (SIMATIC HMI, SIMATIC NET) are configured symmetrically.

Step 4: Configure Redundancy in WinCC Explorer

  1. In SIMATIC Manager on the Engineering Station, configure the redundant partner in the OS Server object properties.
  2. Open WinCC Explorer on the master server -> Redundancy editor.
  3. Select the partner server, define the dedicated network connection for redundancy monitoring, and enable 'Activate Redundancy'.
  4. Execute an OS compilation and download the projects to both Server 1 and Server 2.

Verification

To verify robust redundant operation:

  1. Heartbeat and Status Verification:
    - Start WinCC Runtime on Server 1 (Master) and Server 2 (Standby).
    - In WinCC Explorer, monitor internal system tags @RedundancyState and @ServerName to verify clean Master/Standby negotiation.

  2. Failover and Archive Gap Synchronization Test:
    - Disconnect the network cable from Server 1. Confirm that OS Clients switch seamlessly to Server 2 within 3 seconds without process loss.
    - Generate alarms and trend data on Server 2 while Server 1 is offline.
    - Reconnect Server 1. Observe that Server 1 starts archive synchronization.
    - Inspect C:\Program Files (x86)\Siemens\WinCC\Diagnose\WinCC_Sys_01.log and confirm message: Redundancy: Archive synchronization finished successfully.

Limitations and Operational Precautions

Operational limitations and precautions:

  1. No Virtual-to-Physical Hybrid Redundancy: Pairing a physical IPC with a virtualized OS Server (ESXi) is strictly prohibited by Siemens guidelines.
  2. Different Clock Speeds: Even small clock-drift differences between disparate motherboard crystal oscillators can cause time-tagging anomalies unless central NTP synchronization is enforced.
  3. OS Client Re-Targeting: OS Clients must have redundant server data packages assigned to enable automatic server failover.
  4. Commercial Disclaimer: Verify all hardware configurations, IPC models, and software licensing packages with an authorized Siemens distributor or the Siemens Industry Mall.

Engineer FAQ

Can I pair an old SIMATIC IPC with a new IPC model for WinCC redundancy?

No. Siemens explicitly mandates that redundant servers must have identical hardware and software configurations. Hybrid configurations are not supported.

What is the risk of using different computers in a redundant server pair?

Disparate hardware causes archive synchronization timeouts, database replication failures, and potential split-brain conditions where both servers become master.

Does WinCC Redundancy require a separate license on each server?

Yes. Both servers require an OS Software Server runtime license, and the WinCC Redundancy option license must be installed on each server station.

What hardware is recommended for connecting the redundancy link?

Siemens recommends a dedicated Ethernet connection (using a cross-over cable or an isolated switch port) exclusively reserved for redundancy monitoring and synchronization.

What should be done when an existing server PC is obsolete and fails?

Both redundant servers should be upgraded together to two identical, current-generation SIMATIC IPCs as part of routine life cycle management.

Technical References

Related Articles

Related Tags

  • WinCC Redundancy
  • OS Server
  • Hardware Homogeneity
  • SIMATIC IPC
  • Lifecycle Management
20 respuestas