How to Deploy Redundant SIMATIC PCS 7 OS Servers and Clients on VMware vSphere ESXi Virtual Infrastructure

Deploying SIMATIC PCS 7 V8.1 OS Servers and Clients in a virtualized VMware vSphere ESXi environment requires strict adherence to Siemens industrial virtualization guidelines. To guarantee high availability, redundant OS Server pairs must never execute on the same physical ESXi hypervisor; they must be distributed across two independent physical hosts using VMware DRS anti-affinity rules ('Separate Virtual Machines'). Each OS virtual machine requires dedicated virtual switches (vSwitches) utilizing high-performance VMXNET3 adapters mapped to physical NICs, segregating the Plant Bus, Terminal Bus, and Redundancy Link with link-state tracking to ensure reliable redundancy failover.

Siemens Official Certification and Compatibility for VMware ESXi

Virtualization of SIMATIC PCS 7 control system components delivers substantial lifecycle benefits: reduced physical hardware footprint, simplified disaster recovery snapshots, hardware-independent operating system migrations, and centralized server management.

When selecting hypervisor platforms:
* PCS 7 V8.1 Official Release: Formally certified and supported on VMware vSphere / ESXi 5.5.
* Deploying on ESXi 6.0 / 6.0 U1: While ESXi 6.0 became the certified standard in PCS 7 V8.2, extensive field deployments demonstrate that PCS 7 V8.1 virtual machines execute reliably on ESXi 6.0/6.5, provided virtual hardware specifications match published Siemens virtualization guidelines.
* Supported virtual nodes include: OS Servers (Single and Redundant), OS Clients, Engineering Stations (ES), Process Historian, Information Server, and OpenPCS 7 stations.

Host Distribution and VMware DRS Anti-Affinity Rules

The most critical rule when virtualizing redundant PCS 7 OS server pairs:

The Single-Point-of-Failure Trap: If both virtual machines (e.g., VM_OS_Server1 and VM_OS_Server2) run on the same physical server blade, a physical power supply fault, motherboard crash, or hypervisor kernel panic will obliterate both servers simultaneously, leaving plant operators blind.
Mandatory Host Separation:
Redundant OS servers must reside on separate physical ESXi hosts connected to independent uninterruptible power supplies (UPS).
Configuring Anti-Affinity Rules in vCenter:
1. Open VMware vSphere Web Client and select the DRS Cluster.
2. Navigate to Manage > Settings > Configuration > VM/Host Rules.
3. Click Add... and create a rule named AntiAffinity_PCS7_OS_Servers.
4. Type: Select Separate Virtual Machines.
5. Add VM_OS_Server1 and VM_OS_Server2.
6. VMware DRS will ensure these two VMs are never scheduled onto the same physical ESXi hypervisor, even during automatic resource rebalancing.

Virtual Network Architecture: Plant Bus, Terminal Bus, and Redundancy Link

To maintain deterministic industrial communications without packet collisions, configure three distinct Virtual Switches (vSwitches) or Portgroups:

Terminal Bus vSwitch:
* Bridges OS Clients, OS Servers, and the ES.
* Bound to a dedicated physical 1 Gbps NIC uplink on each ESXi host.
Plant Bus vSwitch:
* Bridges OS Servers and the ES to the S7-400 / CPU 410 Automation Stations.
* Bound to dedicated physical NICs configured with Siemens Softnet-IE or virtual network paths.
Redundancy Link vSwitch:
* Carries the dedicated cross-server archive synchronization and heartbeat traffic between Server 1 and Server 2.
* Bound to an isolated private VLAN or dedicated physical cross-connect uplink.

Redundancy Heartbeat and Virtual Link-State Propagation

In physical installations, WinCC Redundancy monitors the physical link status of the redundancy network card. In a virtual environment:
* Standard virtual network adapters (such as E1000) can report an active link to the guest operating system even if the underlying physical uplink switch is disconnected.
* Best Practice:
* Utilize VMXNET3 virtual network adapters for all PCS 7 virtual machines.
* Configure Virtual Switch Beacon Probing or Link State Tracking on the upstream physical switches to propagate physical link failures directly into the virtual guest OS.
* Ensure WinCC Redundancy settings in WinCC Explorer explicitly select the dedicated redundancy adapter IP subnet to prevent false failover triggers.

Comparison of Physical vs Virtualized PCS 7 Architectures

The table below compares the operational characteristics of physical versus virtualized PCS 7 OS deployments.

Architectural FeaturePhysical PCS 7 OS ServerVirtualized PCS 7 OS (VMware ESXi)Hardware FootprintDedicated 19" rack IPC per serverConsolidated blade/rack serversServer RedundancyPhysical server pairDual VMs separated by DRS Anti-AffinityDisaster RecoveryManual disk imaging / tapeAutomated VM snapshot / Veeam backupNetwork InterfacePhysical PCIe CP 1623 / Intel NICHigh-performance virtual VMXNET3 adaptersMaintenance DowntimeHardware repair requires site outageLive migration (vMotion) for host patching

Verification

To confirm that the virtualized PCS 7 OS server pair is operating properly:
1. In VMware vSphere Client, verify that VM_OS_Server1 runs on Host A and VM_OS_Server2 runs on Host B.
2. Launch WinCC Runtime on both virtual servers.
3. In WinCC Tag Management, verify that @RedundancyState indicates 1 (Synchronized) and @RM_MASTER reports 1 on one server and 0 on the other.
4. Open the WinCC alarm journal on an OS Client: confirm that process alarms update dynamically without latency.
5. Perform a live failover test: shut down the active Master virtual machine. Confirm that the Standby virtual machine assumes the Master role seamlessly within 2 seconds without client interruption.

Limitations and Operational Precautions

Never execute VMware vMotion (live migration) on an active Master OS Server during live plant operations; the brief memory freeze (500 ms to 1 second) during migration will trigger redundancy watchdog trips.
Do not overcommit CPU or RAM resources on ESXi hosts running PCS 7 OS Servers; configure 100% CPU and memory reservations for all production automation VMs.
Ensure all virtual machine system clocks are synchronized via Network Time Protocol (NTP) to a central physical GPS/SICLOCK master; disable VMware Tools periodic guest time synchronization.
Always validate final software licensing, virtualization options, and hardware specifications against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

Can redundant OS servers run on the same physical ESXi host?

Technically they will communicate, but industrially it is strictly prohibited. If the single physical host suffers a hardware failure, both redundant servers will crash simultaneously, completely defeating the purpose of redundancy.

Which virtual network adapter should be used for PCS 7 VMs?

Always use the VMXNET3 virtual network adapter. It delivers high throughput, low CPU overhead, and advanced jumbo frame and link-state support optimized for industrial Windows operating systems.

Can VMware snapshots be taken while WinCC Runtime is active?

Taking live snapshots of active SQL Server databases can cause brief disk I/O freezes that disrupt real-time archive logging. It is recommended to perform backups using application-consistent backup tools (such as Veeam with Microsoft VSS quiescing) during calm process periods.