How to Resolve WinCC Redundancy Restart Request Errors and Reboot Loops on PCS 7 OS Servers

In SIMATIC PCS 7 redundant OS Server architectures, the recurring popup 'Restart Request Error during Startup of the runtime' accompanied by a mandatory Windows reboot occurs when WinCC Redundancy detects an unresolvable project conflict, split-brain condition, or orphaned Windows registry reboot flag. When engineers attempt to re-activate WinCC Runtime on a newly maintained server while its redundant partner is running, WinCC checks synchronization logs. If the internal project ID, runtime GUID, or SQL Server database timestamps are corrupt or misaligned, runtime aborts and requests a reboot. To resolve this without recurring reboot loops, clear the pending Windows reboot registry keys, temporarily decouple redundancy, re-synchronize the project via Project Duplicator, and re-couple redundancy.

Mechanism of the WinCC Redundancy Startup Restart Request

High-availability SIMATIC PCS 7 OS Servers maintain real-time database synchronization over a dedicated redundant Ethernet link:
* The Startup Handshake:
* When Server A activates WinCC Runtime, the WinCC Redundancy Service (CCRedSync.exe / Redundancy.dll) initiates an inter-station handshake with Server B.
* It verifies network reachability, SQL database context, and project GUID alignment.
* The Restart Request Trap:
* If Server A's runtime was aborted improperly, or if project files were modified independently on Server A while Server B was running, WinCC determines that database synchronization cannot proceed safely.
* To protect database integrity, the WinCC process manager terminates startup and posts: A restart of the computer is required before WinCC can start.
* If the underlying database mismatch or registry lock is not cleared, rebooting the PC achieves nothing—the prompt appears cyclically upon every reboot.

Registry Flags: PendingFileRenameOperations and CCProjectMgr

Two primary Windows system states perpetuate the reboot loop:

PendingFileRenameOperations Registry Lock:
* Windows maintains a registry key for pending driver or file updates:
* Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
* Value: PendingFileRenameOperations
* If a third-party software install or Windows update leaves stale entries in this key, SIMATIC startup routines strictly prohibit WinCC runtime activation.
* Remedy: Open regedit.exe, navigate to the path, and delete the PendingFileRenameOperations value.
WinCC Project Manager Restart Flag:
* Path: HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\WinCC\Diagnostics
* If RestartRequested = 1, WinCC blocks startup. Clear this flag to 0.

Decoupling and Re-Coupling Redundancy During Server Maintenance

To safely re-activate Server A without triggering reboot errors:

Temporarily Decouple Redundancy on Server A:
* Open WinCC Explorer on Server A (in edit mode, runtime deactivated).
* In the navigation tree, open the Redundancy editor.
* Uncheck: Activate Redundancy.
* Click OK. This isolates Server A from Server B.
Start Server A in Standalone Mode:
* Activate WinCC Runtime on Server A.
* Because redundancy synchronization is bypassed, runtime will start cleanly without the reboot pop-up.
* Verify that process graphics, alarms, and controller communication are healthy.
Deactivate Runtime and Re-Couple Redundancy:
* Deactivate WinCC Runtime on Server A.
* Open the Redundancy editor: re-check Activate Redundancy.
* Verify that the Redundant Partner Server computer name matches Server B exactly.
* Click OK.

Database Synchronization and Redundancy Project Duplication

If Server A continues to fault upon re-coupling, the project database on Server A is desynchronized from the ES master:

Execute reset_wincc.vbs:
* On Server A, run reset_wincc.vbs to release SQL database locks.
Re-Download Entire Project from ES:
* In SIMATIC Manager on the Engineering Station, right-click the OS Server object: select PLC > Download > Entire WinCC Project.
* The ES will overwrite Server A's local directory with a fresh, authenticated copy of the master database.
Start Partner Server First:
* Ensure Server B is fully in RUN mode.
* Activate WinCC Runtime on Server A.
* Server A will establish the handshake with Server B, and the WinCC Redundancy synchronization engine will back-fill missing alarm and trend archives automatically.

Comparison of Redundancy Startup States and Failure Modes

The table below outlines common WinCC Redundancy startup failure states and corrective workflows.

Failure SymptomRoot CauseUnderlying Registry / DB StateImmediate Remedy'Restart Request Error' loopPending Windows file update / CrashPendingFileRenameOperations lockedDelete registry key; run reset_wincc.vbs'Cannot connect to partner'Redundancy network link disconnectedPing fails on redundant subnetVerify dedicated redundancy crossover/NIC'Database mismatch on sync'Server A edited independently of ESMismatched project GUIDs in SQLDownload Entire Project from ESSplit-Brain (Both Master)Terminal bus heartbeat lostBoth servers assume partner is deadRestore terminal bus network switch linkArchive sync stall (100% CPU)Corrupted SQL transaction log*RT.ldf database log bloatedShrink SQL log via SSMS or reset archives

Verification

To confirm that WinCC redundancy is fully functional:
1. Activate WinCC Runtime on Server A while Server B is active.
2. Confirm that WinCC Runtime activates to 100% without displaying the restart request popup.
3. Open WinCC Tag Management: inspect internal system tags:
* @RedundancyState: Verify it transitions to 1 (Synchronized).
* @RM_MASTER: Confirm one server is 1 (Master) and partner is 0 (Standby).
4. In WinCC Explorer, open the Diagnose folder: open WinCC_Sys_01.log.
* Verify entry: Redundancy: Partner found, synchronization starting / finished.
5. Perform an alarm acknowledgment test: confirm that alarms acknowledged on Server A immediately reflect on Server B and all OS Clients.

Limitations and Operational Precautions

Never attempt to edit graphics or tags directly on an active redundant OS server; all engineering modifications must originate from the Engineering Station and download via SIMATIC Manager.
Do not delete project database files (.mdf) manually while SQL Server is active, as this causes severe instance database corruption.
Ensure both redundant servers maintain identical Windows user accounts, passwords, and security patch levels.
Always validate final software licensing, OS redundancy packages, and hardware specifications against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

Why does Windows keep demanding a restart even after rebooting?

The PendingFileRenameOperations registry key is continuously regenerated or locked by an incomplete driver installation. Manually deleting the value in Registry Editor breaks the loop.

Will unchecking 'Activate Redundancy' disrupt Server B?

No. Server B will detect that Server A is offline or non-redundant and will simply operate as the sole active master server without interrupting client visualization.

How long does redundancy archive synchronization take?

Depending on outage duration and network bandwidth, synchronizing historical alarms and tag logs typically takes between 2 and 15 minutes, proceeding in the background without affecting real-time process monitoring.