RealVNC Enterprise Support and Cybersecurity Constraints in SIMATIC PCS 7 V9.0 Remote Architectures

In SIMATIC PCS 7 V9.0, remote desktop access using RealVNC is officially released and supported by Siemens, specifically using RealVNC Enterprise Edition (VNC Connect). RealVNC is approved for remote monitoring, diagnostic maintenance, and operator control of OS Clients and Engineering Stations. However, Siemens cybersecurity guidelines enforce strict constraints: only one active remote session is permitted per station, the connection must inherit the console session of the locally logged-on user rather than spawning a parallel session, and audio transmission is disabled. Validate software licensing and versions via the Siemens Compatibility Tool and an authorized Siemens distributor or the Siemens Industry Mall.

Executive Summary

Process manufacturing plants increasingly require secure remote operations—allowing off-site plant specialists, process engineers, and on-call technicians to access PCS 7 Operator Stations (OS) and Engineering Stations (ES) from corporate offices or mobile devices. While Microsoft Remote Desktop (RDP) is commonly used in enterprise IT, standard RDP opens disconnected virtual sessions that interfere with WinCC Runtime graphics rendering and can blind physical control room monitors. Siemens officially tests, certifies, and supports RealVNC Enterprise Edition for PCS 7. This technical guide outlines the official release status, configuration prerequisites, and mandatory industrial cybersecurity rules.

Architecture and Fundamental Mechanics

The remote access architecture in SIMATIC PCS 7 enforces distinct operational boundaries between RDP and RealVNC:
1. Why Standard Microsoft RDP is Restricted on WinCC Stations:
Standard RDP creates a new virtual display session (Session ID > 1) and locks the physical console monitor (Session 0). WinCC Runtime relies on hardware-accelerated direct DirectX/GDI rendering bound to the physical console. Using RDP causes screen refresh freezes, faceplate rendering delays, and blinds the physical operator sitting in the control room.
2. The RealVNC Console Shadowing Architecture:
RealVNC Enterprise Edition operates via direct desktop capture (Console Shadowing). The remote viewer captures the exact pixel buffer rendered on physical Session 0. Control room operators and remote specialists view the identical screen simultaneously, ensuring that local personnel maintain full situational awareness.
3. Siemens Official Certification and SIOS Guidance:
Siemens certifies RealVNC under SIOS Application Guideline Entry ID 102843424 ('Process visualization on mobile devices') and Entry ID 55422236 ('Accessing WinCC and PCS 7 with RealVNC'). The Siemens Compatibility Tool (kompatool) itemizes released RealVNC server and viewer builds for each PCS 7 version.
4. Cybersecurity and IEC 62443 Compliance:
- Encryption: 256-bit AES end-to-end encryption must be enforced in RealVNC Server properties.
- Network Demilitarized Zone (DMZ): RealVNC traffic should terminate at a central jump host or VPN gateway in the Industrial DMZ, never directly bridging corporate LAN to the Terminal Bus.

Step-by-Step Implementation Procedure

Verify RealVNC Version in Siemens Compatibility Tool:
a. Access support.industry.siemens.com/kompatool.
b. Query 'SIMATIC PCS 7 V9.0' and check the released version of 'RealVNC VNC Connect Enterprise' (e.g., VNC Connect 6.x / 7.x).
c. Procure valid commercial RealVNC Enterprise licenses through authorized channels.
Install RealVNC Server on Target PCS 7 Stations:
a. Log in to the target OS Client or Engineering Station as Administrator.
b. Run the RealVNC Server installer: select 'Enterprise Mode' (Service-mode installation).
c. In licensing, enter your enterprise license key.
Configure Hardened Security Settings in RealVNC Server:
a. Open RealVNC Server Options -> 'Security' tab.
b. Set Encryption to 'Always maximum' (256-bit AES).
c. Set Authentication to 'Windows password' or 'Single Sign-On' to integrate with plant Active Directory domain security.
d. Under 'Users & Permissions', grant remote control rights exclusively to authorized automation engineers.
Configure Display and Session Constraints:
a. Under 'Connections' tab, set 'Maximum connections = 1' to enforce the Siemens single-session policy.
b. Check 'Prompt local user to accept connection' if control room operator authorization is required before granting remote access.
c. Disable audio transmission in RealVNC options.
Network Hardening and Firewall Configuration:
a. Configure local Windows Firewall on the PCS 7 station to permit inbound traffic on TCP port 5900 strictly from the designated DMZ Jump Host IP address.
b. Disallow any direct routing from external internet connections.

Verification

Connect from the authorized DMZ jump host using RealVNC Viewer to the OS Client IP address.
Enter authorized Windows domain credentials: confirm secure 256-bit AES connection establishes.
Verify on the physical monitor in the central control room: confirm the screen remains live and mirrors the remote viewer without locking out the local operator.
Click an analog faceplate: verify that response times are crisp and values update in real-time.

Limitations and Operational Precautions

Never install RealVNC Server directly on an S7-400 AS controller (which runs proprietary firmware) or on safety-critical SIL3 engineering nodes without strict administrative authorization; remote write commands must comply with plant operating procedures.

Engineer FAQ

Does SIMATIC PCS 7 V9 support RealVNC?

Yes. Siemens officially supports RealVNC Enterprise Edition (VNC Connect) across PCS 7 V8, V9, and V10 versions.

Why is RealVNC preferred over Microsoft RDP for WinCC?

RealVNC mirrors the physical console session (Session 0) without locking the control room monitor, whereas RDP creates a virtual session that interferes with WinCC Runtime rendering.