Remote Engineering and Maintenance Architecture for SIMATIC PCS 7

In SIMATIC PCS 7, implementing remote engineering from a home office or remote facility must be executed by establishing an encrypted Virtual Private Network (VPN) connection to a centralized Engineering Station (ES) hosted locally on the plant Terminal Bus. Operating SIMATIC Manager directly across a WAN/VPN connection to field controllers is strictly unsupported, as wide-area network latency causes SQL database transaction timeouts and communication drops during controller downloads. Secure remote engineering utilizes encrypted Remote Desktop (RDP) or Siemens Common Remote Service Platform (cRSP) sessions into a dedicated ES or virtualized jump host situated within the plant perimeter network (DMZ), protected by multi-factor authentication and strict firewall zoning.

PCS 7 Remote Access Architectural Security Framework

Industrial Distributed Control Systems (DCS) require secure, high-availability remote access to support off-site engineering, vendor diagnostics, and on-call operational assistance. In accordance with the SIMATIC PCS 7 Security Concept (Compendium Part F) and international cybersecurity standard IEC 62443, remote access must adhere to a strict defense-in-depth perimeter model.

The corporate enterprise network (Level 4) and remote home offices (Level 5) are fundamentally untrusted zones. Direct layer-2 or layer-3 bridging into the plant Control Bus (Plant Bus) hosting S7-400 controllers is prohibited. Instead, a secure Demilitarized Zone (DMZ - Level 3.5) is established using dual-homed industrial firewalls (such as SCALANCE S615 or SCALANCE S623). Remote engineers connect to a jump server or remote desktop gateway hosted in the DMZ via encrypted SSL/IPsec VPN, from which they manage the local Engineering Station.

Why Direct WAN-to-AS Engineering Is Strictly Prohibited

Engineers occasionally attempt to install SIMATIC Manager on a remote laptop, connect via VPN, and download CFC charts directly to an S7-400 across the internet. This practice consistently leads to severe engineering failures:

STEP 7 Database Latency Sensitivity: STEP 7 and WinCC use Microsoft SQL Server and relational database files distributed across shared SMB network shares. File locking, cross-reference generation, and compilation routines require sub-millisecond local network latency. WAN latency spikes (exceeding 20ms) trigger database corruption, leaving multiproject cross-references in an unrecoverable state.
Controller Download Interruption Risk: Downloading CFC changes (delta download) or full programs requires continuous, uninterrupted communication handshakes between STEP 7 and the CPU. A transient VPN packet drop during block replacement can corrupt CPU work memory, crashing the controller into STOP mode and halting continuous chemical or power processes.
Absence of Local Verification: Commissioning controller code or changing setpoints remotely without dedicated local plant personnel present violates fundamental industrial safety standards.

Remote Engineering Solutions and Security Zone Matrix

The following table compares remote access architectures for SIMATIC PCS 7 environments:

Remote Access MethodInfrastructure RequiredNetwork LayerLatency ToleranceIndustrial Safety ComplianceDirect VPN to ControllerHome PC with STEP 7Layer 3 IPsecExtremely Poor (< 5ms required)Prohibited (High risk of CPU STOP)RDP to Local ES / VMDMZ Jump Server / ESApplication (RDP)Excellent (> 100ms tolerated)Recommended (Standard DCS Architecture)Siemens cRSPDedicated Siemens GatewayManaged SSL/VPNHighCertified Siemens Manufacturer AccessVirtual Desktop (VDI)VMware Horizon / ESXiWeb / BlastHighEnterprise Multi-User EngineeringWeb Navigator ClientWinCC Web ServerHTTPS (Port 443)HighMonitoring & HMI Operation Only

Step-by-Step Procedure to Establish a Secure Remote Engineering Gateway

To establish an authorized, compliant remote engineering environment for PCS 7:

Deploy Dedicated Engineering Station in Plant Network:
- Host the primary PCS 7 Engineering Station on a physical IPC (e.g., SIMATIC IPC547G) or virtualized workstation (VMware ESXi) connected directly to the local Terminal Bus.
- Install all required engineering software, Master Data Libraries, and licenses locally on this workstation.
Configure Industrial Security Router and VPN Gateway:
- Install an industrial firewall/router (e.g., SCALANCE S615 6GK5615-0AA00-2AA2) between the plant perimeter and the corporate network.
- Configure an IPsec or OpenVPN tunnel requiring Multi-Factor Authentication (MFA) and digital certificate exchange.
- Restrict incoming traffic strictly to RDP (TCP port 3389) or secure VNC protocols directed solely to the engineering workstation IP address.
Configure Remote Desktop Sessions on the Engineering Workstation:
- On the local ES, open System Properties -> Remote and enable Allow remote connections to this computer.
- Add authorized engineering user accounts to the Remote Desktop Users group.
- Configure group policy to disconnect idle sessions after 60 minutes.
Establish Operational Remote Engineering Protocols:
- Remote engineers connect to the corporate VPN, establish the RDP session to the local ES, and author CFC/SFC logic within the remote desktop window.
- Prior to initiating any online controller download or mode change, establish voice contact with on-site control room operators to ensure safe plant conditions.

Verification

Verify remote engineering connectivity and safety:
1. Establish the remote RDP session; verify responsive graphical interaction inside SIMATIC Manager, CFC, and WinCC Graphics Designer without display lag.
2. Compile a test CFC chart locally on the remote desktop; verify that compilation completes at local hardware speed.
3. Open the CPU diagnostic buffer online; confirm that communication response times match local workstation performance.
4. Intentionally disconnect the remote VPN connection; confirm that the local ES continues executing its background tasks and does not interrupt the PLC.

Limitations and Operational Precautions

No Downloads in CPU STOP Without Personnel: Never initiate a download that forces the controller to STOP mode without dedicated mechanical and operations personnel standing by at the physical machine.
Screen Resolution Matching: Ensure the remote RDP client matches the multi-monitor resolution of the plant ES to prevent displaced toolbar elements or faceplate clipping.
Cybersecurity Logging: Maintain comprehensive audit logs of all remote VPN connections, including user identities, login durations, and IP addresses.

Engineer FAQ

Can I install SIMATIC Manager on my home PC and connect to the plant via VPN?

No. Running SIMATIC Manager across a WAN connection causes database corruption, SQL timeouts, and risks dropping communication during live PLC downloads.

What is the recommended remote connection method for PCS 7?

The recommended method is using an encrypted VPN to connect via Remote Desktop (RDP) to a dedicated Engineering Station situated on the local plant Terminal Bus.

What is Siemens cRSP?

cRSP (Common Remote Service Platform) is Siemens' proprietary managed remote service platform providing secure, audited access for vendor maintenance and diagnostics.

Can multiple engineers work on the same PCS 7 project remotely?

Yes, using PCS 7 Multi-Engineering on a shared multiproject hosted on a local central engineering server, with each engineer accessing their assigned workstation via RDP.