Resolving WinCC 'Error Requiring Restart' and Redundant OS Server Failures in PCS 7

In SIMATIC PCS 7 v7.1 and WinCC v7.0, the critical popup error 'An error has occurred that requires a restart' during runtime startup indicates severe SQL Server database corruption, an improperly synchronized RAID array, or mismatched redundancy state files. When replacing a failed hard drive in a RAID1 server, inserting a new drive without rebuilding the array corrupts the active WinCC database and propagates lockups across the redundant partner via network synchronization. To recover, isolate the faulted server physically from the terminal bus, rebuild the hardware RAID1 array in RAID controller BIOS, run Reset_WinCC.vbs, and download the OS project afresh from the Engineering Station.

Root Causes of WinCC Runtime Startup Crash and Restart Requests

The generic error message 'An error has occurred that requires a restart' is generated by the WinCC runtime supervisory process (CCSetPartnerOnStatus.exe or HmiRtm.exe) when an essential subsystem fails to initialize during startup. In a redundant OS Server configuration (such as redundant Fujitsu Primergy TX300 or Siemens IPC547D servers running PCS 7 v7.1 / WinCC v7.0), this error typically stems from three root causes:

Asynchronous or Degraded RAID1 Volume: When a faulted hard drive is replaced while the server is powered off, the RAID controller (such as an on-board LSI / Fujitsu MegaRAID controller) may not automatically initiate an array rebuild. If the operating system boots from an un-synchronized or corrupted mirror, Microsoft SQL Server data pages become corrupted.
Database Attachment and Transaction Log Failure: When WinCC starts, it invokes Microsoft SQL Server to attach project databases (<Project>.mdf, <Project>R.mdf, and Archive databases). If the database files were left in an inconsistent state during an ungraceful shutdown or disk fault, SQL Server marks them SUSPECT or fails to mount them, triggering an immediate WinCC restart abort.
Cross-Station Redundancy Contagion: When Server-1 boots with corrupted runtime databases and connects to the terminal bus, the WinCC Redundancy manager attempts to establish partner status (Redundancy.dll). If Server-1 sends corrupt transaction logs or malformed status packets, it can cause the partner server (Server-2) to crash or hang, incapacitating all connected OS Clients.

Hardware RAID1 Recovery vs WinCC Redundancy Synchronization

A strict distinction must be maintained between low-level storage array synchronization and high-level WinCC software redundancy:

Redundancy LayerManaging SubsystemPurpose and ScopeFailure Mode and SymptomsHardware RAID1Host RAID Controller / Fujitsu ServerViewPhysical block-level disk mirroring across dual hard drives.Amber LED, degraded array, disk read timeouts, corrupted file system blocks.SQL Server StorageMicrosoft SQL Server Instance (WinCC)Relational transaction logging and tag/alarm archive tables.SUSPECT database state, failed database attach, SQL event ID 823/824.WinCC RedundancyWinCC Redundancy Package (6ES7658-2CX58-0YB5)Runtime tag synchronization, alarm message matching, and archive gap filling.Partner connection drop, station lockup, client freezing, split-brain condition.Terminal Bus NetworkCP 1623 / Intel NIC via Ethernet SwitchPhysical and logical communication between redundant servers and clients.Lost heartbeat telegrams, timeout retries, broadcast storms during desync.

Table 1: Redundancy layers and diagnostic failure points in PCS 7 OS Servers.

Step-by-Step Procedure to Recover a Corrupted Redundant OS Server

Follow this sequence to restore the faulted server safely without impacting plant operations:

Isolate the Faulted Server (Server-1):
* Disconnect all terminal bus and plant bus network cables from Server-1 immediately.
* Verify that Server-2 remains running, stable, and servicing all OS Clients.
Rebuild the Hardware RAID1 Array:
* Reboot Server-1 into the RAID controller BIOS configuration utility (e.g., press Ctrl+M, Ctrl+H, or Ctrl+G during POST depending on the RAID controller).
* Verify array status: it will show DEGRADED.
* Select the newly inserted hard disk, assign it as the rebuild partner / hot spare, and initiate the Rebuild Array process.
* Allow the hardware rebuild to reach 100% completion before booting into Windows.
Reset WinCC Runtime Environment:
* Boot Windows on Server-1 (keep network cables disconnected).
* Open Windows Command Prompt as Administrator, navigate to C:\Program Files (x86)\Siemens\WinCC\bin\, and run:
cmd Reset_WinCC.vbs
* This terminates lingering WinCC background processes (CCExpServer.exe, CCProjectMgr.exe, HmiRtm.exe) and releases hung SQL database handles.
Deploy a Clean OS Project Copy:
* Delete or archive the damaged project folder on Server-1.
* Connect Server-1's network cable to the terminal bus.
* From the Engineering Station (ES), execute a complete OS Download to Server-1 with the option Entire WinCC Project.
* Start WinCC runtime on Server-1.
Verify Partner Redundancy Reintegration:
* Observe WinCC Redundancy archive synchronization: Server-1 retrieves missing alarms and historical data from Server-2 without disrupting ongoing operations.

WinCC Database Cleanup and Reset Utility Workflow

When WinCC crashes during startup, SQL Server services often remain running with exclusive locks on corrupted .mdf and .ldf files. Running Reset_WinCC.vbs performs the following automated cleanup operations:
* Gracefully stops all WinCC host processes and DCOM objects.
* Detaches WinCC runtime and design databases from the WINCC SQL Server instance.
* Cleans temporary runtime cache files in %TEMP% and the WinCC project directory.
* Resets shared memory segments and inter-process communication semaphores.

After running Reset_WinCC.vbs, always reboot the operating system before attempting to open the WinCC project in SIMATIC WinCC Explorer or initiating a project download from the ES.

Verification

To confirm complete recovery and operational health:

Open WinCC Explorer on Server-1: verify the project opens cleanly without popups.
Activate WinCC Runtime: confirm that graphics runtime launches and no restart prompt appears.
Check the WinCC diagnosis directory (C:\Program Files (x86)\Siemens\WinCC\Diagnostics\): inspect WinCC_Sys_01.log and CCSetPartnerOnStatus.log for zero critical database errors.
Open the WinCC Redundancy status window (@TRG_WinCC_Redundancy.pdl or system alarms): confirm that Server-1 and Server-2 report partner state as redundant, with archive synchronization completed.

Limitations and Operational Precautions

Never insert a replacement hard drive into a production server without checking controller compatibility and verifying the RAID rebuild process in BIOS or Fujitsu ServerView.
Never leave a desynchronized or crashing OS server connected to the network; always disconnect its network cables to prevent redundancy cascade failures that crash the healthy partner server.
Do not attempt manual SQL database repair using third-party SQL utilities on WinCC databases; re-downloading the project from the ES is the only certified and reliable recovery method.

Engineer FAQ

Why did Server-2 crash when Server-1 tried to start up?

When Server-1 booted with corrupted SQL databases, its WinCC Redundancy component attempted to communicate with Server-2 over RPC/DCOM. Mismatched database transaction logs and corrupted message queues caused a timeout exception in Server-2's redundancy manager, causing both servers to fail.

Can I use WinCC Project Duplicator instead of re-downloading from the ES?

Yes. If the ES is unavailable, you can use the WinCC Project Duplicator tool on Server-2 to duplicate the healthy running project directly across the network to Server-1, provided Server-2's runtime is safely maintained.

What software licenses are required for OS Server redundancy?

Redundant OS Servers require a WinCC Server license (6ES7658-2BA58-0YB0) and a WinCC Redundancy license (6ES7658-2CX58-0YB5) on each physical server station. Always validate license packages with an authorized Siemens distributor before commissioning.