Understanding PCS 7 Maintenance Station Passivation States and Redundant OS Diagnostics

In SIMATIC PCS 7 Maintenance Station (MS), when an OS Server in a redundant pair is cleanly shut down via 'Deactivate Runtime', the Maintenance Station intentionally does NOT generate an 'OS-OS Connection Failure' alarm. Instead, the runtime deactivation sequence signals an intentional operational change, placing the server into a 'Passivated / Under Maintenance' state indicated by a green wrench (or hand) badge in the MS diagnostic screens. Connection failure alarms are reserved strictly for uncommanded, abrupt hardware crashes or physical network cable breaks. The lack of an alarm during clean deactivation is verified normal system behavior designed to prevent nuisance alarms during planned servicing.

Executive Summary

Plant asset management in SIMATIC PCS 7 is orchestrated by the Maintenance Station (MS Basic or MS Standard), which monitors the hardware health of controllers, fieldbus devices, network switches, and operator computers. When commissioning a redundant OS Server pair with Maintenance Station in PCS 7 V9.0 SP2 UC3, engineers frequently observe a puzzling diagnostic behavior: shutting down one server by deactivating WinCC Runtime displays a green wrench symbol on the station in the diagnostic hierarchy, yet the expected alarm 'OS-OS Connection Failure' is not generated in the message system. System integrators worry that SNMP or OPC communication is malfunctioning. This article explains the technical distinction between clean passivation and abrupt failure in the Maintenance Station state machine, verifies icon badges, and details how SNMP and OPC drivers monitor redundant partners.

Architecture and Fundamental Mechanics

Maintenance Station Architecture, Asset Monitoring State Machine, and Passivation Mechanics:

Architecture of the PCS 7 Maintenance Station (MS Basic / Standard):
The Maintenance Station aggregates asset health using specialized blocks from the Basis Library (AssetMon, ASSET_M) and communications from the SIMATIC NET SNMP OPC Server.
It visualizes the entire physical and logical architecture in standardized diagnostic screens (@DiagOverview.pdl, @DiagTree.pdl).
Monitored objects include: Automation Systems (AS), Operator Stations (OS), Field Devices (HART/PROFIBUS), and Network Components (SCALANCE).
Intentional Deactivation vs Abrupt Crash (Passivation Concept):
Clean Runtime Deactivation (Passivation):
- When an engineer clicks 'Deactivate' in WinCC Explorer on Server 1B, WinCC executes a graceful shutdown handshake.
- Server 1B notifies Server 1A and the MS Server that it is willingly entering downtime.
- In the Maintenance Station state machine, Server 1B transitions to 'In Maintenance / Passivated'.
- In the diagnostic overview, the station is tagged with a Green Wrench (or Green Hand) badge.
- Suppression Rule: NAMUR and EEMUA 191 alarm management standards mandate suppressing connection failure alarms during planned maintenance to prevent distracting operators with false emergency messages.
Uncommanded Failure (Cable Disconnect / Power Outage):
- If Server 1B suffers an unexpected power loss or the Terminal Bus network cable is physically severed, no shutdown handshake occurs.
- Server 1A's redundancy agent detects an uncommanded heartbeat loss, and the SNMP OPC Server reports an unreachable ping.
- In this scenario, the Maintenance Station flags an unmanaged failure (Red Wrench or Red X) and generates the formal system alarm: 'OS-OS Connection Failure'.
SNMP Configuration and Asset Synchronization:
For the Maintenance Station to correctly detect both clean passivations and physical failures, the SIMATIC NET Configuration Console must have SNMP enabled with valid read community strings (public) matching the Windows SNMP service on all monitored IPCs.

Step-by-Step Implementation Procedure

Verify Passivation Badge in the Maintenance Diagnostic Screen:
* In WinCC Runtime on the active OS client, open the Maintenance Station Overview (@DiagOverview.pdl).
* Navigate to the PC Stations group and locate the deactivated server.
* Verify that the station badge shows the Green Wrench (or Hand icon), confirming that the station was recognized as passivated.
* Confirm that the surviving partner server continues processing without redundancy failover alarms.
Test Abrupt Failure Alarm Triggering:
* Start WinCC Runtime on both redundant servers; verify both show green/healthy in the MS overview.
* To simulate a real uncommanded hardware failure, physically disconnect the Terminal Bus Ethernet cable from Server 1B (do NOT click Deactivate).
* Observe the Maintenance Station diagnostic display:
- The green wrench does NOT appear; instead, a Red Fault badge is displayed.
- In the WinCC Alarm Logging list, verify that the alarm 'OS-OS Connection Failure' is generated immediately.
Verify SNMP Service Configuration across All IPCs:
* On both OS servers and the ES, open Windows Services (services.msc).
* Locate SNMP Service; ensure its Startup Type is set to Automatic and the service is Running.
* Right-click SNMP Service -> Properties -> Security tab:
- Ensure the Accepted Community Names list contains public with READ ONLY rights.
- Check 'Accept SNMP packets from any host' (or specify the MS server IP).
Re-compile Maintenance Station Diagnostics:
* In SIMATIC Manager on the ES, select the OS project designated as the Maintenance Station.
* Select Options -> Plant Hierarchy -> Create/Update Diagnostic Screens.
* Execute an OS compilation to ensure all SNMP asset identifiers are synchronized.

Verification

Gracefully deactivate Server 1B: confirm that the green wrench appears on the diagnostic graphic and zero nuisance alarms are raised.
Pull the network plug on Server 1B: confirm that the system alarm 'OS-OS Connection Failure' is raised and logged in Alarm Logging.
Reconnect Server 1B: confirm that the alarm clears, synchronization finishes, and the station icon returns to normal green.

Limitations and Operational Precautions

Do not confuse Maintenance Station Basic (which runs integrated on standard OS servers) with Maintenance Station Standard (which runs on dedicated MS server hardware); MS Basic is limited in device count and diagnostic scope. If SNMP services are stopped on an IPC, the Maintenance Station cannot poll operating system health, resulting in stale diagnostic badges.

Engineer FAQ

Why is there no 'OS-OS Connection Failure' alarm when I deactivate WinCC Runtime?

Because deactivating Runtime is a planned shutdown. The Maintenance Station places the server into a 'Passivated' state (green wrench) and intentionally suppresses connection alarms.

What does the green wrench icon mean in PCS 7 Maintenance Station?

It signifies that the component is passivated or in a planned maintenance state.

How do I verify that connection failure alarming actually works?

Physically disconnect the network cable or power down the server without clicking Deactivate Runtime; this uncommanded failure will trigger the alarm.