Understanding WinCC Redundant Server State Indications: What Does the Orange Color Mean?

In SIMATIC PCS 7 and WinCC Redundancy diagnostic displays (such as @Config.pdl or the System Overview faceplate), an Orange server indication signifies that the server is actively operating as the Redundancy Master while its redundant partner is offline, deactivated, or disconnected. When both redundant servers are active and fully synchronized, both typically display Green. When one server is shut down for maintenance or loses network connectivity, the surviving server assumes mastership alone, changing its status indicator to Orange. This alerts operators that while process monitoring and client connectivity remain fully operational, server redundancy is temporarily compromised until the partner server re-engages and completes redundancy synchronization.

The Color-Coded State Architecture of WinCC Redundancy

In SIMATIC PCS 7 operator stations, the system diagnostic display (@Config.pdl) and the title bar server status icons visualize the operational health of redundant OS Server pairs.

To give operators and maintenance technicians immediate situational awareness, WinCC utilizes standardized color-coded states to represent the internal state of the redundancy manager (CCRedSync.exe):
* Green: Normal redundant operation. Both servers are active, runtime is synchronized, and client connections are distributed.
* Orange: Solo Master operation. The local server is the active Master, but the partner server is offline, deactivated, or unreachable.
* Blue: Standby server in synchronized operational state.
* Red: Redundancy error, split-brain condition, or fatal communication fault.
* Grey: Server runtime deactivated or station offline.

Operational Meaning of the Orange (Standalone Master) State

When a server displays Orange, it indicates that the system is operating without redundancy fault protection:

Active Mastership: The orange server has assumed full operational responsibility. It communicates directly with all automation stations (AS), processes all alarms, executes background C/VBS scripts, and serves all connected OS Clients.
Missing Partner: The redundancy heartbeat signal (exchanged over the serial cable or dedicated Ethernet redundancy link) is absent. The local server has confirmed that the partner is not running or is disconnected.
Historical Buffering: The orange server continues logging alarms and process tags locally, buffering synchronization packages to backfill the partner once it restarts.

While process control is fully maintained, the plant is operating in a non-redundant state. A failure of the orange server would result in a total loss of operator visualization.

Redundancy State Machine: Master, Standby, and Fault States

The transition between redundancy states is governed by internal system tags and network heartbeats:

Transition to Orange

Server A and Server B are both running (Green / Blue).
Server B deactivates or suffers a power failure.
Server A detects heartbeat loss.
Server A evaluates @RM_Master and verifies it is the sole active node.
Server A transitions from Green to Orange to notify operators of degraded redundancy.

Transition from Orange Back to Green

Server B powers up and launches WinCC Runtime.
Server A and Server B establish a handshake across the redundancy link.
CCRedSync.exe initiates archive synchronization, copying missing tag and alarm data logged during Server B's outage.
Once synchronization is verified ('Synchronization Successful'), Server A turns Green (Master) and Server B turns Blue (Standby) or Green.

Diagnostic Inspection: System Tags and WinCC Redundancy Logs

To verify the exact reason why a server remains Orange:

Inspect Internal Redundancy Tags:
In WinCC Explorer -> Tag Management -> Internal Tags, review:
* @RM_MASTER: 1 indicates local server is Master; 0 indicates Standby.
* @RM_SERVER_STATE: Integer code representing active redundancy mode.
* @RedundancyCheck: Status of heartbeat synchronization link.
Review CCRedSync.log:
Navigate to C:\Program Files (x86)\Siemens\WinCC\Diagnose\CCRedSync.log.
Look for entries such as:
* Connection to partner broken: Indicates partner shutdown or physical link disconnect.
* Sync in progress: Indicates partner is online but still catching up on historical data.
Check Channel Diagnosis:
Open WinCC Channel Diagnosis to confirm that the orange server maintains active connections to all AS controllers.

WinCC Redundancy Status Color Code and Action Matrix

The following table outlines the status colors, underlying states, operational impacts, and required actions:

Display ColorRedundancy StatusPartner Server StatusOperational ImpactRequired ActionGreenFully RedundantOnline & SynchronizedFull high-availability protectionNone; standard operationsOrangeStandalone MasterOffline / DisconnectedNormal control; no redundancyInvestigate partner server; restart partnerBlueStandby SynchronizedOnline (Master active)Full standby readinessNone; standard operationsRedRedundancy FaultSplit-brain or sync errorRisk of diverging archivesInspect redundancy cable, NIC priorityGreyDeactivatedUnknownStation not participatingStart WinCC Runtime if planned online

Understanding these color transitions allows operators to react proactively before secondary faults cause plant outages.

Verification

To verify that a server correctly transitions from Orange back to normal redundancy:
1. Observe the orange server in @Config.pdl.
2. Start WinCC Runtime on the offline partner server.
3. In the alarm logging banner, observe the message: 'Redundancy synchronization started'.
4. Wait for the archive catch-up to complete; observe the message: 'Redundancy synchronization finished'.
5. Confirm that the server status indicator transitions from Orange to Green, verifying that redundant high-availability is fully restored.

Limitations and Operational Precautions

Do not reboot or power down the orange server while the partner is offline; doing so causes total loss of operator supervision and client blackout.
If a server remains orange after the partner is restarted, check CCRedSync.log to determine whether synchronization is stalled due to corrupted cache.
Ensure both redundant servers have matching system clocks (via NTP) to avoid synchronization rejection.
Never disable redundancy in the WinCC project settings as a temporary workaround for an orange status indication.

Engineer FAQ

Is plant operation safe while the WinCC server is Orange?

Yes. The orange server is completely functional and continues to process alarms, trends, and commands. However, the system lacks fault tolerance; any hardware failure on the orange machine will interrupt operator visibility.

Why did my server turn Orange if both servers appear to be running?

If both servers are running but one displays Orange or Red, the redundancy communication link (serial cable or dedicated Ethernet NIC) has failed, causing a partial disconnect where the servers cannot exchange heartbeat tokens.

Can OS Clients operate normally when connected to an Orange server?

Yes. WinCC OS Clients automatically connect to whichever server is currently active as Master, operating identically whether the server is Green or Orange.