Virtualizing Multi-Project PCS 7 Architectures on VMware ESXi 6.7 with Spanned Plant and Terminal Buses

In SIMATIC PCS 7 V8.1 SP1, migrating physical multi-project architectures to VMware ESXi 6.7 requires establishing strictly isolated virtual network topologies for the Plant Bus and Terminal Bus. To ensure deterministic performance and prevent network loops, create two independent VMware vSwitches: one bound to dedicated physical NICs for the plant bus (PLC_Span_Net) connecting AS 410 controllers, and a separate vSwitch for the terminal bus (HMI_Span_Net) handling WinCC client-server traffic. OS servers utilize SIMATIC NET SOFTNET-IE (BCE) over VMXNET3 virtual adapters rather than emulated CP 1623 cards. Crucially, disable VMware Tools time synchronization on all guest VMs and synchronize all virtual stations and physical AS controllers to an external physical NTP stratum-1 clock.

Executive Summary

Virtualizing process control systems on enterprise hypervisors—such as VMware ESXi 6.7—delivers significant lifecycle benefits, including hardware consolidation, rapid disaster recovery snapshots, and streamlined operating system patching. However, deploying multi-project PCS 7 architectures (featuring multiple redundant OS server pairs, Engineering Stations, and physical AS 410-5H controllers) into a virtual environment introduces severe communication pitfalls if networking and clock synchronization are misconfigured. This guide provides the complete infrastructure design, vSwitch configuration, network adapter selection, and NTP clock synchronization architecture required for certified, high-availability PCS 7 virtualization.

Architecture and Fundamental Mechanics

The virtualization architecture of SIMATIC PCS 7 on VMware ESXi operates under rigorous industrial constraints:
1. Dual-Bus Network Separation via vSwitches:
- PCS 7 strictly mandates complete physical and logical isolation between the Plant Bus (AS-to-OS communication) and the Terminal Bus (OS-to-Client and ES-to-OS communication).
- In ESXi, this is achieved by creating two separate standard vSwitches or Distributed Virtual Switches (vDS):
a. vSwitch_TerminalBus: Dedicated physical uplinks connecting to the control room terminal LAN.
b. vSwitch_PlantBus: Dedicated physical uplinks connecting to the industrial Ethernet switches (e.g., SCALANCE X) housing the AS 410 CP 443-1 / onboard PROFINET interfaces.
2. Network Adapter Selection in Guest VMs:
- Physical OS servers traditionally use dedicated PCI communication processors (CP 1623 / CP 1613).
- In VMware ESXi, virtual machines use high-performance VMXNET3 virtual network adapters.
- SIMATIC NET SOFTNET-IE S7 (Basic Communication Ethernet - BCE) operates over VMXNET3 to execute S7 communication without requiring hardware pass-through.
3. Gateway and Routing Constraints:
- The Plant Bus must remain a deterministic Layer 2 industrial subnet. Standard IP default gateways should not be configured on Plant Bus adapters in multi-homed VMs; default gateways must be assigned exclusively to the Terminal Bus adapter to avoid asymmetric routing.
4. Time Synchronization Rules:
- Virtual machine clocks drift due to hypervisor CPU scheduling.
- Strict Rule: Disable 'Synchronize guest time with host' in VMware Tools.
- Configure all virtual servers, clients, and physical AS controllers to synchronize to a common external physical NTP time server (e.g., SICLOCK TC 400 or GPS master clock).

Step-by-Step Implementation Procedure

Configure VMware ESXi Virtual Networking (vSwitches):
a. Log in to VMware vSphere Client for ESXi 6.7.
b. Navigate to Networking -> Virtual Switches.
c. Create vSwitch_TerminalBus: assign physical NICs (e.g., vmnic0, vmnic1 for NIC teaming) connected to the terminal bus switch.
d. Create vSwitch_PlantBus: assign physical NICs (e.g., vmnic2, vmnic3) connected to the plant bus industrial switches.
e. Under Port Groups, create PG_TerminalBus on vSwitch_TerminalBus and PG_PlantBus on vSwitch_PlantBus.
Provision Guest Virtual Machines for PCS 7 OS Servers and ES:
a. Create virtual machines configured with Windows Server 2008 R2 / 2016 (matching PCS 7 version compatibility).
b. Allocate resources according to Siemens virtualization guidelines: minimum 4 vCPUs and 16 GB RAM per OS server.
c. Add two virtual network adapters to each VM:
- Network Adapter 1: Connected to PG_TerminalBus, Adapter Type = VMXNET3.
- Network Adapter 2: Connected to PG_PlantBus, Adapter Type = VMXNET3.
Disable VMware Tools Time Synchronization:
a. Power off the VM.
b. In VM settings, navigate to VM Options -> VMware Tools -> Time.
c. Uncheck 'Synchronize time with host'.
d. Under 'Advanced -> Configuration Parameters', verify that tools.syncTime = "0".
Configure Windows Network Adapters Inside the VM:
a. Power on the VM and open Windows Network Connections.
b. Rename the connections to Terminal_Bus and Plant_Bus.
c. In Terminal_Bus properties: configure IP address, subnet mask, default gateway, and DNS servers.
d. In Plant_Bus properties: configure IP address and subnet mask matching the AS subnet. Leave the Default Gateway field completely blank.
Configure Simatic Shell and Station Configuration Editor:
a. Open Windows Explorer, right-click Simatic Shell, and select Settings....
b. Bind Simatic Shell strictly to the Terminal_Bus network adapter.
c. Open Set PG/PC Interface in Control Panel: set S7ONLINE to PC internal.local.1.
d. Open Station Configuration Editor: ensure WinCC Application and IE General components are active.

Verification

In SIMATIC Manager on the virtual ES, open NetPro online: verify that S7 connections to physical AS 410 controllers establish with green status.
In WinCC Runtime on the virtual OS servers, verify live process tags and alarms update smoothly without communication timeout warnings.
Check Windows Event Viewer on virtual servers: confirm that time synchronization events originate exclusively from the external NTP server without host clock interference.

Limitations and Operational Precautions

Do not place redundant OS server pairs on the same physical ESXi hypervisor host. Redundant pairs must be distributed across separate physical servers using VMware Anti-Affinity rules to prevent simultaneous hardware failure.

Engineer FAQ

Can VMware ESXi host redundant PCS 7 OS servers?

Yes, but VMware Anti-Affinity rules must be configured so that OS Server 1 and OS Server 2 run on separate physical ESXi host hardware.

Why should VMware Tools time synchronization be disabled?

Hypervisor host clock sync causes sudden microsecond jumps that disrupt WinCC alarm logging sequence-of-events timestamps and SQL Server database consistency.

What virtual network adapter type is recommended for PCS 7 in VMware?

The VMXNET3 virtual network adapter, utilized with SIMATIC NET SOFTNET-IE (BCE).

Why must the Default Gateway be blank on the Plant Bus adapter?

To prevent asymmetric routing and TCP connection drops; only the Terminal Bus adapter should route outside the local subnet.

What is the maximum latency tolerated between virtual OS servers and physical controllers?

Round-trip network latency on the plant bus must remain under 10 ms to maintain stable S7 communication heartbeats.

Technical References

Related Tags

Virtualization
VMware ESXi
Plant Bus
Terminal Bus
VMXNET3
PCS 7 V8.1

20 respuestas

Virtualizing Multi-Project PCS 7 Architectures on VMware ESXi 6.7 with Spanned Plant and Terminal Buses