Configuring Remote Desktop on SIMATIC IOT2050 SM for SIMATIC WinCC OA

The SIMATIC IOT2050 in the SM hardware variant is deployed as a compact edge gateway running SIMATIC WinCC Open Architecture (WinCC OA) as the supervisory software layer. Because the SM variant omits the integrated DisplayPort that the standard IOT2050 provides, engineers must establish a graphical desktop session through a remote protocol stack rather than a directly attached monitor. This reference documents the end-to-end procedure for installing a desktop environment, exposing it through xrdp or VNC, and validating the WinCC OA IPC Package 128 graphical console without physical video output.

1. Hardware Architecture and Display Subsystem

The IOT2050 product family ships in two principal configurations, both based on the same Linux-based firmware image (Example OS based on Debian / Siemens Industrial OS):

For the SM variant, Siemens does not provide a direct graphical video output. Practical workarounds in field deployments are limited to:

1. Software remote desktop (xrdp, VNC) over the management Ethernet port (X1 P1 or X2 P1).
2. Active DisplayPort adapter over USB — a USB-to-DisplayPort adapter does not function on the IOT2050 SM because the SoC does not expose a USB DisplayLink driver pathway in the Siemens stock image. This is not a recommended path.

2. Prerequisites

Before configuring the remote desktop, verify the following prerequisites.

2.1 Hardware Prerequisites

• SIMATIC IOT2050 SM with stable 24 V DC supply (terminal torque 0.56 Nm / 5 lb-in per the Operating Instructions).
• Ethernet cable to connect the engineering station to the IOT2050 (port X1 P1 LAN).
• Engineering PC running Windows 10/11 with Remote Desktop Client (mstsc.exe) or VNC Viewer (TigerVNC, RealVNC, or TightVNC).

2.2 Software Prerequisites

• Siemens Industrial OS (Debian-based) or Example OS image flashed to the IOT2050 (microSD or eMMC).
• SSH access already configured (default port 22).
• Root or sudo permissions for package installation.
• SIMATIC WinCC OA installation package (IPC Package 128 for IOT2050 from SiePortal).

2.3 Network Prerequisites

• IOT2050 management interface configured with a static IP (e.g., 192.168.200.10/24) or DHCP reservation.
• Engineering station in the same subnet with bidirectional reachability (verify with ping 192.168.200.10).
• Firewall rules permitting TCP 3389 (xrdp) or TCP 5900 (VNC display 0) inbound to the IOT2050.

3. Installing a Graphical Desktop Environment

The stock Siemens IOT2050 image ships as a headless Debian / Industrial OS installation without an X server or desktop manager. To run the WinCC OA Desktop UI (GEDI) locally, a graphical environment must be installed first.

3.1 Recommended: XFCE for Low Resource Footprint

XFCE consumes approximately 150–250 MB RAM, leaving sufficient headroom for WinCC OA's typical 1–2 GB working set on the 2 GB SM configuration.

# Update package metadata
sudo apt-get update
sudo apt-get upgrade -y

# Install X server and XFCE desktop
sudo apt-get install -y xorg xfce4 xfce4-goodies dbus-x11

# Set XFCE as the default session for any remote user
echo "xfce4-session" | sudo tee /etc/xrdp/startwm.sh.lastline

3.2 Alternative: MATE / GNOME (Higher Resource Use)

GNOME requires approximately 600 MB RAM and is generally not recommended for the 2 GB IOT2050 SM when running WinCC OA concurrently. MATE is a viable compromise at ~300 MB.

sudo apt-get install -y task-mate-desktop

4. Configuring xrdp for Remote Desktop Sessions

xrdp is the most direct path to a Microsoft Remote Desktop Protocol (RDP) session from a Windows engineering station. It integrates with the existing X server and PAM authentication.

4.1 Installation

sudo apt-get install -y xrdp
sudo systemctl enable xrdp
sudo systemctl start xrdp

# Add xrdp user to the ssl-cert group to read the TLS certificate
sudo adduser xrdp ssl-cert
sudo systemctl restart xrdp

4.2 Start-up Script Configuration

xrdp starts the X session by executing /etc/xrdp/startwm.sh. The default script sources the user profile and launches the desktop session specified in ~/.xsession or /etc/xrdp/startwm.sh.lastline.

sudo nano /etc/xrdp/startwm.sh

Replace the existing content with:

#!/bin/sh
if [ -r /etc/profile ]; then
  . /etc/profile
fi

export LANG=en_US.UTF-8
export DBUS_SESSION_BUS_ADDRESS=unix:path=/var/run/dbus/system_bus_socket

startxfce4

sudo chmod +x /etc/xrdp/startwm.sh
sudo systemctl restart xrdp

4.3 Connecting from Windows

1. Open Remote Desktop Connection (mstsc.exe).
2. Enter the IOT2050 IP (e.g., 192.168.200.10).
3. Set display to 24-bit color and resolution to 1280x800 for the IOT2050 SM's typical 16:9 panel association.
4. Click Connect and authenticate with a local Linux user (not root).

5. Configuring VNC as an Alternative Remote Desktop

VNC is useful in environments where RDP is firewalled or where cross-platform clients (macOS, Linux) need simultaneous access. TigerVNC is the recommended server for headless Debian systems.

5.1 Installation

sudo apt-get install -y tigervnc-standalone-server tigervnc-common

5.2 Set VNC Password

vncpasswd
# Enter a read-only and a full-control password when prompted

5.3 Create a VNC Startup Script

cat <<EOF | sudo tee /etc/systemd/system/[email protected]
[Unit]
Description=Start TigerVNC server at startup
After=syslog.target network.target

[Service]
Type=forking
User=<USERNAME>
PAMName=login
PIDFile=/home/<USERNAME>/.vnc/%H:%i.pid
ExecStartPre=-/usr/bin/vncserver -kill :%i > /dev/null 2>&1
ExecStart=/usr/bin/vncserver -depth 24 -geometry 1280x800 -localhost no :%i
ExecStop=/usr/bin/vncserver -kill :%i

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable [email protected]
sudo systemctl start [email protected]

5.4 Connecting from a VNC Client

Open a VNC viewer (e.g., TigerVNC Viewer) and connect to 192.168.200.10:5901. The display number 1 maps to TCP port 5901.

6. Network and Firewall Configuration

By default, the Siemens Industrial OS enables nftables or iptables with a restrictive INPUT chain. Remote desktop ports must be explicitly allowed.

6.1 iptables (Debian default)

sudo iptables -A INPUT -p tcp --dport 3389 -j ACCEPT   # xrdp
sudo iptables -A INPUT -p tcp --dport 5901 -j ACCEPT   # VNC display 1

# Persist across reboot
sudo apt-get install -y iptables-persistent
sudo netfilter-persistent save

6.2 nftables (Industrial OS / newer Debian)

sudo nft add rule inet filter input tcp dport { 3389, 5901 } accept
sudo nft list ruleset > /etc/nftables.conf

6.3 Port Reference Table

7. WinCC OA IPC Package 128 Installation on the IOT2050 SM

The IPC Package 128 referenced in the SiePortal is the SIMATIC WinCC OA pre-bundled installation for the IOT2050 platform. The package includes the WinCC OA Manager, Event, Console, and a pre-configured project skeleton.

7.1 Installation Sequence

1. Transfer the IPC package to the IOT2050 over SCP:

   scp IPC_Package_128_IOT2050.deb [email protected]:/tmp/

2. Install via dpkg:

   sudo dpkg -i /tmp/IPC_Package_128_IOT2050.deb
   sudo apt-get install -f -y   # resolve any missing dependencies
   

3. Verify the WinCC OA binaries are on PATH:

   which WCCOAui
   which WCCOActrl
   which WCCOAmanager

7.2 Launching the Desktop UI (GEDI) Over Remote Desktop

1. Connect to the IOT2050 SM via xrdp or VNC.
2. Open a terminal inside the remote session (xfce4-terminal).
3. Start the WinCC OA console:

   WCCOAui -proj <ProjectName>

4. For multi-process operation on a single device (manager + event + console), use the WinCC OA control panel:

   WCCOActrl -start <ProjectName> -num 1   # starts Manager 1
   WCCOActrl -start <ProjectName> -num 2   # starts Event 2
   WCCOAui -proj <ProjectName>            # starts Desktop UI as console

8. Verification Procedures

After installation, run the following verification sequence to confirm that the remote desktop path is operational and the WinCC OA stack is functional.

8.1 xrdp / VNC Service Health

sudo systemctl status xrdp            # should show "active (running)"
ss -tlnp | grep -E '3389|5901'        # confirm listening sockets

8.2 WinCC OA Manager Health

WCCOActrl -status -proj <ProjectName>
# Expected output includes lines for each started process and their state (Started/Stopped)

8.3 Console GEDI Connectivity

1. Launch WCCOAui in the remote desktop session.
2. Confirm the panel tree loads (panel.tree visible in the left pane).
3. Open System Management → Drivers and confirm at least one driver is OK (typically the sim or OPC UA driver).
4. Insert a test datapoint value through the para module and confirm it propagates to a panel widget.

8.4 Remote Session Performance Check

9. Troubleshooting Matrix

10. Operational Notes and Field-Proven Caveats

• Do not run WinCC OA as root. The xrdp session should be a non-root user; the WinCC OA Manager can be configured to drop privileges after startup.
• Persist the desktop install across image updates. When re-flashing the Siemens Industrial OS image, the XFCE/xrdp install must be reapplied. Consider scripting the post-install with a .deb overlay or a systemd firstboot.service.
• Watch eMMC wear. The IOT2050 SM's eMMC has a finite write endurance. The WinCC OA datapoint archive writes continuously; configure ring-buffered historic databases with write-interval no less than 10 seconds to extend eMMC life.
• For new deployments, prefer the standard IOT2050 (non-SM) variant if a DisplayPort-attached local panel is required at the cabinet door. The SM variant is optimized for headless operation.
• Validate the chassis grounding before commissioning per the Operating Instructions. Improper grounding can introduce display artifacts even over RDP because of Ethernet link noise on the management port.
• Use a managed switch with port security on the management VLAN. The IOT2050 exposes its console session over the same network that carries WinCC OA event traffic; isolation prevents accidental GEDI session hijacks from operational networks.

11. Frequently Asked Questions