Fixing TIA Portal V13 WinCC Runtime Advanced Transfer Failure

Problem Overview

This article documents the complete diagnostic and remediation procedure for the failure mode where TIA Portal V13 on a Windows 8.1 engineering station cannot complete a project download to a Windows 8.1 PC station running WinCC Runtime Advanced, even though the engineering station can ping the runtime PC, the runtime loader is started, and the firewall has been (apparently) disabled on both ends. The failure is reported as "No connection to PC" in the TIA Portal "Download to device" dialog and resolves only after a project version compatibility issue is corrected and a fresh project archive is created. The case combines three independent root causes: a project version mismatch, a network profile misclassification, and a third-party firewall tamper protection. The full procedure below addresses all three plus the standard TIA Portal V13 to WinCC Runtime Advanced transfer prerequisites.

The diagnostic scope covers TIA Portal V13 (V13.0, V13 SP1, V13 SP1 Update 1 through Update 9, and V13 SP2), WinCC Runtime Advanced V13 (build numbers 13.0.0.0 through 13.0.2.0), and Windows 8.1 (build 9600) on both 32-bit and 64-bit platforms. While later TIA Portal versions (V14 through V20) share most of the same architecture, this article is scoped to V13 because the field case explicitly uses that version, and V13 has several quirks not present in V14+ (notably the separate S7RTM.exe loader, the older port allocations for WinCC tag logging, and the absence of the "PC interface" auto-detection wizard added in V15).

Symptoms and Failure Surface

Observed failure surface in TIA Portal V13 to WinCC Runtime Advanced PC station transfers:

• "Download to device" dialog: target status remains "Not reachable" or "No connection" with a yellow warning icon. TIA Portal's progress bar reaches 100% during the search phase and then shows the "No connection" status with no further diagnostic information.
• ICMP / Ping: ping <runtime_ip> -n 4 from the engineering station returns four replies with sub-millisecond RTT. There is no packet loss.
• WinCC Runtime Loader: the loader (running as S7RTM.exe) is in "Transfer" mode, displayed in the Windows system tray. The status text reads "Transfer mode - wait for download from engineering station".
• Local transfer: starting the transfer on the runtime PC itself (engineering and runtime on the same machine) also fails when the project archive is from a TIA Portal build older than the installed WinCC Runtime. The local transfer reports a different symptom: the loader rejects the .pdata file with "Project was created with a newer version of TIA Portal".
• Event Viewer: no application-level error is logged in eventvwr.msc under Windows Logs / Application. The failure is a timeout in TIA Portal's transfer dialog after roughly 30 seconds, with no event log correlation.
• Windows Firewall log: if the firewall is configured to log dropped packets (netsh advfirewall set allprofiles logging droppedconnections enable), the runtime PC's firewall log shows dropped inbound TCP/102 packets from the engineering station IP, confirming the firewall is the failure point even after the user manually disabled it (the third-party product re-enabled it via tamper protection).

Root Cause Analysis

Engineering transfer to WinCC Runtime Advanced is a TCP-based protocol that uses fixed service ports and the Siemens S7 communication stack. The "No connection" symptom with successful ICMP echo almost always traces to one of the following layers. In the field case, three of these layers were contributing causes and all three had to be corrected.

1. TCP service port filtering: Windows Firewall, third-party endpoint security, or upstream network devices (managed switches, routers, firewalls) are blocking the engineering transfer ports even though ICMP is permitted. The user-visible "I disabled the firewall" is often ineffective because the third-party product's tamper protection re-enables its own firewall within 30-60 seconds of the Windows Firewall being disabled.
2. Network profile / NLA category mismatch: Windows 8.1 classifies the Ethernet adapter as "Public network" rather than "Private" (Work) or "Domain". The "Public" profile applies a much stricter default firewall policy. Until the user explicitly changes the profile in Network and Sharing Center, all unsolicited inbound connections are dropped, including the engineering transfer.
3. PG/PC Interface access point mismatch: the S7ONLINE access point in the PG/PC Interface configuration is bound to the wrong network adapter. On a laptop with both Wi-Fi and Ethernet, or a workstation with Hyper-V / VMware / VPN virtual adapters, the S7ONLINE access point may default to the virtual adapter and never reach the physical Ethernet that is on the same subnet as the runtime PC.
4. User rights and group membership: WinCC Runtime Advanced refuses to start, or to accept a project transfer, unless the user starting the runtime is a member of the local Siemens TIA Engineer group on the runtime PC. The TIA Portal engineering station user must also be a member of the same group on the runtime PC if the transfer requires the runtime to perform a user authentication step (this is the default for V13 SP1+).
5. Project version mismatch: the .ap13 / .pdata archive was created in a TIA Portal build older than the runtime's installed version, or with a higher service pack / update than the runtime supports. The runtime will refuse to start a project whose version metadata does not match.
6. Third-party firewall "Smart Firewall" / "Intrusion Prevention": many endpoint security products (Norton Security, McAfee Endpoint, Trend Micro, Kaspersky, Sophos) re-enable their firewall after Windows Firewall is disabled, or use application-level rules that override port-based rules. Disabling Windows Firewall has no effect on the third-party product.
7. Multiple network adapters and binding order: dual-homed engineering stations (Wi-Fi + Ethernet, or Ethernet + Hyper-V virtual switch) may send the engineering transfer out on the wrong adapter, with the result that the runtime never receives the connection attempt.

Engineering Transfer Protocol and Port Reference

WinCC Runtime Advanced uses the Siemens S7 communication stack for engineering download, with additional proprietary services for the WinCC runtime loader and tag / alarm logging. The default ports and services for TIA Portal V13 are listed below. The same ports apply to TIA Portal V14 through V20 with the addition of TLS-wrapped variants on port 102 (S7 Communication over TLS) starting with V17.

Inline network flow diagram (ES = engineering station, RT = runtime PC, FW = firewall):

Prerequisites

Before attempting the transfer, confirm the following preconditions. Each item is required; missing any one of them is sufficient to produce the "No connection" symptom.

• TIA Portal version match: TIA Portal V13 (with the same Service Pack and Update) must be installed on both the engineering station and the runtime PC. Mixed builds (for example, engineering V13 SP1 Update 7, runtime V13 SP1 Update 8) will refuse the transfer with a version error.
• WinCC Runtime Advanced installed: install WinCC Runtime Advanced V13 on the PC station, matching the engineering TIA Portal build exactly. The install path is typically C:\Program Files\Siemens\Automation\WinCC\Advanced.
• Valid license: a valid WinCC Runtime Advanced license, either on a USB license dongle (slot 1 of the PC station) or activated in the Automation License Manager (ALM). Open the ALM (Start -> Siemens Automation -> Automation License Manager) and confirm the license is visible and not in "Missing" or "Error" state.
• Network reachability: the engineering station and runtime PC are on the same IP subnet (for example, 192.168.0.0/24) or routed with the required TCP ports (102, 2308, 5000-5009) permitted between them.
• Local administrator on runtime PC: a local or domain administrator account is required to add users to the Siemens TIA Engineer group and to configure Windows Firewall rules.
• Service account (optional): if the runtime is started as a Windows service, a dedicated service account is required with the Log on as a service right and membership in the Siemens TIA Engineer group.

Resolution Procedure - Step-by-Step

Step 1 - Verify TIA Portal and WinCC Runtime versions match

On the engineering station, open TIA Portal, go to menu Help -> About TIA Portal. Note the exact build string, for example TIA Portal V13.0 + SP1 + Update 7 (Build 13.0.1.7). On the runtime PC, open the Control Panel applet Programs and Features -> SIMATIC software and confirm the installed "SIMATIC WinCC Runtime Advanced" version. Alternatively, inspect the registry key:

reg query "HKLM\SOFTWARE\Siemens\Automation\WinCC\Advanced" /v Version

The version string must match the engineering build exactly. If the runtime has a newer build than the engineering project source, the project may refuse to start with a message "Project was created with a newer version of TIA Portal". If the runtime is older, the project may transfer but fail to load at runtime with a missing-DLL or missing-tag error.

Step 2 - Add the user account to the Siemens TIA Engineer group

WinCC Runtime Advanced enforces the following Windows local groups on the runtime PC. The user that starts the runtime, the user that runs TIA Portal on the engineering station, and any service account used to run the runtime as a service must all be members of these groups where applicable:

To add the user, open the Computer Management console on the runtime PC:

compmgmt.msc

Navigate to System Tools -> Local Users and Groups -> Groups. Double-click Siemens TIA Engineer, click Add, and enter the domain or local user that starts the runtime and the user that runs TIA Portal on the engineering station. If the runtime is started as a service, also add the service account. Click Apply, close the dialog, and have the user sign out and back in for the new group membership to take effect.

Per the official Siemens WinCC readme, WinCC Runtime Advanced can only be started if the user starting the runtime is a member and has the rights of the Siemens TIA Engineer group. Reference: Notes on operation of Runtime Advanced - WinCC. The same restriction applies to the engineering station user when transferring remotely.

Step 3 - Configure the network profile on Windows 8.1

Windows 8.1 classifies each network adapter into one of three profiles: Domain, Private (Home/Work), or Public. The Public profile applies a default-deny inbound policy, which blocks the engineering transfer. The classification is set the first time the adapter connects to a new network, and the user can change it manually. To verify and correct the profile:

1. Open Control Panel -> Network and Sharing Center on the runtime PC.
2. Click the Ethernet connection used for the engineering transfer.
3. Click Properties. Confirm the adapter is enabled and bound to TCP/IPv4.
4. Close the Properties dialog.
5. In Network and Sharing Center, find the "View your active networks" section. The current profile is shown next to the network name (for example, "Network 4: Public network", "Network 4: Work network", "Network 4: Domain network").
6. If the profile reads "Public network", click the network name and select Work network (Windows 8.1 displays "Work" for private, non-domain networks; "Home" for trusted private networks; "Domain" for domain-joined networks). Click Close.

Verify the profile is correct from an elevated command prompt:

netsh advfirewall show allprofiles

The "Private profile" and "Domain profile" sections should show "Firewall status = On" with the inbound rules from Step 4 active. The "Public profile" should be "On" but its rules should not include the engineering transfer ports (or the adapter should not be on the Public profile).

Step 4 - Open the engineering transfer ports in Windows Firewall

With the firewall re-enabled (disabling Windows Firewall is not recommended on Windows 8.1 and does not bypass third-party firewalls), add the following inbound rules on the runtime PC. Use PowerShell with administrator privileges for cleaner rule management:

New-NetFirewallRule -DisplayName "TIA V13 - S7ONLINE TCP 102 (RT Advanced)" `
  -Direction Inbound -Protocol TCP -LocalPort 102 `
  -Profile Private,Domain -Action Allow -Enabled True

New-NetFirewallRule -DisplayName "TIA V13 - WinCC RT Transfer 2308" `
  -Direction Inbound -Protocol TCP -LocalPort 2308 `
  -Profile Private,Domain -Action Allow -Enabled True

New-NetFirewallRule -DisplayName "TIA V13 - WinCC Tag/Alarm 5000-5009" `
  -Direction Inbound -Protocol TCP -LocalPort 5000-5009 `
  -Profile Private,Domain -Action Allow -Enabled True

Add the corresponding outbound allow rules on the engineering station:

New-NetFirewallRule -DisplayName "TIA V13 - S7ONLINE TCP 102 (ES outbound)" `
  -Direction Outbound -Protocol TCP -RemotePort 102 `
  -Profile Private,Domain -Action Allow -Enabled True

New-NetFirewallRule -DisplayName "TIA V13 - WinCC RT Transfer 2308 (ES outbound)" `
  -Direction Outbound -Protocol TCP -RemotePort 2308 `
  -Profile Private,Domain -Action Allow -Enabled True

New-NetFirewallRule -DisplayName "TIA V13 - WinCC Tag/Alarm 5000-5009 (ES outbound)" `
  -Direction Outbound -Protocol TCP -RemotePort 5000-5009 `
  -Profile Private,Domain -Action Allow -Enabled True

For tighter scope, the rules can be tied to the Siemens binaries rather than the ports:

• Engineering station: C:\Program Files\Siemens\Automation\Portal V13\bin\Siemens.Automation.Portal.exe, C:\Program Files\Siemens\Automation\Portal V13\bin\S7otbxsx.exe (S7 communication layer).
• Runtime PC: C:\Program Files\Siemens\Automation\WinCC\Advanced\bin\S7RTM.exe (runtime loader), C:\Program Files\Siemens\Automation\WinCC\Advanced\bin\HMIRTM.exe (runtime process), C:\Program Files\Siemens\Automation\WinCC\Advanced\bin\CCWriteHMIRTM.exe (project writer).

Application-based rules are preferable to port-based rules in regulated environments (PCI, NERC, IEC 62443) because they survive IP renumbering and VPN transitions.

Step 5 - Disable or correctly configure third-party endpoint security

Norton Security, McAfee Endpoint, Trend Micro, Kaspersky, Sophos, and Windows Defender on Windows 8.1 may re-enable their own firewall after Windows Firewall is disabled, because tamper protection detects the change and resets it within 30-60 seconds. In the field case, the user reported disabling both "internal Windows Firewall" and "Norton Security Firewall" - but the engineering transfer still failed. The likely cause is that Norton's "Smart Firewall" or "Intrusion Prevention" module re-engaged, or that Norton's "Application Blocking" rule was denying S7RTM.exe regardless of port state.

Perform the following in the Norton console (or the equivalent product):

1. Open the Norton main console and navigate to Settings -> Network -> Smart Firewall -> Trusted Networks. Add the engineering station's IP subnet (for example, 192.168.0.0/24) as trusted.
2. Navigate to Settings -> Network -> Smart Firewall -> Program Rules. Add the following applications with full inbound/outbound access ("Allow all traffic"):
   • C:\Program Files\Siemens\Automation\Portal V13\bin\Siemens.Automation.Portal.exe (engineering station only)
   • C:\Program Files\Siemens\Automation\Portal V13\bin\S7otbxsx.exe (engineering station only)
   • C:\Program Files\Siemens\Automation\WinCC\Advanced\bin\S7RTM.exe (runtime PC)
   • C:\Program Files\Siemens\Automation\WinCC\Advanced\bin\HMIRTM.exe (runtime PC)
3. Navigate to Settings -> Antivirus -> Scans and Risks -> Exclusions -> Add. Add the same executables to the antivirus exclusion list. This prevents the AV scanner from scanning the .pdata transfer stream, which can cause mid-transfer timeouts.
4. Disable "Smart Firewall" briefly only to confirm the transfer; re-enable with the rules in place. Do not leave the firewall disabled on a production machine.

Step 6 - Configure the PG/PC Interface access point

On the engineering station, open the PG/PC Interface configuration. In TIA Portal V13, the configuration tool is launched from Control Panel -> Siemens Automation -> PG/PC Interface or directly via s7tgtopx.exe from the TIA Portal installation directory. Assign the access point S7ONLINE to the physical Ethernet adapter that has line-of-sight to the runtime PC. Specifically:

1. Under Access Point of the Application, select S7ONLINE (STEP 7 / TIA Portal) from the dropdown. The right pane lists the installed interface modules with their assignments.
2. In the Interface Parameter Assignment Used list, select the entry whose description is the Intel / Realtek / Broadcom / Marvell Ethernet adapter on the correct subnet. Avoid the following entries:
   • TCP/IP (Auto) - TIA Portal V13 will use the auto-detected adapter, which may not be the one connected to the runtime PC.
   • Hyper-V Virtual Ethernet Adapter (when the workstation runs the Hyper-V role).
   • VMware VMnet / VirtualBox Host-Only / TAP-Win32 (when the workstation runs a virtual machine or VPN client).
   • Any WAN miniport or RAS dial-up adapter.
3. Click Properties on the selected adapter and confirm the IPv4 address is in the same subnet as the runtime PC (for example, engineering 192.168.0.10/24, runtime 192.168.0.20/24). Verify the subnet mask and the absence of a default gateway in the same subnet (a default gateway pointing to a corporate router is acceptable, but the subnet must match).
4. Click OK to apply, then OK again to close the PG/PC Interface dialog. The assignment is stored in the registry under HKLM\SOFTWARE\Siemens\Automation\Communication\S7ONLINE and persists across reboots.

Repeat the IP reachability check on the runtime PC. The runtime does not need a PG/PC Interface entry, but its Windows IP address must be reachable from the engineering station via the same subnet. From a PowerShell prompt on the engineering station:

ping 192.168.0.20
Test-NetConnection 192.168.0.20 -Port 102

If Test-NetConnection returns TcpTestSucceeded: True, TCP/102 is open. If it returns False, the firewall is still blocking. If it returns False with a "No route to host" error, the IP is on a different subnet or the routing is broken.

Step 7 - Initiate the transfer

1. On the runtime PC, start the WinCC Runtime Loader (Start -> Siemens Automation -> WinCC Runtime Loader or C:\Program Files\Siemens\Automation\WinCC\Advanced\bin\S7RTM.exe). The loader runs in the Windows system tray and displays a small icon with a green or red dot indicating runtime state. Click the icon to open the loader status dialog. Confirm it reads "Transfer" mode (yellow icon).
2. In TIA Portal on the engineering station, open the project. In the project tree, select the HMI device (under "Devices" in the TIA Portal project tree, the device is named for example "HMI_1 [WinCC RT Advanced]").
3. Right-click the HMI device and select Download to device -> Software (all), or click Download to device in the toolbar.
4. In the "Download to device" dialog, configure the connection:
   • Type of the PG/PC interface: PN/IE (PROFINET / Industrial Ethernet)
   • PG/PC interface: S7ONLINE
   • Connection to target/subnet: select the subnet that contains the runtime PC (for example, PN/IE_1 or a custom subnet name)
   • Address of the target device: the runtime PC's IPv4 address (for example, 192.168.0.20). For a runtime on the same PC, use 127.0.0.1 or the loopback entry.
5. Click Search. TIA Portal broadcasts a S7 discovery packet and lists all reachable S7 nodes. The WinCC RT Advanced node should appear in the list with its IP address and the WinCC runtime type. If the search returns no node, repeat Step 6 - the PG/PC Interface is bound to the wrong adapter.
6. Click the discovered node, then click Download. The transfer takes 30-180 seconds for typical projects, longer for projects with large tag logs, complex graphics, or remote I/O descriptors. Watch the progress bar; a stall at 0% or 30% typically indicates an antivirus scan of the transfer stream.
7. On the runtime PC, observe the WinCC Runtime Loader. The icon changes from yellow to red during transfer, then back to green when the runtime starts. The status text in the loader dialog changes from "Transfer" to "Running".

Offline Transfer Fallback

If direct network transfer remains unreliable (typically because of a corporate firewall, VPN segmentation, or a customer site without TIA Portal), Siemens provides an offline transfer method using a removable USB drive. This is the canonical method documented in the Siemens Industry Online Support FAQ 109478060 (German; machine-translated to English is acceptable for field use). The procedure is:

1. In TIA Portal on the engineering station, with the HMI device selected, choose Online -> Download to device -> Transfer as file. TIA Portal prompts for the destination drive; select the root of the USB drive. TIA Portal writes a .pdata package to the drive, with a name like MyProject.pdata or MyProject_1.pdata.
2. Safely eject the USB drive, transport it to the runtime PC, and insert it.
3. On the runtime PC, start the WinCC Runtime Loader if it is not already running.
4. In the loader, click File -> Transfer (or press Ctrl + T). The loader opens a file browser. Navigate to the USB drive, select the .pdata file, and click Open.
5. The runtime unpacks the package and starts the project. The runtime loader status changes to "Running" and the start screen appears.

Offline transfer is the recommended approach for customers in air-gapped or VPN-segmented plants, for shipping a project to a site where the TIA Portal license cannot be installed, and for projects where the TIA Portal engineering station cannot reach the runtime PC's subnet for network policy reasons.

Verification

After successful transfer, perform the following checks in order:

1. Runtime loader status: on the runtime PC, confirm the project name appears in the WinCC Runtime Loader status bar (for example, "Project: line1.pdata, running"). The icon should be green.
2. HMI screen: open the runtime HMI screen and confirm the start screen, tag connections to the S7 PLC, and alarm views are functional. Navigate to a screen that reads a tag from the PLC and confirm the value updates.
3. Online connection from engineering station: in TIA Portal, switch to Online -> Go online. The HMI device should now appear in the project tree with status "Online". Right-click the HMI device and select Online -> Diagnostics -> Status to view the runtime diagnostics (CPU load, memory, connection count).
4. Event Viewer: check Windows Event Viewer under Application log on the runtime PC. Look for any WinCC Runtime Advanced errors with Event IDs in the following ranges:
   • 1-50: severe runtime errors (license, DLL load failure)
   • 1001-1099: transfer-related events (transfer start, transfer complete, transfer abort)
   • 2001-2099: tag connection events (PLC connection, tag quality)
   • 3001-3099: alarm logging events
   The presence of Event ID 1001 followed by 1002 indicates a clean transfer.
5. PLC communication: confirm the runtime PC is receiving tags from the S7 PLC. The Tag Management editor in TIA Portal (in online mode) shows the connection state and the last value of each tag. A green dot next to the connection name indicates a healthy S7 connection.

Troubleshooting Matrix

Notes on Operation of Runtime Advanced (User Rights)

Per the official Siemens WinCC Basic / Advanced / Professional readme (referenced in Notes on operation of Runtime Advanced - WinCC), WinCC Runtime Advanced can only be started if the user starting the runtime is a member and has the rights of the Siemens TIA Engineer group. The same restriction applies to:

• Starting the runtime manually from the Windows Start menu.
• Starting the runtime as a Windows service (via sc start "Siemens S7RTM" or Service Control Manager).
• Accepting a project transfer from a remote engineering station.
• Saving runtime project backups via the loader's File -> Backup menu.
• Changing runtime language settings via the loader's File -> Language menu.

If the runtime is started as a service, the service logon account must be a member of the Siemens TIA Engineer group. The default LocalSystem account is acceptable because LocalSystem is implicitly a member of all local groups, but it does not have network credentials for the engineering transfer from a remote engineering station. Use a dedicated service account, add it to Siemens TIA Engineer, and grant it the Log on as a service right via secpol.msc -> Local Policies -> User Rights Assignment.

Network Topology and Adapter Binding Order

PC stations with multiple network adapters (laptop with Wi-Fi and Ethernet, virtual machines with Hyper-V virtual switch, VPN clients) confuse TIA Portal's automatic adapter selection. The most common failure mode is the engineering station attempting the transfer on the Wi-Fi adapter while the runtime PC is reachable only on the Ethernet adapter (or vice versa). Verify the binding order:

1. Open ncpa.cpl on the engineering station.
2. Press Alt to expose the menu, choose Advanced -> Advanced Settings.
3. In the "Connections" pane, confirm the Ethernet adapter used for the plant network is at the top of the binding order. Wi-Fi and virtual adapters should be below it.
4. Disable Wi-Fi temporarily if the engineering station is dual-homed, to ensure TCP/102 is sent out on the Ethernet adapter.

For virtual machines running on the engineering station (Hyper-V, VMware, VirtualBox), the virtual switch creates a virtual adapter that TIA Portal may select as the S7ONLINE target. Disable the virtual adapter, or remove the virtual switch if the virtual machine is not in use. Alternatively, configure the S7ONLINE access point to a specific adapter in the PG/PC Interface dialog (Step 6), bypassing the auto-detection.

Project Compatibility Across TIA Portal Versions

TIA Portal project archives are versioned by the build that created them. The version metadata is stored in the archive header and is checked by the runtime loader before the project is started. A version mismatch between the archive and the runtime produces a "Project was created with a newer / older version of TIA Portal" error and the project does not start.

When the source project is older than the live TIA Portal build (for example, V12 archive opened in V13), the project upgrades on open, but the original .ap13 archive metadata may still be V12. Always re-archive the project on the engineering station that is known to work, and use that archive for transfer to the runtime. The field case is exactly this scenario: the user opened a V12 archive in V13, the project upgraded, but the original archive was preserved with V12 metadata. The runtime refused to load it. Re-archiving from V13 with the new build metadata resolved the issue.

Diagnostic Commands Reference

Use the following commands to diagnose transfer issues. All commands are run from an elevated command prompt or PowerShell on the engineering station unless otherwise noted.

Diagnostic decision tree:

1. Run ping. If it fails, the IP is unreachable - fix routing or IP assignment first.
2. Run Test-NetConnection -Port 102. If it returns TcpTestSucceeded: True, the S7 communication channel is healthy and the failure is at the TIA Portal application level (PG/PC Interface, group membership, project archive). Proceed to Step 6 and Step 2 of the resolution procedure.
3. If Test-NetConnection fails with "Connection refused" (the IP is reachable but the port is not listening), the runtime loader is not running or the S7DOS service is not started. Restart the WinCC Runtime Loader.
4. If Test-NetConnection fails with "No route to host" or times out, the firewall is still blocking or the routing is broken. Re-verify Step 4 and Step 5 of the resolution procedure.

Service Account Configuration for Headless Runtime

For runtime PCs that start the runtime automatically at boot (operator stations, panel PCs, factory floor HMIs), the runtime is typically configured as a Windows service. The service logon account must have specific rights and group memberships. To configure the service:

1. Open services.msc on the runtime PC.
2. Locate the service Siemens S7RTM (WinCC Runtime Loader) and WinCC Runtime Advanced (if present). Right-click and select Properties.
3. On the Log On tab, select This account and enter the service account credentials (for example, DOMAIN\HmiService). If the runtime is on a workgroup (no domain), use .\HmiService with the local account name.
4. Grant the service account the following rights:
   • Log on as a service (secpol.msc -> Local Policies -> User Rights Assignment)
   • Log on as a batch job (only if the service uses batch logon)
   • Access this computer from the network (for remote engineering transfer)
5. Add the service account to the local groups:
   • Siemens TIA Engineer
   • Siemens HMI user (only if WinCC user administration is enabled)
   • SIMATIC HMI (legacy compatibility)
6. Grant the service account read/write access to the project directory (C:\Program Files\Siemens\Automation\WinCC\Advanced\Projects by default) and the runtime log directory (C:\Program Files\Siemens\Automation\WinCC\Advanced\Logs).
7. Restart the service and verify the runtime starts. Check the Event Viewer for any service-startup errors.

FAQ