PCS 7 OS Server Redundancy: Live Migration Step-by-Step Guide

Overview

SIMATIC PCS 7 supports high-availability operation through OS server redundancy. A redundant pair (Master + Standby) keeps WinCC Runtime online even if one server fails, and the "SIMATIC PCS 7 Server Redundancy" software option is required on both OS servers. The challenge in a brownfield project is adding a second OS server to an already-running plant: the user wants the existing Master to keep serving clients, the AS to remain in RUN, and only the unavoidable NetPro download to produce a brief interruption.

This procedure covers configuring a redundant OS server pair in PCS 7 V8.x / V9.x while the process is in operation, with the AS going to STOP only for the NetPro download window. The minimum offline window is the time required for NetPro to push the new connection table into the AS.

Reference documentation: SIMATIC PCS 7 - PC Configuration (V9.1 SP1) and the SIMATIC Process Control System PCS 7 Compendium Part A - Configuration Guidelines, chapter 4.5.3 "OS Server".

Redundancy Architecture

A PCS 7 OS server pair consists of two physically separate stations (Master and Standby) running WinCC Runtime with the PCS 7 Server Redundancy option licensed on each. Both partners subscribe to the same AS connection (S7 connection to a CP 1623 / CP 1628 or integrated IE interface), maintain synchronized tag and alarm databases, and one is active at any moment.

The redundant pair communicates via a dedicated redundancy cable (cross-over or via a terminal bus switch) using the standard PCS 7 redundancy port. Both servers must have identical project databases (downloaded from the ES) and synchronized time-of-day, typically provided by the domain controller or a plant NTP server.

Prerequisites

1. Engineering Station (ES) with the current PCS 7 project open, including the Master OS server that is already running in the plant.
2. SIMATIC PCS 7 Server Redundancy license on both the existing and the new OS server (article number 6ES7652-1XX00-0XX0 family, version-dependent).
3. Identical hardware / software on the new Standby: same Windows version, same WinCC version, same PCS 7 version (V9.0, V9.0 SP2, V9.1, V9.1 SP1, etc.), same terminal bus IP subnet, and matching terminal bus network card.
4. Plant bus connectivity on the new Standby to all AS stations (S7 connections routed through plant bus). Verify ICMP reachability from ES to Standby and from Standby to each AS before any download.
5. NetPro connection table on the ES must be checked and compiled (Save and Compile > Connections (only)) before any download, otherwise the AS download will fail or rewrite unrelated connections.
6. OS Client updated: any OS Client project that points to the OS server list must be updated to include the new Standby as a redundancy partner before the standby is downloaded.
7. Process / Operations window: schedule the AS NetPro download during a low-risk process state. The AS will briefly cycle RUN → STOP → RUN during the connection download.

Pre-Migration Planning

1. Export the current WinCC project archive from the Master OS server. This is the recovery baseline if the new Standby is mis-configured.
2. Run WinCC Explorer > Server Data > Redundancy on the existing Master and document current partner settings (partner name, redundancy port, update interval). The default update interval is 1 s; do not change it without a documented justification.
3. Confirm that the new server PC has the same terminal bus IP class (typically 140.80.x.x in default PCS 7 terminal bus layout) and that no IP collision exists.
4. Stop and restart-freeze: the existing OS clients do not need to be stopped during the configuration phase. They will lose their connection only during the NetPro AS stop, which lasts seconds under normal conditions.

Step-by-Step Configuration

Step 1 - Insert the New Standby OS Server in the Project

In SIMATIC Manager (or PCS 7 V9.x Engineering), open the component view, right-click the OS folder of the plant, and select Insert New Object > SIMATIC PC Station. Name it consistently (for example OSSRV_02_STDB) and assign the OS server role in the PC station properties (OS > Server / Standby Server). Insert an IE General (or CP 1623) interface and bind the plant bus subnet to it.

In the component view, drag the WinCC application from the Master OS to the new PC station and reconfigure it as a Standby Server. Both servers must point to the same S7 connection at the AS level.

Step 2 - Configure the Redundancy Pair

Open the WinCC Explorer of the Master OS, then Server Data > Redundancy:

• Activate Activate redundancy.
• Partner server: enter the new Standby computer name (for example OSSRV_02).
• Redundancy port: default 6677; change only if the corporate firewall requires it.
• Update interval: 1000 ms (default).
• Lifecycle: Master waits one full update interval before declaring the Standby lost.

Repeat the same configuration on the new Standby server, pointing its redundancy partner back to the existing Master. The two views must match exactly; otherwise failover decisions become asymmetric.

Step 3 - Update the NetPro Connection Table

Open NetPro on the ES. For each AS, verify that the S7 connection list now contains both OS servers as connection partners. The existing Master keeps its connection; the new Standby gets a parallel connection to the same AS slot (for example S7 connection AS01_OSSrv_01 and AS01_OSSrv_02).

Compile only the connections (Network > Save and Compile > Connections (only)) - do not run a full Compile OS at this stage. Review the connection log for warnings such as duplicate connection or subnet mismatch; these will block the AS download.

Step 4 - Update the OS Client Server List

Open the OS client project and edit Server Data: add the new Standby as a redundancy partner to the existing Master. The OS client does not need to distinguish between Master and Standby - it treats both as the same logical server and only switches on a configured event.

Step 5 - Download the New Standby OS Server

1. Select the new OS server PC station in NetPro.
2. Right-click > Download to Target Station > Entire Station. The PG/PC interface must point to the terminal bus card and the correct computer name.
3. Confirm the Station Configuration Editor shows WinCC Runtime as configured. PCS 7 will push the Station Manager configuration first, then the WinCC project.
4. After the download, leave WinCC Runtime inactive on the Standby. Do not activate Runtime yet.

Step 6 - Download the Updated OS Client

Download the OS client so it knows the redundancy partner exists. Clients can be downloaded in RUN; this is a one-way push of project data and does not affect the running Runtime immediately. Activate Runtime on the client to load the new redundancy configuration.

Step 7 - Download NetPro to the AS (The Stop Window)

This is the only step that requires the AS to stop.

1. In NetPro, select the AS station.
2. Right-click > Download to Target Station > Connections and Gateways (or Selected Connections if your PCS 7 version supports it - this limits the scope of the CPU stop).
3. When prompted, confirm CPU STOP. The AS will go to STOP, the new S7 connections will be loaded, and the AS will restart in RUN.
4. Typical stop time is 15-60 seconds, depending on connection count, AS CPU type (AS 410 vs AS 400H), and memory card speed.

Step 8 - Activate Runtime on the Standby OS Server

With the AS now reachable, start WinCC Runtime on the new Standby. It will establish its S7 connection, synchronize tags and alarms with the Master, and enter Standby state. The OS client will not notice - it continues talking to the Master.

Step 9 - Stop and Re-Download the Original Master

The original Master is the last item touched, because it must be re-downloaded with the new redundancy partner known to it.

1. Stop WinCC Runtime on the original Master.
2. From NetPro on the ES, Download to Target Station > Entire Station on the original Master.
3. Activate Runtime. The original Master comes back up as Active; the new server enters Standby automatically because it has a higher instance counter from the runtime activation order.

During this final step the OS clients see a brief loss of process data (typically 5-15 seconds). The process itself is unaffected; the S7 connections in the AS are unchanged.

Verification and Commissioning

1. Open the Redundancy dialog on both OS servers and confirm Status: Synchronized.
2. In WinCC Explorer > Server Data > Redundancy > Statistics, check that the loss counter, synchronization events, and the last sync timestamp are updating.
3. On the OS client, open the Server status display (PCS 7 standard symbol library: @ServerRedundancy). It should show Master connected, Standby available.
4. Forced failover test: with operations informed, stop WinCC Runtime on the Master. Within 1-2 update intervals the Standby promotes itself, the OS client reconnects automatically, and the picture tree becomes live again. Document the failover time and verify it is within the agreed plant SLA (typical 2-5 seconds end-to-end).
5. Re-start the Master. Verify the new server comes back as Standby, not as a second Master. If both servers claim Master, a license mismatch or an asymmetric redundancy configuration is the most common cause.
6. Audit the AS connection list (NetPro, online view): both S7 connections show Established.

Troubleshooting Matrix

Operational and Maintenance Notes

• Apply WinCC / PCS 7 hotfixes to both servers at the same time. A version skew between Master and Standby is a documented cause of asymmetric failover.
• Keep the redundancy link on a dedicated NIC and a dedicated VLAN or physical switch. Sharing the terminal bus for redundancy traffic is permitted but increases the chance of split-brain under heavy load.
• Back up the WinCC project database on both servers after every WinCC compile. The redundant database is not a substitute for an offline backup.
• For plant-wide rollouts across multiple redundant pairs, repeat the procedure per AS and per server pair. The AS stop windows cannot be parallelized; sequence them.

Safety and Process Considerations

Although WinCC Runtime can be reloaded with the AS in RUN in many cases, the connection table download requires the CPU to stop. For a Safety Instrumented System (SIS) implemented with PCS 7, the safety AS must not be affected by an OS change. The standard AS (process AS) takes the brief stop; the F-system remains in RUN throughout the procedure.

Coordinate the procedure with the operating team, log the start and end times of the AS stop in the shift log, and have a written recovery path in case the Standby fails to synchronize after failover. The recovery path is the WinCC archive export taken in the pre-migration step.

FAQ