PCS 7 RDP vs KVM: Siemens Restrictions for OS Servers and Clients

PCS 7 RDP vs KVM: Siemens Release Constraints, Service-Mode Requirements, and IPC574 Field Practice

Siemens SIMATIC PCS 7 V9.x and V10 environments that mix redundant OS Servers, OS Clients, and Engineering Stations (ES) on SIMATIC IPC574 hardware raise a recurring infrastructure question: which remote-access technology does Siemens actually release for the operator stations — Remote Desktop Protocol (RDP) over standard Ethernet, or a dedicated Keyboard-Video-Mouse (KVM) extender over Category 6 / fiber cabling? The answer governs both capital expenditure (fiber KVM matrix switches vs. zero-cost TCP/IP infrastructure) and long-term data-integrity risk on the WinCC/PCS 7 archives.

This reference consolidates the official Siemens release statements, the underlying service-mode mechanism, the documented failure mode, the KVM-over-IP alternatives, and a verification procedure that lets an integrator prove to IT management that an RDP-only topology is not supported for OS Servers or the Engineering Station on a PCS 7 plant.

1. Problem Definition: Distance, KVM Signal Integrity, and the IT Department Debate

A standard PCS 7 station is a SIMATIC IPC574 (or the legacy IPC547 / IPC647 generation) installed in the Control and Protection Domain (CPD). The default operator-room layout is:

• Two redundant OS Servers (typically configured as a Master/Standby pair with a WinCC/PCS 7 redundancy license).
• Two OS Clients (one per operator console, usually with multi-monitor graphics cards supporting 4 to 6 screens each).
• One Engineering Station (ES) with the SIMATIC Manager / PCS 7 Engineering Toolset.
• Optional Web Navigator / Information Server host.

Originally the operator consoles and the OS Servers were co-located in the same cabinet row, and a KVM extender pair driven by shielded Category 6 cable delivered acceptable analog or digital video at distances of 30 to 50 m. New installations in the same plant have pushed the distance beyond 80 m, and image artifacts (pixel tearing, dropped frames, EDID re-handshake, USB keyboard lag) appear because:

• Category 6 copper KVM extenders are typically rated to 100 m, but only with premium shielded cable (S/FTP, foil + braid) and bonded conduit.
• Industrial CPDs route cable trays next to VFD power conductors, welding supplies, and 480 V motor feeders. Common-mode noise coupling degrades the TMDS video pairs even inside the KVM extender's shielding.
• Multi-head graphics cards (4 × DisplayPort 1.2) stress the extender's pixel clock; some KVM models only support dual-link DVI at 30 Hz beyond 50 m.

The IT department's preferred answer is RDP: it reuses the existing plant Ethernet, requires no proprietary hardware, and integrates with the Active Directory group policy. The integrator's counter-argument must be backed by official Siemens documentation, not by opinion.

2. Siemens Official Release Statement for RDP on PCS 7

Siemens publishes release statements in two layers:

1. PCS 7 Process Control System documentation — entry ID 109780270 on the Siemens Industry Online Support portal. The manual explicitly states that "Use of the Remote Desktop Protocol (RDP) is permitted only for remote maintenance of PCS 7 OS clients. The RealVNC software should be used for remote access…" See SIMATIC PCS 7 Process Control System, entry ID 109780270.
2. WinCC / TIA Portal help — the WinCC Server / WinCC RT Professional documentation entry on Remote access and Remote Desktop Protocol (RDP) repeats the same constraint at the WinCC layer: "The use of the Remote Desktop Protocol (RDP) is only permitted if the WinCC server or the single-station system is running in service mode." See Remote access and RDP (WinCC RT Professional V21).

Both documents collapse to the same decision tree, which is reproduced below as the canonical reference for any argument with IT management.

2.1 Decision matrix — Siemens release scope

3. Why Siemens Restricts RDP: The Service-Mode Mechanism

The restriction is not arbitrary. WinCC Runtime uses the Windows interactive desktop to host the Graphics Runtime process (CCWriteRts.dll and the PDLRT runtime). When an operator console or a server is launched normally, the runtime holds a window station handle (winsta0\default) and renders to a logical desktop. If an RDP session is opened against the same station while the runtime is running, Windows creates a separate session and a separate window station. The WinCC services detect a new logon event and re-attach their handles; on the next RDP session log-off, the services sometimes fail to release the handles cleanly, which is the root cause of the documented SQL background-process stop.

The fix in Siemens's official release is service mode:

1. Open WinCC Explorer on the OS Server or single-station system.
2. Right-click the computer name → Properties → Start Configuration.
3. Activate the "Service Mode" checkbox. This runs the Graphics Runtime as a Windows service (CCStartService.exe) that is decoupled from any interactive logon session.
4. Reboot the station. The runtime now starts before any RDP user logs on and survives an RDP disconnect.

Service mode is the only configuration under which Siemens releases RDP, and even then only for OS Clients. The OS Server role is excluded because the redundancy handshake — message-queue replication, partner-watchdog CCRedundantService, alarm-logging flush — depends on uninterrupted local access to the Windows Session 0 and the SQL Express instance.

4. The KVM Technology Family: Copper, Fiber, and IP

If RDP is constrained and Cat 6 copper is degraded, three KVM technologies are available. The choice is governed by distance, number of consoles, and the level of BIOS-level access required.

4.1 Copper KVM Extenders (Cat 5/6/6a)

• Typical distance: 50 to 100 m at 1920 × 1200 / 60 Hz, 150 m at 1080p.
• Limitation: Susceptible to electromagnetic interference from VFDs and 480 V feeders. Premium shielded S/FTP Cat 6a and grounded extender chassis are mandatory in industrial CPDs.
• Examples: AdderLink XDIP, Raritan Dominion CatX, IHSE Draco compact.

4.2 Fiber KVM Extenders

• Typical distance: 5 km (single-mode OS2 fiber) at 4K60, 300 m on multi-mode OM3.
• Advantages: Total galvanic isolation, immune to ground loops, immune to VFD common-mode noise. Latency < 1 ms with modern DisplayPort 1.2 optical transceivers.
• Examples: IHSE Draco vario, AdderLink Infinity, Black Box Emerald, Guntermann & Drunck (G&D) DL-Vision.
• Cost: Single-head fiber extender pair: USD 1,800 to 3,500. Four-by-eight matrix switch with fiber I/O: USD 18,000 to 45,000.

4.3 KVM-over-IP (IPMI, iLO, iDRAC, RealVNC Enterprise)

• Typical distance: Unlimited (any routable TCP/IP network).
• Examples: SIMATIC IPC574 includes Intel AMT / iAMT with out-of-band KVM; RealVNC Enterprise is the Siemens-recommended solution for OS Clients in service mode.
• Limitation: Out-of-band iAMT / iDRAC is not released by Siemens for PCS 7 OS Servers because the out-of-band channel cannot participate in the Windows domain authentication that the WinCC redundancy handshake requires.

5. SIMATIC IPC574 Hardware Considerations

The SIMATIC IPC574 (article number 6AG4014-1...) is the standard PCS 7 V9.x OS Server / OS Client / ES platform. The relevant specifications for KVM and remote-access design are:

For the operator consoles that are 80 m+ from the CPD, the recommended architecture is fiber KVM with 4-port multi-head transmitters (IHSE Draco vario DV-4XCPU or G&D DL-Vision), with the Cat 6 copper link replaced by single-mode OS2 9/125 fiber pairs. The fiber path also segregates the video link from the plant Ethernet, satisfying the IEC 62443 zone-and-conduit requirement for the Basic Process Control System (BPCS) zone.

6. RealVNC Enterprise — The Siemens-Recommended RDP Alternative

Where a TCP/IP solution is genuinely required (remote engineering from outside the plant, vendor support from a different continent), Siemens releases RealVNC Enterprise in addition to RDP. RealVNC's mirror driver integrates with the Windows session 0 and survives an RDP-style disconnect, which removes the database-detach failure that plain RDP triggers.

Implementation outline:

1. Acquire the RealVNC Enterprise license per OS Client / OS Server (Siemens supplies the SIMATIC WinCC/PCS 7 RealVNC bundle as add-on article number 6AV6371-1PT0x-0Ax0).
2. Install the RealVNC Server component on each OS Client and (with explicit Siemens approval) on the OS Server.
3. Configure the VNC Server in Service Mode (mirror driver + GFX hooks) — this is mandatory.
4. Open port 5900 (or 443 for the VNC Connect cloud relay) inbound to the operator subnet only; never to the corporate IT subnet.
5. Authenticate against the same Active Directory domain used for WinCC user administration.

7. BIOS-Level and Out-of-Band Access: When RDP Cannot Reach

KVM-over-IP and KVM extenders retain one capability that RDP cannot match: access before the operating system has booted, into the BIOS, the UEFI setup, the Intel iAMT provisioning console, or the Windows Recovery Environment. For a PCS 7 OS Server that fails to boot, only this layer of access can recover the system without dispatching a field engineer with a crash cart.

Recommended configuration on the SIMATIC IPC574 OS Servers:

1. Enable Intel iAMT in the BIOS setup (Advanced → Intel AMT → Enabled).
2. Provision iAMT to the management VLAN (out-of-band). Record the iAMT hostname and the MPS (Management Presence Server) address.
3. Use the VNC Viewer in iAMT mode (port 16994, 16995) for BIOS-level access only. This connection is for fault recovery, not for routine operation.

8. Verification Procedure After Installation

After a fiber KVM is installed (or RealVNC is deployed on the OS Clients), execute the following sequence to verify both the video quality and the runtime integrity.

1. Boot the OS Server. Verify that the WinCC Graphics Runtime launches automatically and that the green "Server is running" indicator appears in the operator area (lower right corner of the standard PCS 7 faceplate).
2. Open the redundancy status window (WinCC Explorer → Redundancy → Status). Confirm that the partner's status reads Standby and the last synchronization time stamp is current.
3. Initiate a forced failover (Right-click redundancy partner → Master). Confirm that the Standby takes over within 60 seconds and that the alarm log is continuous.
4. From a second OS Client, establish a VNC / KVM session against the OS Client under test. Walk through the operator screens, trigger an alarm, acknowledge it, and confirm that the alarm appears in the chronological log within 2 seconds.
5. Disconnect the VNC / KVM session. Wait 5 minutes. Reopen the WinCC Explorer on the OS Server. Confirm that the SQL Express database is still Online (right-click the database in SQL Server Management Studio → View Job History). The "DBM FULL" alarm must not appear.
6. Open the Windows Event Viewer → Applications and Services Logs → WinCC. No error events with Event ID 4900, 4901, or 4902 should appear in the last hour.

9. Troubleshooting Matrix

10. Building the Argument for IT Management

When the IT department presses for an RDP-only topology, the technical response should be:

1. Cite the release statement. Quote the SIMATIC PCS 7 manual (ID 109780270) section that limits RDP to OS Clients in service mode. Provide the link in writing.
2. State the failure mode. An RDP disconnect on the OS Server detaches the SQL Express database. The WinCC Runtime continues to accept new tag values but the archive flush stalls, leading to a DBM FULL alarm and loss of historical data.
3. Identify the cost of an archive loss. In a regulated process (FDA 21 CFR Part 11, GAMP 5), loss of one production batch's archive is a deviation report. A fiber KVM matrix switch pays back in one avoided deviation.
4. Offer the compromise. RDP is acceptable for OS Clients in service mode only, with RealVNC as the supported alternative. Fiber KVM extends coverage to the Engineering Station and the OS Servers without violating the Siemens release.

11. Migration Path: From Degraded Cat 6 to Fiber KVM

A typical migration plan for an existing PCS 7 plant with Cat 6 KVM degradation:

1. Survey all Cat 6 KVM runs; record distance, shielding type, and tray segregation.
2. For runs above 70 m, replace copper with OS2 single-mode fiber; use LC/UPC connectors and a 4-port KVM transmitter (e.g., IHSE Draco vario 4X-CPU).
3. For OS Clients inside the 50 m radius, retain the existing copper extenders, but upgrade to shielded S/FTP Cat 6a.
4. Install RealVNC Enterprise on the OS Clients and the ES for remote vendor support.
5. Disable RDP on the OS Server and the ES through Group Policy (Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections → Allow users to connect remotely = Disabled).
6. Document the topology in the Plant Security Plan and update the PCS 7 network architecture diagram.

12. Summary of Siemens-Released Remote-Access Methods

13. FAQ