Resolving PCS 7 V9.1 Standby OS Runtime Graphics Mismatch

When a SIMATIC PCS 7 V9.1 project is built around a minimal configuration (one Engineering Station combined with one OS, plus a redundant OS for hot-standby), engineers frequently observe that the runtime graphics on the Standby OS look completely different from the Master OS after a full project download. User-defined process pictures disappear, the WinCC User Administrator is empty, and component views render with default placeholders. This article documents the root cause, the configuration steps that are typically missed, and the commissioning procedure required to bring the redundant OS pair into a synchronized, production-ready state.

1. Problem Description

Symptom summary as reported in the field:

• PCS 7 V9.1 multiproject with a single ES-OS and a separate OS station configured as redundant partner.
• Download of the OS project to the Standby OS completes without an error message, but the activated runtime shows a different layout: standard PCS 7 faceplates, default overview area, missing user-defined pictures, no operator user accounts.
• User-administration data (operator rights, password lists) is empty on the Standby OS.
• Process value archive paths on the Standby OS reference a different drive or folder than the Master.
• After a delta/change download, the Standby OS graphics diverge further because the master no longer matches the standby.

The symptom is not a corrupted project file and not a WinCC licensing fault. It is a configuration ordering issue combined with the documented limitations of the PCS 7 Minimal Configurations topology.

2. Affected Versions and Scope

3. Root Cause Analysis

Two independent root causes combine to produce the symptom set.

3.1 Missing OS-Server-to-Standby-Server Assignment

The primary root cause is a configuration step that is not printed in the PCS 7 Minimal Configurations manual (entry ID 109481571 in the Siemens Industry Online Support) but is mandatory. On the OS that will become the master, the engineer must declare which PC station acts as the Standby Server.

If this assignment is absent, the OS compilation and download still complete, but the Standby OS receives only the public master runtime data. Project-local data on the Standby OS (User Administrator, picture hierarchy, text library, archive configuration) is not synchronized because the redundancy handshake never binds the two computers to a single project identity.

Reference: Siemens Industry Online Support – PCS 7 Compendium Part A, Configuration Guidelines, Section "OS Server".

3.2 Limitations of the PCS 7 Minimal Configuration

Siemens explicitly states that the minimal topology carries the following behavioral limits (excerpt from PCS 7 Minimal Configurations, Section 6):

• The first OS that activates runtime becomes the master. Whichever PC is started first wins. This is deterministic only if startup order is fixed; otherwise a power-on race can swap the master.
• For a complete (initial) download, runtime must be deactivated on both computers, the OS project must be closed on both, and the project must be compiled/downloaded from the ES.
• For a delta download (online changes), runtime must be stopped on the ES during OS compilation, the project reactivated for testing, and only then downloaded. During this window, the ES computer is not available for operator actions and not for archiving.
• Runtime archives created while runtime is active on the ES are stored inside the multiproject path. They are included in the ZIP file, which inflates the multiproject size and lengthens the archive cycle.

3.3 Archive and User-Data Synchronization Path

User administration and the runtime database are part of the OS project file set, but the WinCC User Administrator uses a local database (UserAdmin.mdf) that is replicated through the redundancy path only when the redundancy partner is correctly bound. With the binding missing, the standby receives an empty local copy. Process value archives behave similarly: the redundancy sync only mirrors segments that have a defined path on both partners.

4. Prerequisites

Before reconfiguring, verify the following:

1. Both PC stations are physically installed on the same terminal bus subnet, reachable by name (DNS or hosts file) and by IP. Test with ping -a <standby-name> from the master and vice-versa.
2. Windows user accounts on both PCs are members of the local group SIMATIC HMI and have the Log on as a service privilege.
3. SIMATIC Logon is installed and licensed on both stations; the WinCC User Administrator is configured on the ES-OS first, then the redundancy binding is established.
4. WinCC Redundancy license is present on the OS that will become the Master (entry ID 6AV6 371-1HF07-4AX0 for PCS 7 V9.1). On V9.0 and later, redundancy is a separate license; on older versions it may be bundled in the OS single-station license.
5. The multiproject has been compiled at least once with Charts > Compile and Download Objects > Compile OS.
6. Both OS computers are members of the same Windows workgroup or domain and have a common service account for the SIMATIC Logon Service if operator authentication is centralized.

5. Solution: Step-by-Step Recovery Procedure

Use this procedure when a Standby OS already shows mismatched runtime. It is also the correct initial commissioning sequence for a new project.

Step 1 – Deactivate Runtime on Both OS Stations

On the Master OS, open WinCC Explorer and choose File > Activate Runtime to deactivate. Repeat on the Standby OS. Verify in the Windows Services console that the SIMATIC WinCC Explorer service and the S7RTM redundancy tunnel are stopped on both machines.

Step 2 – Close the OS Project on Both Stations

Close the OS project on the ES-OS, the Master, and the Standby. In the SIMATIC Manager, the OS server objects should show Offline (not loaded).

Step 3 – Reset Runtime Archives on the ES Computer

From the ES, open the OS project editor and reset the archive configuration:

1. In WinCC Explorer on the ES, right-click Tag Logging > Archive Configuration.
2. On the Archives tab, mark all process value and alarm archives.
3. Click Reset and confirm. This clears the local segment files so they will be regenerated from live data on the next runtime start.
4. Close the entire PCS 7 project on the ES.

Step 4 – Configure the Master-to-Standby Binding

This is the step that is missing in most broken installations. In SIMATIC Manager / Project view on the ES:

1. Open the OS object that will become the master (for example, OS01_Master).
2. Choose Options > OS-Server Assignment (in older SIMATIC Manager this is on the context menu of the OS object).
3. In the Standby OS Server drop-down, select the PC station that is physically the second OS (for example, OS02_Standby).
4. Set the Preferred Master flag on the OS that should be the master after a simultaneous restart. Leave the other one cleared.
5. Confirm with Apply. The redundancy partner list must now show both station names with their WinCC project name identical.

Save the multiproject. The OS server assignment is stored in the OS object, not in the PC station, so this survives a re-compile of the OS.

Step 5 – Recompile and Download the OS

1. In SIMATIC Manager, right-click the Master OS > Compile OS > Entire OS with memory reset. Choose Scope = Entire project.
2. Wait for the compile log to finish without E errors. Warnings (W) about duplicate tag names can be ignored only if they refer to internally generated diagnostic tags.
3. Right-click the Master OS > Download to Target System. Choose Entire project. The download writes the project to the Master PC station.
4. Repeat the compile, then Download to Target System on the Standby OS.

Step 6 – Activate Runtime in the Correct Order

Activate runtime first on the Master OS, wait for the WinCC startup banner to reach the Runtime active state, then activate on the Standby OS. The standby performs a startup synchronization (up to several minutes depending on archive size), then mirrors the master. Verify in the redundancy diagnostics that the partner is reported as Connected, Synchronized.

To check the diagnostic state, open on the Master: Start > SIMATIC > WinCC > Tools > Redundancy Diagnostics. The state should read:

Redundancy State: PARTNER_ONLINE
Last Sync: <timestamp>
User DB Sync: OK

6. Handling OS Single Station Redundancy

In a true OS-Server / OS-Server redundancy (typical plant), the two OS servers share an OS project and an archive path on a separate file server. In the minimal configuration the redundancy mode is OS Single Station Redundancy, in which each PC has its own OS project, joined through the multiproject and bound by the OS-Server-Assignment described in Step 4. The two OS projects must be identical; a single byte difference in the project container will break the redundancy handshake and the standby will fall back to its last good state – which is often the empty placeholder set.

7. Verification Checklist

After the configuration and download, perform the following functional checks. Each check is binary – it either passes or the configuration is not yet correct.

1. On the Master and Standby, open WinCC Explorer and compare the project tree. The number of pictures, the number of tags, the number of archives and the user count must match exactly.
2. Open the user-defined process picture set (for example, @Overview.pdl replacements and customer pictures under Grafic) on both stations. The picture set must be identical.
3. Open the WinCC User Administrator on the Standby. The operator list and the password policy must be identical to the Master.
4. Trigger a process tag change on the AS. Verify that the value updates on the Standby within one second, indicating the live tag connection is bound.
5. Stop the WinCC runtime on the Master (simulate a failure). The Standby must take over operator control without operator intervention within the configured switchover time. Reverse the test and verify the same behavior.
6. Inspect the redundancy log file <WinCC project path>\Redundancy\Redundancy.log on both PCs. The most recent entry should be Partner is online, synchronized with no preceding Project mismatch entries.
7. Force a failover by pulling the terminal bus cable on the Master. The Standby should report Partner lost in the redundancy diagnostics and continue running standalone. Reconnect the cable and confirm the Standby re-synchronizes when runtime is reactivated on the Master.

8. Common Errors and Remediation Matrix

9. Workaround: Operating Runtime on the ES

The PCS 7 Minimal Configurations manual permits running runtime on the ES for short engineering tests, but it is not a normal operating mode. The procedure below keeps the multiproject size and the archive cycle in check when the ES runtime must run temporarily.

1. Deactivate runtime on the ES computer.
2. Reset the archives in the OS project on the ES computer (Tag Logging > Reset).
3. Close the entire PCS 7 project on the ES.
4. Reopen the project, activate runtime only for the test.
5. After the test, deactivate runtime again, reset the archives once more, and close the project.

10. Best Practices for PCS 7 V9.1 Minimal Redundancy

• Always commission the Standby binding before activating runtime for the first time, not after the first download fails.
• Keep the multiproject on a fixed drive letter on the ES (avoid path remapping on the Standby – the WinCC project path is stored absolutely in WinCCExplorer.MCP).
• Use a dedicated Windows user for the SIMATIC Logon service, and document the password in the plant's credential vault.
• Schedule the redundancy diagnostic check as a daily or weekly WinCC script, and raise a maintenance alarm on the OS if the partner state has not been Synchronized for more than 30 minutes.
• Apply PCS 7 V9.1 updates through the Siemens Automation License Manager and re-validate the redundancy after each hotfix. The WinCC Redundancy DLL is updated in the same patch as the OS runtime.
• Document the OS-Server-Assignment in the project's Plant Documentation and reference the section in PCS 7 Compendium Part A – Configuration Guidelines that justifies the choice.

11. Field-Commissioning Notes

When the redundant OS pair is part of a green-field commissioning, follow this sequence in the commissioning plan:

1. Install the ES image and the OS images from the same PCS 7 V9.1 installation media. Mismatched media versions are the single most common reason for project-mismatch errors at first activation.
2. Install the SIMATIC Logon role on both OS stations and configure the user database before the OS project is created.
3. Configure the OS-Server-Assignment in SIMATIC Manager, then perform the first full compile and download to both stations.
4. Activate the Master first, then the Standby. Capture a screenshot of the redundancy diagnostics state for the SAT (Site Acceptance Test) report.
5. Trigger a controlled failover (WinCC service stop on the Master) and time the switchover. Document the time in the SAT report. Typical target is < 30 s for a single-station redundancy.
6. Re-arm the Standby by re-activating runtime on the Master and observing the re-synchronization. Archive the resulting redundancy log file in the project documentation.

12. When to Migrate to OS-Server / OS-Server Redundancy

Siemens recommends moving away from the minimal configuration as soon as the plant grows. Triggers for migration:

• Number of process tags (WinCC tags, not AS tags) exceeds 8 000.
• Number of process pictures exceeds 80.
• Operator actions are required during delta downloads.
• The ES is required to remain available 24/7 for engineering on a live plant.
• Archive retention exceeds 30 days with a tag count above 2 000.

For any of the conditions above, plan a migration to a standard OS-Server / OS-Server topology with a separate OS client pool and a dedicated archive server. The OS-Server-Assignment and the OS project container model change in that topology – re-read the SIMATIC PCS 7 Compendium Part A – Configuration Guidelines and the SIMATIC PCS 7 Compendium Part F – Industrial Security document before re-architecting.