Background: WinCC V6.0, PCS7 V6.1, and Web Navigator V6.1 SP1
SIMATIC PCS 7 V6.1 Service Pack 1 is delivered with WinCC V6.0 SP3a as the integrated HMI/SCADA runtime. The optional SIMATIC WinCC/Web Navigator V6.1 SP1 is an add-on package that publishes the active WinCC project over HTTP/HTTPS so that thin clients and Internet Explorer can operate the plant picture remotely. According to the official Siemens support release notice (entry ID 22453248), the Web Navigator V6.1 SP1 is released for delivery and requires WinCC V6.0 SP4 as its host runtime.
This creates a structural conflict in PCS 7 V6.1 environments: the base station install of PCS 7 V6.1 SP1 places WinCC V6.0 SP3a, while the Web Navigator V6.1 SP1 installer performs a build-level prerequisite check that demands SP4. Technicians who attempt to upgrade only the WinCC layer to SP4 from the standalone WinCC DVD supplied with the system (instead of the matching PCS 7 DVD) see the install routine abort with the message that "WinCC V6.0 SP3a is not installed" - because the SP4 upgrade patch re-checks the baseline SP3a package and fails when the PCS 7 stack has been layered on top.
The same configuration also produces a second, runtime-level failure: a successful first connection between Web Navigator client and server, followed by a permanent "Connecting to Server" loop on every subsequent launch, combined with the Web Configurator losing its bound server IP and reverting to "all not assigned" whenever WinCC is restarted. Both symptoms originate from the same root cause: a mis-paired WinCC/Web Navigator build combination layered over a PCS 7 V6.1 base.
Identifying the Dependency Conflict
Use the matrix below to confirm the exact build pairing that produced the abort. The matrix is derived from the Siemens release notice and the PCS 7 V6.1 compatibility documentation.
| Host Runtime | Web Navigator Add-on | Supported on PCS 7 V6.1? | Notes |
|---|---|---|---|
| WinCC V6.0 SP3a (PCS 7 baseline) | Web Navigator V6.0 SP3 | Yes - fully validated | Default pairing shipped with PCS 7 V6.1 |
| WinCC V6.0 SP3a (PCS 7 baseline) | Web Navigator V6.1 SP1 | No - install aborts | Setup reports "SP3a missing" because SP4 redistributables are not present |
| WinCC V6.0 SP4 (standalone upgrade) | Web Navigator V6.1 SP1 | Restricted | WinCC layer is correct for WebNav, but PCS 7 OS libraries expect SP3a symbols |
| WinCC V6.0 SP4 (from PCS 7 V7.0 media) | Web Navigator V6.1 SP1 | Yes - only when both come from PCS 7 V7.0+ | Use this when the project can be migrated to PCS 7 V7.x |
Diagnostic identifiers on the failing station:
- Installer log file:
%TEMP%\Siemens\WinCC_WebNav_Setup.logwith the literal stringWinCC V6.0 SP3a is requiredorcomponent not found. - Registry key:
HKLM\SOFTWARE\Siemens\Automation\WinCC\Versions\WebNavigator- theRequiredBasevalue is6.0.4.0when the SP4 build is mandated. - Windows Installer
MSIreturn code:0x80070643(fatal install error) when the SP3a check fails.
Prerequisites Before Installation
Verify the following before re-attempting the Web Navigator V6.1 SP1 install on a PCS 7 V6.1 SP1 station:
- Logged in as a member of the local
SIMATIC HMIgroup (or theAdministratorsgroup during install). - All WinCC and PCS 7 components closed; services
CCArchiveMgr,CCAlgHelpSrv,CCConnect,CCEventMgr,CCLicenseServer,CCMsgMgr,CCProjectMgr,CCRTLoader,CCSysdiag,CCTimeSync, andCCWinGraphstopped. - Microsoft IIS installed and started. The Web Navigator V6.1 SP1 install requires IIS 5.1 (Windows XP Professional), IIS 6.0 (Windows Server 2003), or the IIS 6 compatibility layer on later OS versions with the WebNavigator ISAPI filter registered.
- Firewall inbound rules allowing TCP
80and TCP443for theWinCCWebDeployerand theCCHttpServerservice identity. Add a rule forC:\Siemens\WinCC\WebNavigator\Server\bin\CCHttpServer.exe. - At least 500 MB free on the system drive and 1 GB on the partition hosting the WinCC project directory.
- Matching media: either the PCS 7 V7.0+ DVD set (which contains WinCC V6.0 SP4 and Web Navigator V6.1 SP1 in a tested combination) or the legacy pairing of WinCC V6.0 SP3a plus Web Navigator V6.0 SP3.
Resolving the Installer Abort: Two Valid Paths
Path A - Stay on PCS 7 V6.1, downgrade Web Navigator to V6.0 SP3
This is the path with the lowest risk for production PCS 7 V6.1 SP1 plants because the WinCC runtime build remains at SP3a (the verified baseline).
- Open Control Panel > Add/Remove Programs and uninstall Web Navigator V6.1 SP1 if a partial install exists.
- Insert the PCS 7 V6.1 SP1 Toolset DVD and run
Setup.exe. - Select Web Navigator V6.0 SP3 from the add-on menu. The installer recognizes the existing WinCC V6.0 SP3a runtime and completes without the prerequisite check failing.
- Reboot the server.
- Launch the Web Configurator from
Start > SIMATIC > WinCC > Web Navigator > Web Configuratorand bind the server to the dedicated network interface (do not leave it on "all not assigned").
Path B - Migrate the project to PCS 7 V7.0 or later with WinCC V6.0 SP4 and Web Navigator V6.1 SP1
Use this when new Web Navigator features (improved plug-in signing, additional diagnostics) are required and the plant is in a planned migration window.
- Back up the full WinCC project directory and the PCS 7 multiproject.
- Uninstall Web Navigator V6.0 SP3 / V6.1 SP1 (whichever is present).
- Uninstall WinCC V6.0 SP3a from the PCS 7 V6.1 base.
- Run
Setup.exefrom the PCS 7 V7.0 (or later) DVD. The PCS 7 setup will install WinCC V6.0 SP4 in the same transaction. - From the same DVD, install Web Navigator V6.1 SP1. Because both packages are now sourced from a single media build, the prerequisite check passes.
- Re-import the project and run a PCS 7 OS project migration.
Resolving the "Connecting to Server" Hang and the Web Configurator IP Reset
When the Web Navigator client connects once successfully and then hangs on subsequent launches, and the Web Configurator reverts the bound server IP to all not assigned every time WinCC is restarted, the root cause is a write-protection on the configuration file WebNav.cfg in combination with the WebConfigurator service running under an account that loses the binding on logout.
Symptom-to-cause mapping
| Symptom | Likely Cause | Verification Command / Location |
|---|---|---|
| "Connecting to Server" never completes | CCHttpServer service not running or blocked by firewall |
sc query CCHttpServer; check %WinCCInstallDir%\WebNavigator\Server\log\CCHttpServer.log
|
| Web Configurator IP shows "all not assigned" after restart | WebNav.cfg written by an account different from the runtime service identity, ACL strips the value on next load | Inspect file ACL: cacls "%WinCCInstallDir%\WebNavigator\Server\WebNav.cfg"
|
| First connection works, second fails | Anonymous IIS user lacks the WinCC project directory read permission after WinCC reloads the project | IIS Manager > WebNavigator virtual directory > Directory Security > Authentication |
| Client installs fine but cannot load process pictures | Required plug-ins (Basic Process Control / Advanced Process Control) not registered on client | Check C:\Program Files\Siemens\Automation\WebNavigatorClient\Plugins
|
Step-by-step repair procedure
-
Stop all WinCC and Web Navigator services. From an elevated command prompt:
net stop CCHttpServer && net stop CCMsgMgr && net stop CCProjectMgr -
Reset the WebNav.cfg ownership and ACL. The file lives at
%ProgramFiles%\Siemens\Automation\WinCC\WebNavigator\Server\WebNav.cfg. Set the owner to theSIMATIC HMIgroup and grant theSIMATIC HMIandSYSTEMaccountsModify+Read & Execute:icacls "WebNav.cfg" /setowner "SIMATIC HMI" /T /Cicacls "WebNav.cfg" /grant "SIMATIC HMI:(M,RE)" /T /Cicacls "WebNav.cfg" /grant "SYSTEM:(F)" /T /C - Re-bind the IP address inside the Web Configurator and click Apply (do not just close the window). Verify that the IP is written to disk by reopening the configurator; the field should retain the value.
-
Confirm the CCHttpServer service identity. Open
services.msc, locate CC HTTP Server, and set the log-on account to a dedicated domain user that is a member ofSIMATIC HMI. Restart the service. -
Allow the CCHttpServer through Windows Firewall with an inbound rule:
netsh advfirewall firewall add rule name="WinCC Web Navigator" dir=in action=allow program="%ProgramFiles%\Siemens\Automation\WinCC\WebNavigator\Server\bin\CCHttpServer.exe" enable=yes - On the client, re-install the Web Navigator Client and both plug-ins (Basic Process Control and Advanced Process Control) from the same media used on the server. Mismatched plug-in versions are a common cause of the "Connecting to Server" hang after the first successful connect.
- Publish the project on the server from WinCC Explorer > Web Navigator > Web View Publisher. A published project is the only one the client can load.
-
From the client browser, browse to
http://<server>/WebNavigator/WebClient.htmand log in with a WinCC user that has at least theWeb Navigator - Operatorauthorization.
IIS, DCOM, and Network Configuration
The Web Navigator V6.1 SP1 install registers an ISAPI filter and a virtual directory in IIS. Misconfiguration of these elements reproduces the "Connecting to Server" loop even when the WinCC side is healthy. Validate the following:
| Component | Setting | Where to verify |
|---|---|---|
| IIS Web Service Extensions | "WinCC Web Navigator ISAPI" set to Allowed | IIS Manager > Web Service Extensions |
| WebNavigator virtual directory | Application pool: DefaultAppPool; execute permissions: Scripts and Executables | IIS Manager > Default Web Site > WebNavigator > Properties |
| Directory Security | Anonymous access enabled; user IUSR_<host> a member of SIMATIC HMI
|
Virtual directory > Directory Security > Authentication |
| DCOM |
WinCC Web Navigator Server AppID launch and access permissions granted to SIMATIC HMI and the IIS anonymous account |
dcomcnfg.exe > Component Services |
| WinCC user administration | Every client user has a WinCC-level account with at least one authorization; password length >= 6 | WinCC Explorer > User Administrator |
| Network binding order | The network interface that carries the Web Navigator traffic is the first-bound NIC (not a virtual Hyper-V / VPN adapter) | Network Connections > Advanced > Advanced Settings > Adapters and Bindings |
Client Plug-in Requirements and Cache Hygiene
The Web Navigator client loads two plug-ins on first connect:
- Basic Process Control - alarm logging, tag forcing, and standard picture navigation. Always required.
- Advanced Process Control - SFC visualization, batch views, and PCS 7-specific add-ons. Required only when the published project contains these picture types.
After any server-side change (project republish, plug-in upgrade, server IP change), the client must clear the Internet Explorer Temporary Internet Files and the Downloaded Program Files folder. The WebClient.cab ActiveX control caches aggressively; a stale cabinet will sit in the "Connecting to Server" loop because the version it expects no longer matches the server handshake.
Diagnostic Checklist and Verification
After applying the corrective procedure, walk through the following verification matrix on the server, then on the client.
| # | Verification Step | Expected Result | Pass / Fail Indicator |
|---|---|---|---|
| 1 | Service state of CCHttpServer | RUNNING |
sc query CCHttpServer returns STATE: 4 RUNNING
|
| 2 | WebNav.cfg IP after WinCC restart | Bound IP retained, not "all not assigned" | Reopen Web Configurator; field still shows server IP |
| 3 | IIS virtual directory responds | HTTP 200 on /WebNavigator/WebClient.htm
|
curl -I http://localhost/WebNavigator/WebClient.htm |
| 4 | Client first-load plug-in install | Basic + Advanced plug-ins register | IE > Manage Add-ons shows both as enabled |
| 5 | Client second-load connection | Connects without re-entering credentials | WinCC user session persisted in the WebClient cookie |
| 6 | Picture navigation in client | All process pictures load, tag values update | Picture change does not show "Picture not found" or red X |
| 7 | Server-side log clean of errors | No new error entries after a 15-min runtime |
CCHttpServer.log and WebNav.log contain only INFO lines |
Edge Cases and Field-Proven Caveats
-
Antivirus interaction. Some endpoint security suites quarantine
CCHttpServer.exeor inject a TLS-inspection shim that breaks the Web Navigator handshake. Add the WinCC installation directory and the CCHttpServer binary to the AV exclusion list and test again. - Domain vs. local user accounts. If the CCHttpServer service is set to run as a local system account while the IIS anonymous user is a domain account, the Web Configurator IP will reset on every restart. Use a single service identity for both IIS and CCHttpServer.
-
Time skew. The Web Navigator session token uses the Windows time stamp. A client clock more than 5 minutes off the server's clock will hang at "Connecting to Server". Enable
CCTimeSyncor an NTP source on both ends. - Multilingual project paths. Project directories with non-ASCII characters occasionally fail to publish; keep WinCC project paths in pure ASCII to avoid obscure path-resolution errors in the Web View Publisher.
- Concurrent OS client sessions. WinCC/Web Navigator V6.1 SP1 licenses concurrent client connections, not named users. Exceeding the licensed count produces a login dialog that never completes; it can be mistaken for a network hang.
FAQ
Why does the Web Navigator V6.1 SP1 setup say that WinCC V6.0 SP3a is missing even when it is installed?
The Web Navigator V6.1 SP1 installer was released to require WinCC V6.0 SP4 (per Siemens support entry 22453248). When you upgrade only the WinCC layer to SP4 from a separate DVD and keep the PCS 7 V6.1 base, the installer's prerequisite scan sees the PCS 7 stack pointing at the SP3a baseline and aborts with that message. Use a single-source DVD (PCS 7 V7.0+ media) or stay on Web Navigator V6.0 SP3 for PCS 7 V6.1.
Can I install WinCC V6.0 SP4 over a PCS 7 V6.1 SP1 system and then add Web Navigator V6.1 SP1?
Technically the install will complete, but PCS 7 V6.1 OS libraries are built against the SP3a symbol set. Mixing SP4 into a PCS 7 V6.1 base is not a supported configuration. The supported migration is to move the whole project to PCS 7 V7.0 or later, which carries the SP4 runtime and the Web Navigator V6.1 SP1 add-on in a tested combination.
Why does my Web Navigator client connect once, then hang on "Connecting to Server"?
The most frequent causes are (a) the CCHttpServer service not running, (b) the WebNav.cfg ACL stripping the bound IP on the next WinCC restart, (c) the IIS anonymous user lacking read permission on the WinCC project directory, or (d) a stale WebClient.cab cached in the client. Reset the ACL, restart CCHttpServer, and clear the IE temporary files before re-testing.
What inbound firewall ports must be open for WinCC/Web Navigator V6.1 SP1?
Open TCP 80 (HTTP) and TCP 443 (HTTPS) for the CCHttpServer executable, plus the DCOM ephemeral range (TCP 135 plus the dynamic range 1024-65535) for the WinCC Web Navigator Server DCOM AppID. Restrict the rules to the management VLAN or VPN that carries the client traffic.
How do I stop the Web Configurator from resetting the server IP to "all not assigned"?
Confirm that the user account that writes the configuration has Modify permission on WebNav.cfg, that the file is not marked read-only, and that the CCHttpServer service identity matches the account that originally wrote the file. After binding the IP in the Web Configurator, click Apply and then close - do not kill the WinCC Explorer process, as the in-memory copy of the configuration is flushed on a clean shutdown only.