Resolving WinCC V6.0 Web Navigator V6.1 SP1 Installation Conflict

David Krause12 min read
SiemensTroubleshootingWinCC
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Background: WinCC V6.0, PCS7 V6.1, and Web Navigator V6.1 SP1

SIMATIC PCS 7 V6.1 Service Pack 1 is delivered with WinCC V6.0 SP3a as the integrated HMI/SCADA runtime. The optional SIMATIC WinCC/Web Navigator V6.1 SP1 is an add-on package that publishes the active WinCC project over HTTP/HTTPS so that thin clients and Internet Explorer can operate the plant picture remotely. According to the official Siemens support release notice (entry ID 22453248), the Web Navigator V6.1 SP1 is released for delivery and requires WinCC V6.0 SP4 as its host runtime.

This creates a structural conflict in PCS 7 V6.1 environments: the base station install of PCS 7 V6.1 SP1 places WinCC V6.0 SP3a, while the Web Navigator V6.1 SP1 installer performs a build-level prerequisite check that demands SP4. Technicians who attempt to upgrade only the WinCC layer to SP4 from the standalone WinCC DVD supplied with the system (instead of the matching PCS 7 DVD) see the install routine abort with the message that "WinCC V6.0 SP3a is not installed" - because the SP4 upgrade patch re-checks the baseline SP3a package and fails when the PCS 7 stack has been layered on top.

The same configuration also produces a second, runtime-level failure: a successful first connection between Web Navigator client and server, followed by a permanent "Connecting to Server" loop on every subsequent launch, combined with the Web Configurator losing its bound server IP and reverting to "all not assigned" whenever WinCC is restarted. Both symptoms originate from the same root cause: a mis-paired WinCC/Web Navigator build combination layered over a PCS 7 V6.1 base.

Identifying the Dependency Conflict

Use the matrix below to confirm the exact build pairing that produced the abort. The matrix is derived from the Siemens release notice and the PCS 7 V6.1 compatibility documentation.

Host Runtime Web Navigator Add-on Supported on PCS 7 V6.1? Notes
WinCC V6.0 SP3a (PCS 7 baseline) Web Navigator V6.0 SP3 Yes - fully validated Default pairing shipped with PCS 7 V6.1
WinCC V6.0 SP3a (PCS 7 baseline) Web Navigator V6.1 SP1 No - install aborts Setup reports "SP3a missing" because SP4 redistributables are not present
WinCC V6.0 SP4 (standalone upgrade) Web Navigator V6.1 SP1 Restricted WinCC layer is correct for WebNav, but PCS 7 OS libraries expect SP3a symbols
WinCC V6.0 SP4 (from PCS 7 V7.0 media) Web Navigator V6.1 SP1 Yes - only when both come from PCS 7 V7.0+ Use this when the project can be migrated to PCS 7 V7.x

Diagnostic identifiers on the failing station:

  • Installer log file: %TEMP%\Siemens\WinCC_WebNav_Setup.log with the literal string WinCC V6.0 SP3a is required or component not found.
  • Registry key: HKLM\SOFTWARE\Siemens\Automation\WinCC\Versions\WebNavigator - the RequiredBase value is 6.0.4.0 when the SP4 build is mandated.
  • Windows Installer MSI return code: 0x80070643 (fatal install error) when the SP3a check fails.
Engineering note: Do not install Web Navigator from a mixed-media set (PCS 7 V6.1 DVD + standalone WinCC V6.0 SP4 DVD). The setup program performs a media-fingerprint check that fails on cross-DVD pairings. Use a single source DVD for both the WinCC runtime and the Web Navigator add-on.

Prerequisites Before Installation

Verify the following before re-attempting the Web Navigator V6.1 SP1 install on a PCS 7 V6.1 SP1 station:

  1. Logged in as a member of the local SIMATIC HMI group (or the Administrators group during install).
  2. All WinCC and PCS 7 components closed; services CCArchiveMgr, CCAlgHelpSrv, CCConnect, CCEventMgr, CCLicenseServer, CCMsgMgr, CCProjectMgr, CCRTLoader, CCSysdiag, CCTimeSync, and CCWinGraph stopped.
  3. Microsoft IIS installed and started. The Web Navigator V6.1 SP1 install requires IIS 5.1 (Windows XP Professional), IIS 6.0 (Windows Server 2003), or the IIS 6 compatibility layer on later OS versions with the WebNavigator ISAPI filter registered.
  4. Firewall inbound rules allowing TCP 80 and TCP 443 for the WinCCWebDeployer and the CCHttpServer service identity. Add a rule for C:\Siemens\WinCC\WebNavigator\Server\bin\CCHttpServer.exe.
  5. At least 500 MB free on the system drive and 1 GB on the partition hosting the WinCC project directory.
  6. Matching media: either the PCS 7 V7.0+ DVD set (which contains WinCC V6.0 SP4 and Web Navigator V6.1 SP1 in a tested combination) or the legacy pairing of WinCC V6.0 SP3a plus Web Navigator V6.0 SP3.

Resolving the Installer Abort: Two Valid Paths

Path A - Stay on PCS 7 V6.1, downgrade Web Navigator to V6.0 SP3

This is the path with the lowest risk for production PCS 7 V6.1 SP1 plants because the WinCC runtime build remains at SP3a (the verified baseline).

  1. Open Control Panel > Add/Remove Programs and uninstall Web Navigator V6.1 SP1 if a partial install exists.
  2. Insert the PCS 7 V6.1 SP1 Toolset DVD and run Setup.exe.
  3. Select Web Navigator V6.0 SP3 from the add-on menu. The installer recognizes the existing WinCC V6.0 SP3a runtime and completes without the prerequisite check failing.
  4. Reboot the server.
  5. Launch the Web Configurator from Start > SIMATIC > WinCC > Web Navigator > Web Configurator and bind the server to the dedicated network interface (do not leave it on "all not assigned").

Path B - Migrate the project to PCS 7 V7.0 or later with WinCC V6.0 SP4 and Web Navigator V6.1 SP1

Use this when new Web Navigator features (improved plug-in signing, additional diagnostics) are required and the plant is in a planned migration window.

  1. Back up the full WinCC project directory and the PCS 7 multiproject.
  2. Uninstall Web Navigator V6.0 SP3 / V6.1 SP1 (whichever is present).
  3. Uninstall WinCC V6.0 SP3a from the PCS 7 V6.1 base.
  4. Run Setup.exe from the PCS 7 V7.0 (or later) DVD. The PCS 7 setup will install WinCC V6.0 SP4 in the same transaction.
  5. From the same DVD, install Web Navigator V6.1 SP1. Because both packages are now sourced from a single media build, the prerequisite check passes.
  6. Re-import the project and run a PCS 7 OS project migration.
Compatibility boundary: PCS 7 V6.1 OS projects migrated to PCS 7 V7.0 must be re-compiled in the new AS/OS engineering tool. Do not assume a binary-compatible upgrade; PLC program symbols and SFC library versions must be re-checked before plant restart.

Resolving the "Connecting to Server" Hang and the Web Configurator IP Reset

When the Web Navigator client connects once successfully and then hangs on subsequent launches, and the Web Configurator reverts the bound server IP to all not assigned every time WinCC is restarted, the root cause is a write-protection on the configuration file WebNav.cfg in combination with the WebConfigurator service running under an account that loses the binding on logout.

Symptom-to-cause mapping

Symptom Likely Cause Verification Command / Location
"Connecting to Server" never completes CCHttpServer service not running or blocked by firewall sc query CCHttpServer; check %WinCCInstallDir%\WebNavigator\Server\log\CCHttpServer.log
Web Configurator IP shows "all not assigned" after restart WebNav.cfg written by an account different from the runtime service identity, ACL strips the value on next load Inspect file ACL: cacls "%WinCCInstallDir%\WebNavigator\Server\WebNav.cfg"
First connection works, second fails Anonymous IIS user lacks the WinCC project directory read permission after WinCC reloads the project IIS Manager > WebNavigator virtual directory > Directory Security > Authentication
Client installs fine but cannot load process pictures Required plug-ins (Basic Process Control / Advanced Process Control) not registered on client Check C:\Program Files\Siemens\Automation\WebNavigatorClient\Plugins

Step-by-step repair procedure

  1. Stop all WinCC and Web Navigator services. From an elevated command prompt:
    net stop CCHttpServer && net stop CCMsgMgr && net stop CCProjectMgr
  2. Reset the WebNav.cfg ownership and ACL. The file lives at %ProgramFiles%\Siemens\Automation\WinCC\WebNavigator\Server\WebNav.cfg. Set the owner to the SIMATIC HMI group and grant the SIMATIC HMI and SYSTEM accounts Modify + Read & Execute:
    icacls "WebNav.cfg" /setowner "SIMATIC HMI" /T /C
    icacls "WebNav.cfg" /grant "SIMATIC HMI:(M,RE)" /T /C
    icacls "WebNav.cfg" /grant "SYSTEM:(F)" /T /C
  3. Re-bind the IP address inside the Web Configurator and click Apply (do not just close the window). Verify that the IP is written to disk by reopening the configurator; the field should retain the value.
  4. Confirm the CCHttpServer service identity. Open services.msc, locate CC HTTP Server, and set the log-on account to a dedicated domain user that is a member of SIMATIC HMI. Restart the service.
  5. Allow the CCHttpServer through Windows Firewall with an inbound rule:
    netsh advfirewall firewall add rule name="WinCC Web Navigator" dir=in action=allow program="%ProgramFiles%\Siemens\Automation\WinCC\WebNavigator\Server\bin\CCHttpServer.exe" enable=yes
  6. On the client, re-install the Web Navigator Client and both plug-ins (Basic Process Control and Advanced Process Control) from the same media used on the server. Mismatched plug-in versions are a common cause of the "Connecting to Server" hang after the first successful connect.
  7. Publish the project on the server from WinCC Explorer > Web Navigator > Web View Publisher. A published project is the only one the client can load.
  8. From the client browser, browse to http://<server>/WebNavigator/WebClient.htm and log in with a WinCC user that has at least the Web Navigator - Operator authorization.

IIS, DCOM, and Network Configuration

The Web Navigator V6.1 SP1 install registers an ISAPI filter and a virtual directory in IIS. Misconfiguration of these elements reproduces the "Connecting to Server" loop even when the WinCC side is healthy. Validate the following:

Component Setting Where to verify
IIS Web Service Extensions "WinCC Web Navigator ISAPI" set to Allowed IIS Manager > Web Service Extensions
WebNavigator virtual directory Application pool: DefaultAppPool; execute permissions: Scripts and Executables IIS Manager > Default Web Site > WebNavigator > Properties
Directory Security Anonymous access enabled; user IUSR_<host> a member of SIMATIC HMI Virtual directory > Directory Security > Authentication
DCOM WinCC Web Navigator Server AppID launch and access permissions granted to SIMATIC HMI and the IIS anonymous account dcomcnfg.exe > Component Services
WinCC user administration Every client user has a WinCC-level account with at least one authorization; password length >= 6 WinCC Explorer > User Administrator
Network binding order The network interface that carries the Web Navigator traffic is the first-bound NIC (not a virtual Hyper-V / VPN adapter) Network Connections > Advanced > Advanced Settings > Adapters and Bindings

Client Plug-in Requirements and Cache Hygiene

The Web Navigator client loads two plug-ins on first connect:

  • Basic Process Control - alarm logging, tag forcing, and standard picture navigation. Always required.
  • Advanced Process Control - SFC visualization, batch views, and PCS 7-specific add-ons. Required only when the published project contains these picture types.

After any server-side change (project republish, plug-in upgrade, server IP change), the client must clear the Internet Explorer Temporary Internet Files and the Downloaded Program Files folder. The WebClient.cab ActiveX control caches aggressively; a stale cabinet will sit in the "Connecting to Server" loop because the version it expects no longer matches the server handshake.

Engineering note: Internet Explorer 6 SP1 or 7 is the supported browser for Web Navigator V6.1 SP1. Later IE versions in compatibility mode and early Edge versions are not validated by Siemens for this build. Verify the browser with the official WinCC/Web Navigator V6.1 SP1 manual before any migration.

Diagnostic Checklist and Verification

After applying the corrective procedure, walk through the following verification matrix on the server, then on the client.

# Verification Step Expected Result Pass / Fail Indicator
1 Service state of CCHttpServer RUNNING sc query CCHttpServer returns STATE: 4 RUNNING
2 WebNav.cfg IP after WinCC restart Bound IP retained, not "all not assigned" Reopen Web Configurator; field still shows server IP
3 IIS virtual directory responds HTTP 200 on /WebNavigator/WebClient.htm curl -I http://localhost/WebNavigator/WebClient.htm
4 Client first-load plug-in install Basic + Advanced plug-ins register IE > Manage Add-ons shows both as enabled
5 Client second-load connection Connects without re-entering credentials WinCC user session persisted in the WebClient cookie
6 Picture navigation in client All process pictures load, tag values update Picture change does not show "Picture not found" or red X
7 Server-side log clean of errors No new error entries after a 15-min runtime CCHttpServer.log and WebNav.log contain only INFO lines

Edge Cases and Field-Proven Caveats

  • Antivirus interaction. Some endpoint security suites quarantine CCHttpServer.exe or inject a TLS-inspection shim that breaks the Web Navigator handshake. Add the WinCC installation directory and the CCHttpServer binary to the AV exclusion list and test again.
  • Domain vs. local user accounts. If the CCHttpServer service is set to run as a local system account while the IIS anonymous user is a domain account, the Web Configurator IP will reset on every restart. Use a single service identity for both IIS and CCHttpServer.
  • Time skew. The Web Navigator session token uses the Windows time stamp. A client clock more than 5 minutes off the server's clock will hang at "Connecting to Server". Enable CCTimeSync or an NTP source on both ends.
  • Multilingual project paths. Project directories with non-ASCII characters occasionally fail to publish; keep WinCC project paths in pure ASCII to avoid obscure path-resolution errors in the Web View Publisher.
  • Concurrent OS client sessions. WinCC/Web Navigator V6.1 SP1 licenses concurrent client connections, not named users. Exceeding the licensed count produces a login dialog that never completes; it can be mistaken for a network hang.

FAQ

Why does the Web Navigator V6.1 SP1 setup say that WinCC V6.0 SP3a is missing even when it is installed?

The Web Navigator V6.1 SP1 installer was released to require WinCC V6.0 SP4 (per Siemens support entry 22453248). When you upgrade only the WinCC layer to SP4 from a separate DVD and keep the PCS 7 V6.1 base, the installer's prerequisite scan sees the PCS 7 stack pointing at the SP3a baseline and aborts with that message. Use a single-source DVD (PCS 7 V7.0+ media) or stay on Web Navigator V6.0 SP3 for PCS 7 V6.1.

Can I install WinCC V6.0 SP4 over a PCS 7 V6.1 SP1 system and then add Web Navigator V6.1 SP1?

Technically the install will complete, but PCS 7 V6.1 OS libraries are built against the SP3a symbol set. Mixing SP4 into a PCS 7 V6.1 base is not a supported configuration. The supported migration is to move the whole project to PCS 7 V7.0 or later, which carries the SP4 runtime and the Web Navigator V6.1 SP1 add-on in a tested combination.

Why does my Web Navigator client connect once, then hang on "Connecting to Server"?

The most frequent causes are (a) the CCHttpServer service not running, (b) the WebNav.cfg ACL stripping the bound IP on the next WinCC restart, (c) the IIS anonymous user lacking read permission on the WinCC project directory, or (d) a stale WebClient.cab cached in the client. Reset the ACL, restart CCHttpServer, and clear the IE temporary files before re-testing.

What inbound firewall ports must be open for WinCC/Web Navigator V6.1 SP1?

Open TCP 80 (HTTP) and TCP 443 (HTTPS) for the CCHttpServer executable, plus the DCOM ephemeral range (TCP 135 plus the dynamic range 1024-65535) for the WinCC Web Navigator Server DCOM AppID. Restrict the rules to the management VLAN or VPN that carries the client traffic.

How do I stop the Web Configurator from resetting the server IP to "all not assigned"?

Confirm that the user account that writes the configuration has Modify permission on WebNav.cfg, that the file is not marked read-only, and that the CCHttpServer service identity matches the account that originally wrote the file. After binding the IP in the Web Configurator, click Apply and then close - do not kill the WinCC Explorer process, as the in-memory copy of the configuration is flushed on a clean shutdown only.

Back to blog