Resolving WinCC V7.4 SP1 OS Server Communication Failure

Problem Overview

A WinCC V7.4 SP1 OS Client successfully copies a PCS 7 project from the engineering station and binds the project path in the SIMATIC Manager. The Client/Server link is created without errors. When the operator attempts to launch the visualization from the OS Client, the WinCC Explorer either hangs at startup, returns to the desktop, or reports that the OS Server cannot be reached. The fault reproduces on Windows 10 Enterprise 1809 (LTSC 2019 / October 2018 Update) but works normally on Windows 10 LTSB 2015 (Build 10240, Creators Update 1507).

Typical accompanying symptoms in WinCC_Sys_<ComputerName>.log and SQLANY.LOG include:

• Event ID 4096, source CCAlgRpcSrv, message RPC server unavailable on the OS Server.
• Event ID 7034, source Service Control Manager, unexpected termination of CCAlgRpcService or S7DOS Help Service.
• OS Client splash screen freezing at Initializing graphics system.
• Alarm logging runtime crashes within 5–10 seconds of process startup, leaving a CCAlgHistoryServer.dmp in the project älarm directory.

Affected Software Matrix

Source: Siemens Entry ID 109751547 — PCS 7 V9.0 SP1 release notes and the WinCC V7.4 SP1 update readme archives on the Siemens Online Support portal.

Root Cause Analysis

The root cause is a version-skew between the OS Server (carrying the original PCS 7 V9.0 DVD image) and the OS Client (a fresh installation on Windows 10 1809 with the latest cumulative servicing stack). WinCC V7.4 SP1 Update 4 (shipped on the PCS 7 V9.0 DVD) was compiled and tested against the Windows 10 LTSB 2015 kernel and the corresponding Universal C Runtime (UCRT) revision. Windows 10 1809 ships UCRT 10.0.17763.1 and a new set of cryptographic primitives (CNG) that did not exist when Update 4 was built.

Three distinct failure paths are observed in field deployments:

1. ACE60.dll initialization failure. The ACE60.dll component (located in C:\Program Files (x86)\Siemens\Automation\WinCC\bin) is responsible for compression of the runtime database and the alarm log stream. On Windows 10 1809 the loader resolves dependencies against the new UCRT, but the manifest embedded in Update 4 still requests UCRT 10.0.10240. The OS Client logs a STATUS_DLL_NOT_FOUND (0xC0000135) for the runtime broker, which manifests as a hung Explorer.
2. CCAlgRpcSrv RPC binding failure. The ALG (Alarm Logging) RPC service binds to a dynamic endpoint on the OS Server. When the client cannot negotiate an authentication level that matches the new Windows 10 1809 NTLM defaults, the binding terminates with ERROR_ACCESS_DENIED (0x5) and the client hangs on the splash screen.
3. SIMATIC Logon credential mismatch. If SIMATIC Logon is configured on the OS Client but the user mapping table on the OS Server is missing, the Logon.exe process starts, the WinCC Explorer is launched by the same account, and the runtime fails to apply the WinCC operator authorization, causing the visualization to stay on the loading mask until the watchdog kills PDLRT.exe.

Compatibility Requirements

Before changing the project, validate the combination of Windows 10 build, WinCC V7.4 SP1 update level, and PCS 7 DVD against the matrix below.

Update 9 is the first WinCC V7.4 SP1 update that re-binds the manifest to UCRT 10.0.17763 and signs the binaries with the SHA-2 certificate. Update 10 additionally ships the PCS 7 V9.0 SP1 project compatibility shim, so it is the preferred target when the engineering station is also on PCS 7 V9.0 SP1.

Diagnostic Procedure

Follow the steps in order; do not skip the manifest check — it is the fastest way to confirm a version-skew.

1. Open Control Panel → Programs and Features on the failing OS Client and record the exact WinCC V7.4 SP1 entry, including the update suffix (e.g., WinCC V7.4 SP1 Update 4 (13.01.05.00)).
2. Open C:\Program Files (x86)\Siemens\Automation\WinCC\bin\ACE60.dll, right-click → Properties → Details and record File version and Product version. A build older than 7.4.1.9 indicates the OS Client is below the threshold for Windows 10 1809.
3. Open an elevated command prompt and run:
   wmic datafile where name="C:\\Program Files (x86)\\Siemens\\Automation\\WinCC\\bin\\ACE60.dll" get Version,ProductVersion
4. From Control Panel → Administrative Tools → Event Viewer, export the last 24 hours of Application and System logs. Filter for CCAlgRpcSrv, CCAlgHistoryServer, PDLRT, and SQLANY 17.0.
5. On the OS Server, run CCAlgRpcDiag.exe (located in bin) and verify the OS Client hostname appears in the connected clients list. If it does not, the RPC bind never succeeded.
6. Confirm the SIMATIC Logon mapping on the OS Server with LogonCfg.exe /list on the engineering station. The Windows account that starts the OS Client must be a member of the “SIMATIC HMI” group on the server.
7. On the OS Client, open Settings → Apps → Apps & Features → App execution aliases and ensure SQL Anywhere 17 is registered as a service and that dbsrv17.exe listens on TCP 4918 (default) without interference from any third-party database engine.

Solution Path A — Upgrade WinCC to Update 9 or Update 10

This is the recommended fix for Windows 10 1809 OS Clients. The update is cumulative; installing Update 10 on top of the PCS 7 V9.0 DVD image overwrites every prior patch.

1. Obtain WinCC V7.4 SP1 Update 9 or Update 10 from Siemens Online Support entry 109751547 (log-in with a Siemens customer account required).
2. Stop all WinCC services: net stop "CCAlgRpcService" /y, net stop "CCAlgHistoryServer" /y, net stop "S7DOS Help Service" /y, net stop "WNCCOA" /y, net stop "WinCC RT" /y, net stop "SIMATIC Logon" /y.
3. Disable antivirus real-time scanning for the duration of the install (Symantec, McAfee, and Trend Micro block the manifest update of ACE60.dll).
4. Mount the update ISO and run Setup.exe /r:noreboot. The /r:noreboot switch prevents the installer from restarting the OS Client mid-migration, which would corrupt the WinCC project cache.
5. When prompted, choose Upgrade existing installation. Do not select Repair — repair only re-applies the existing Update 4 bits and will not resolve the manifest mismatch.
6. Reboot. After reboot, verify ACE60.dll reports File version >= 7.4.1.10 (Update 9) or >= 7.4.1.11 (Update 10).
7. Re-apply the OS Client project from the engineering station. Right-click the OS Client in the SIMATIC Manager and choose Target system → Download → OS Client.

Solution Path B — Downgrade the OS Client to Windows 10 LTSB 2015

If the engineering site is locked to the PCS 7 V9.0 DVD and cannot acquire Update 9 or Update 10, the only supported alternative is to rebuild the OS Client on Windows 10 LTSB 2015 (Build 10240). This path is documented in the PCS 7 V9.0 readme and is still officially supported as of the original release.

1. Obtain a Windows 10 LTSB 2015 (10240) ISO from the Microsoft Volume Licensing Center.
2. Boot the OS Client from the ISO, choose Custom: Install Windows only, and delete all partitions on the system disk.
3. Disable the Windows Update service before joining the domain. Use the Local Group Policy editor to set Computer Configuration → Administrative Templates → Windows Components → Windows Update → Do not connect to any Windows Update Internet locations = Enabled. This prevents the build from auto-upgrading to a newer feature update.
4. Install the OS Client in the order: Windows Update agent → .NET Framework 3.5 → WinCC V7.4 SP1 Update 4 from the PCS 7 V9.0 DVD → SIMATIC Logon → project download.
5. Pin the build using the wimutil tool or, more practically, by setting the Windows Update agent to Notify before download and install so administrators can decline any feature update.

Solution Path C — Repair the SIMATIC Logon Mapping

If the manifest and the WinCC version are correct, the failure may be limited to credential mapping. This applies to installations where the OS Server was joined to the domain after the SIMATIC Logon configuration was exported.

1. On the engineering station, open the SIMATIC Manager and navigate to the OS project in the component view.
2. Right-click the OS Server and select Properties → SIMATIC Logon.
3. Click Edit user mapping. The dialog lists the Windows users, the WinCC operator authorization level, and the time zone used by the runtime.
4. Add the Windows account that runs the OS Client runtime. Use the DOMAIN\username notation; local accounts are not supported on multi-host OS installations.
5. Re-export the SIMATIC Logon configuration with SIMATIC Logon → Export. Copy the resulting *.slc file to the OS Server and import it with SIMATIC Logon Service → Configuration → Import.
6. Restart the OS Server and the OS Client in the order Server → Client.

Verification Procedure

After applying the chosen solution path, perform the verification below in sequence. Each step is a binary pass/fail; do not advance to the next step until the current one is green.

1. On the OS Client, open Start → Siemens Automation → WinCC Explorer. The Explorer must open the project within 10 seconds without producing a WinCC System Tray warning.
2. Click Start → Runtime. The PDL screen must render within 15 seconds. The status line must read Connected to OS Server.
3. Trigger a process tag from the AS (e.g., flip a bit in the S7 program) and verify the alarm appears in the WinCC Alarm Control on the OS Client within 2 seconds of the trigger.
4. On the OS Server, run CCAlgRpcDiag.exe again. The OS Client hostname must be listed with a Connection state of Active and an Auth state of NTLMv2.
5. Open the Windows Event Viewer on the OS Server and confirm no CCAlgRpcSrv errors with Event ID 4096 in the last 15 minutes.
6. Open the SQL Anywhere 17 console (Hwnd SQL Central) and verify the alarms database on the OS Client is receiving writes by checking the row count of the ALGVIEWCHANGES table.
7. Reboot the OS Client, log in, and re-launch the WinCC runtime. The project must auto-start without manual intervention.

ACE60.dll Verification Matrix

Use the table below to confirm a healthy ACE60.dll on the OS Client. The File version column is the value reported by Properties → Details; the UCRT binding column is the value reported by dumpbin /dependents ACE60.dll | findstr ucrt.

Troubleshooting Matrix

Preventive Measures for Future Upgrades

1. Pin the OS Client image with the wim capture once the upgrade is verified. Re-deploy the same image to all OS Clients to keep the WinCC update level consistent.
2. Maintain a small inventory table of OS Server version, OS Client version, and Windows 10 build. Add a column for the ACE60.dll file version so any future drift is caught at the engineering station, not at the operator desk.
3. Subscribe to the Siemens ProductCERT and WinCC Security Update feeds. Each WinCC V7.4 SP1 update changes the SHA-2 signature and may require a renewed server certificate.
4. Schedule the WinCC service restart as a weekly task. The CCAlgHistoryServer memory leak is fixed in Update 10 and is automatically recovered by the restart, but Update 4 still requires manual cleanup of ALGVIEWCHANGES every 30 days.
5. Keep at least one Windows 10 LTSB 2015 OS Client on the floor as a reference. The LTSB 2015 build remains the only configuration where the original PCS 7 V9.0 DVD image runs without an additional update and is invaluable when validating a new SIMATIC Logon configuration.