Siemens WinCC Power Failure Recovery: SCADA Hardening Guide

Overview

Siemens WinCC is widely deployed as the supervisory layer for SIMATIC S7, SINUMERIK, and third-party PLCs across discrete and process industries. Unlike compiled-runtime HMI packages that store a fully resolved image of the project, WinCC reads from a project database, an archive database (Microsoft SQL Server / SQL Server Express), and a number of dynamically generated files in the runtime directory. When the host PC loses power abruptly, the runtime transaction log, the archive database, the alarm logging buffer, and the in-process script state are all in arbitrary intermediate states. On the next boot, WinCC's startup sequence may find a corrupt .ldf file, a missing tag connection container, or an inconsistent RT project folder, and either refuse to start Runtime or start with degraded data integrity.

This reference documents the field-proven hardening strategy for WinCC V7.x and the WinCC option Shutdown WinCC, covering project file architecture, runtime file hygiene, UPS-triggered orderly shutdown, OS-level journaling, physical operator-access controls, and a backup/restore plan that lets the line restart within minutes after an unplanned blackout. The guidance is independent of the specific TIA Portal or STEP 7 version used to author the project and applies to single-station, client/server, and WinCC/WebUX configurations.

Why WinCC Is More Sensitive Than Compiled HMI Packages

Compiled HMI panels and several third-party SCADA packages load an opaque, vendor-encoded project image and run from it in memory. The on-disk image is updated transactionally at design time, not at runtime, so an uncontrolled shutdown rarely touches the executable. WinCC, by contrast, treats Runtime as a live authoring environment:

• The project directory (default C:\Program Files\Siemens\Automation\WinCC\WinCCProjects\<ProjectName>) is read and written continuously by the alarm logging service, the tag logging service, the report job scheduler, and the user administrator.
• The archive database is a Microsoft SQL Server instance (full SQL or bundled SQL Server 2014/2016/2019 Express) with .mdf data and .ldf log files in <ProjectName>\ArchiveManager\ and per-tag subfolders.
• The script interpreter loads C and VBS actions into the Graphics Runtime, Alarm Logging Runtime, and Tag Logging Runtime DLLs that maintain open file handles for <ProjectName>.pck packs, picture caches, and ODBC connections.
• Internal WinCC services are started in a defined order by the WinCC Control Center / SIMATIC Shell and depend on the SQL Server, the Message Queue, and the Windows Event Log being consistent.

If the OS is hard-reset mid-transaction, the next WinCC Runtime start performs an integrity check and will either auto-repair, log an error, or refuse to activate Runtime. The Windows OS itself is also at risk: NTFS metadata, the registry hive, and the WMI repository may all be left inconsistent. UPS alone does not solve this if the UPS battery is depleted, the bypass is held, or an operator hard-resets the cabinet.

Project File Architecture and the Points of Failure

Understanding where WinCC writes at runtime is the first step to making it robust. The following table lists the volatile file groups and their recovery characteristics.

Three observations drive the rest of this guide: (1) only the project database and the archive database are critical to recover the running process; (2) the SQL Server write-ahead log is the most frequent corruption point, not the WinCC binaries; (3) a hard power cut can corrupt Windows itself, which no WinCC setting can prevent.

Step 1: Configure Orderly Shutdown with the Shutdown WinCC Add-On

The Shutdown WinCC option (Siemens catalog designation 6AV6371-1SA07-0AX0 for WinCC V7, or its TIA Portal equivalent) is the single most important measure for power-failure resilience. It interfaces the UPS monitoring contact (or a network UPS via the included agent) to trigger an orderly sequence: stop the WinCC Runtime first, then shut down the SQL Server, then initiate Windows shutdown. The result is that on the next boot the project, archives, and OS journals are all consistent.

Prerequisites

• UPS with a serial/USB contact-closure or SNMP card, plus a supported USB-to-serial converter if required by the host PC.
• Shutdown WinCC license installed and visible in WinCC Explorer > Help > About.
• Administrator rights on the WinCC station.
• Battery runtime sized for at least 180 seconds at full PC load after the start of the alarm event; verify with the UPS manufacturer runtime calculator.

Configuration Procedure

1. In the Windows Control Panel, install the UPS driver supplied with Shutdown WinCC (or the generic Windows UPS Service if no Shutdown WinCC driver is present). The driver maps the UPS contact into a Windows event.
2. Launch Start > Siemens Automation > Shutdown WinCC. The configuration dialog opens.
3. On the Power Failure Detection tab, select the COM port or USB device, and tick Activate power failure detection. Set the shutdown delay to 5–10 seconds to ride through nuisance trips.
4. On the Actions tab, define the order:
   1. Stop WinCC Runtime (calls deactivate project via the WinCC ODK API).
   2. Stop the SQL Server service (WinCCInstance<n>).
   3. Run any user script (optional, e.g. backup copy).
   4. Issue shutdown /s /t 30 /c "UPS power fail".
5. Set the minimum remaining battery threshold to 30%. Below this level Shutdown WinCC will initiate the sequence even if mains has been restored, to protect against oscillating brownouts.
6. Click Apply, then export the configuration with File > Export and store it under the project documentation folder for reproducibility.

Reference the official Siemens WinCC Shutdown Add-On manual (SIOS entry 109753634) for the latest firmware matrix and supported UPS hardware list.

Step 2: File Handling Best Practices in WinCC Project Design

Even with orderly shutdown, the runtime should be designed to keep on-disk state to a minimum. The guiding rule: open a file, read or write, close it immediately. Do not hold file handles open across scans or screen changes.

Scripts and File I/O

In C and VBS actions, use the FileSystemObject only inside the action body, never as a global object with a long-lived handle. Replace patterns such as:

Dim f As Object
Set f = CreateObject("Scripting.FileSystemObject")
' ... f used across the entire picture ...

with an open/use/close block scoped to a single trigger:

Sub OnClick(ByVal Item)
  Dim path : path = HMIRuntime.ActiveProject.Path & "\Trace\" & Format(Now,"yyyymmdd") & ".csv"
  Dim fso, ts
  Set fso = CreateObject("Scripting.FileSystemObject")
  Set ts  = fso.OpenTextFile(path, 8, True)   ' 8 = ForAppending
  ts.WriteLine Format(Now,"hh:nn:ss") & "," & SmartTags("Motor01_Speed")
  ts.Close
  Set ts  = Nothing
  Set fso = Nothing
End Sub

Closing ts inside the same sub releases the lock so a power cut at any point leaves either the old file (consistent) or the new file (consistent).

Tag Logging and Alarm Logging

• Use the segmented archive type (day, week, or month) so the active .mdf is rolled over to a closed segment on a schedule. Closed segments are read-only and cannot be corrupted by a hard power cut.
• Enable the SQL Server maintenance plan to BACKUP DATABASE at the same rollover boundary. A typical configuration backs up hourly for in-process tags, daily for trend archives, and weekly for long-term data.
• Set the runtime tag buffer to the smallest value consistent with the scan rate; a smaller buffer means fewer in-memory rows are at risk of loss.

Graphics and Picture Cache

• Pre-compile complex pictures and store them as compiled picture in the project to reduce cache regeneration time on restart.
• External picture references (links to .bmp, .emf) should be on a local SSD, not a network share. A network share that goes away on UPS shutdown will cause a runtime hang during picture load.

Step 3: UPS Sizing and Windows Power Configuration

A UPS that cannot bridge the time between a power outage and Shutdown WinCC completing its sequence is worse than no UPS: the PC is hard-cut mid-shutdown, which is the exact failure mode the system is meant to prevent.

Sizing Formula

Compute the required battery autonomy as:

Typical field values for a single-station WinCC V7 on an industrial Box PC (Core i5 class, 16 GB RAM, 256 GB SSD, two 24" monitors):

Add the PC load (W), the monitor load (W), and a 25% derating for battery ageing. Choose a UPS with a published runtime curve that exceeds 240 s at this load. Common validated choices for WinCC stations are the APC Smart-UPS SMT/SMC series and the Eaton 5PX, both of which are listed in the Shutdown WinCC compatibility matrix.

Windows Power Plan

1. Set Control Panel > Power Options > Choose what the power buttons do to Do nothing for the power button and Sleep for the lid close (if a panel PC).
2. Disable Fast Startup (Choose what the power buttons do > Change settings currently unavailable > Turn on fast startup uncheck). Fast Startup is a hybrid hibernate that leaves the OS in an inconsistent state across the next shutdown and is a documented source of boot failures.
3. Set the disk and SSD turn off hard disk after to Never in the active power plan. Spinning disks that stop on a power cut do not always spin back up under low battery.
4. In Device Manager > Disk drives &em>, open the SSD properties, Policies tab, and uncheck Enable write caching on the device if the UPS autonomy is marginal. This forces a flush on every transaction at the cost of throughput.

Step 4: OS-Level Journaling and File System Hardening

Even with WinCC perfectly configured, an NTFS metadata corruption can prevent Windows from booting. The following Windows-level settings reduce the impact of an unexpected power loss.

• Schedule chkdsk /f /r on the WinCC volume to run at the next restart, weekly. NTFS fixes minor inconsistencies on its own but logged events in Event Viewer > Windows Logs > Application with source NTFS indicate a journal that needs a real-time check.
• Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth monthly to validate the system component store.
• Move the WinCC project and the SQL Server data directories to a dedicated NTFS volume (e.g. D:\WinCC) so that user-profile and paging-file churn on C: do not compete for write bandwidth with WinCC during a brownout.
• Disable Windows Search Indexer on the WinCC volume; index rebuilds triggered by an unexpected shutdown can saturate disk I/O during startup and prolong boot into the dangerous low-battery window.
• For sites with chronic brownouts, deploy an industrial SSD with power-loss protection (PLP) capacitors such as the Swissbit X-60 or the Innodisk 3MG2-P. PLP holds the in-flight write cache long enough to commit to NAND when the supply rail collapses.

Step 5: Physical Operator-Access Controls

Some field events are not power failures at all but operator interventions: a long press of the power button, pulling the mains plug during a cleaning shift, or tripping a wall breaker. No UPS or software setting can defeat a held-in power button.

• Deploy a SIMATIC IPC (e.g. SIMATIC IPC227G, IPC477E) or a Siemens Box PC inside the control cabinet. The cabinet key becomes the access control and the front-panel power button is unreachable.
• Where a panel PC must be on the operator console, fit a cover plate over the power button and the USB ports to prevent casual access. Use a recessed, key-operated power switch routed to the motherboard power header.
• Disable the front-panel reset header on the motherboard if the cabinet layout allows. The reset switch is the most common path to a hard power cut on a panel PC.
• Label the mains and UPS outlets with lockout-tagout placards so that electrical maintenance cannot unplug the PC by accident.

Step 6: Backup Strategy and Recovery Time Objective

The single most effective operational measure is a verified, automated, versioned backup of the WinCC project. A corrupted project is recovered in minutes; without a backup it is recovered never.

Backup Tiers

Project Duplicator Script

Use the WinCC Project Duplicator from the command line to capture a consistent project image even while Runtime is active:

PDL.exe -source="C:\Program Files\Siemens\Automation\WinCC\WinCCProjects\Plant01" \
       -target="\\nas01\WinCC_Backup\Plant01_$(date +%Y%m%d_%H%M)" \
       -compress -v

Schedule this as a Windows Task Scheduler job with Run whether user is logged on or not and a service account that has read access to the project directory. Verify the exit code (ERRORLEVEL) and fail the job on a non-zero value so the backup is known to be invalid.

Step 7: Commissioning Verification Procedure

Before signing off a WinCC station as power-failure resilient, perform the following acceptance test with the customer present. Capture the results in the site commissioning report.

1. Cold start test: Power off the PC at the wall, wait 30 s, restore power. Verify that WinCC Runtime starts within the documented boot time, all archives are readable, and no SQL errors appear in Event Viewer.
2. UPS test: Disconnect the UPS mains input. Confirm that Shutdown WinCC starts its sequence within 10 s, Runtime stops cleanly, the OS shuts down, and the PC powers off before the UPS battery depletes.
3. Hard power cut test: With Runtime running, hold the power button for 10 s. Restore power and measure the time to a fully operational WinCC Runtime. Acceptable target: under 10 min with all data from the last archive segment.
4. Database corruption drill: On a test replica, deliberately truncate the <Project>_ALG_<yyyy-mm-dd>_<hhmmss>.ldf file while Runtime is running. Force a restart. Verify that the SQL Server auto-recovery completes and that no user-visible alarms are duplicated.
5. Backup restore drill: On a test replica, delete Plant01.pck. Run the L1 backup restore. Verify that the project activates, all pictures render, and the archive timeline continues seamlessly from the backup point.
6. OS restore drill: Apply the L3 image to a spare SSD. Boot the PC and verify that Runtime starts, the license is intact (or re-activates), and the most recent archive data is present.

Record the measured RTO for each tier in the commissioning report. Revisit the report after every Windows cumulative update, every WinCC service pack, and every major project change.

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

Several conditions recur in the field that are not covered in the WinCC manuals but are confirmed by Siemens Support entries.

• Hyper-V / VMware virtual hosts: Shutdown WinCC requires a physical UPS contact or a vendor-supplied hypervisor agent. The stock APC PowerChute VMware agent does not propagate the shutdown event to a guest OS without a coordinator; install the APC PowerChute Network Shutdown or a Shutdown WinCC compatible UPS module and confirm the guest receives the AC-loss event by Event Viewer > System > Source UPS entry 1.
• Windows 10/11 IoT in-place upgrade: Cumulative updates have been observed to reset the WinCCInstance service account password, causing the SQL Server to fail to start after the next restart. After any OS update, manually re-enter the WinCC service account password in SQL Server Configuration Manager > SQL Server Services > Properties > Log On.
• Antivirus real-time scan: McAfee, Symantec, and Defender real-time scanning of the .ldf log files can delay SQL checkpoints to the point that Shutdown WinCC's time window is exceeded. Exclude C:\Program Files\Siemens\Automation\ and C:\WinCCProjects\ from real-time scan in a single GPO or local policy.
• Multiple monitor shutdown: If the OS begins the shutdown before the monitors are powered, the visible WinCC error message is lost. Configure the Shutdown WinCC script to write the shutdown reason and timestamp to D:\WinCC_Shutdown.log for post-incident review.
• Project on a network share: WinCC supports opening a project from a UNC path for engineering only, not for Runtime. Runtime on a network share will fail in a controlled way after a power cut because the share may be slow to remount and the SQL Server cannot find the master file in time.

Quick Checklist for an Existing WinCC Station

1. License for Shutdown WinCC is installed and active.
2. UPS battery is less than 3 years old and the autonomy has been measured at full PC load.
3. Shutdown sequence has been tested within the last 90 days.
4. SQL Server maintenance plan is creating .bak files hourly and rolling them offsite.
5. WinCC project is being backed up at least once per shift via the Project Duplicator.
6. Project and SQL data live on a separate volume from the OS and from the paging file.
7. Front-panel power and reset are physically inaccessible to the operator.
8. Windows Fast Startup is disabled; disk write-cache policy is set per UPS autonomy.
9. Antivirus real-time scan excludes the WinCC directories.
10. A cold spare PC or SSD image is stored at the site, current within one quarter.