WinCC Redundant Server User Licensing and Multi-User

Overview

Siemens WinCC supports redundant server pairs that maintain a synchronized runtime database so that a standby partner can take over visualization, archiving, and alarm routing when the primary server fails. A common engineering question when planning such a pair is which licenses the two servers actually require, whether different operators can be logged in on each partner at the same time, and how picture-changeover behavior is affected when the two servers drive a different number of monitors.

This reference consolidates the licensing rules for WinCC V7.x and WinCC RT Professional (TIA Portal) redundant systems, the user-administration behavior on the partner pair, the relationship between the Server, RC (Runtime and Configuration), and RT (Runtime) license classes, and the multi-monitor picture rules that govern a graceful changeover. All behavior described applies to the standard WinCC redundant topology of two servers with one or more WinCC clients attached as observers or as additional operating stations.

Redundant WinCC System Architecture

A WinCC redundant system consists of two functionally identical server stations running the same WinCC project. The two servers are coupled by a dedicated redundancy link (serial, TCP/IP, or both, depending on version) and exchange process values, alarms, and archive data continuously. Each server can be connected to the automation level (SIMATIC S7-1500, S7-1200, S7-300/400, or third-party PLCs via OPC) and to one or more WinCC clients.

According to the official WinCC V8.1 Configuration and Communication manual, the redundant system can be operated either as a single-user redundant project (no clients) or as the server pair of a multi-user project. The distinction is critical for license selection.

License Model: RT, RC, Server, and Redundancy

WinCC distinguishes four license categories that affect redundant deployments. Understanding the boundary between them is required to size a system correctly.

Minimum license set for a redundant WinCC server pair

For a standard two-server redundant pair, Siemens licensing is:

• 2 × WinCC Server license (one per server, when used as the server of a multi-user project)
• 2 × RT license (one per server)
• 1 × Redundancy license (activates the standby behavior on the partner)
• 0 × RC license (RC is only needed if a station must also reconfigure the project in the field)

If the two servers form a redundant single-user project (no WinCC clients, no separate multi-user layer), the Server license is not required and a single RT license per station is sufficient plus the Redundancy license. The Server license is only triggered by the multi-user topology with attached clients.

User Administration on a Redundant Server Pair

The two redundant servers run independent Windows sessions but share a common WinCC project. The WinCC User Administrator is a project-level database, so user accounts, password hashes, and group memberships are mirrored to the partner during redundancy synchronization. This means a user configured on Server 1 is also valid on Server 2 with the same credentials.

Concurrent operator sessions

Different WinCC operators can be logged in on each server at the same time. The redundancy mechanism operates at the process-data and archive layer, not at the operator session layer. There is no cluster-style "active user list" between the partners, so each server authenticates locally and the same user account may be active on both servers simultaneously without a licensing conflict. Session-based authorization (e.g., operator may acknowledge alarms, supervisor may change setpoints) is enforced by the local server evaluating the User Administrator against the active login.

WinCC User Administrator configuration

1. Open the WinCC Explorer on Server 1 and select User Administrator.
2. Create the operator, supervisor, and administrator accounts; assign group memberships and authorization levels (e.g., Authorization 4 = change setpoint, Authorization 10 = acknowledge alarm).
3. Close the project and copy the UserAdmin.mdf database file to the same path on Server 2, or rely on the redundancy project synchronization to replicate it.
4. On Server 2, verify in User Administrator that all groups and authorizations are present and identical.

Picture and Screen Behavior During Changeover

When the two redundant servers drive a different number of monitors — for example, Server 1 is equipped with four screens and Server 2 is equipped with only two screens — picture changeover during a partner failure must be planned explicitly. The WinCC runtime is screen-position aware: each picture opened in the Graphics Runtime is associated with a specific monitor slot (screen 1 through 4 on a four-monitor machine, screen 1 and 2 on a two-monitor machine).

If the standby partner takes over while a picture is open on screen 3 or screen 4, that picture cannot be re-rendered on a station that has no screen 3 or screen 4. The runtime will report the picture as lost, and any process values that were displayed only on those monitors will no longer be visible to the operator until the picture is re-opened on an available screen. Conversely, if the same picture name is open on screen 3 of Server 1 and on screen 3 of Server 2 simultaneously, the changeover logic can release one occurrence but not both without explicit closing.

Field-proven rule

Match the monitor count of the two redundant servers exactly. If a 4-screen station is paired with a 2-screen station, restrict the engineering team to opening pictures only on screens 1 and 2 (the common set), and assign picture-changeover logic in the project to use only those two screen numbers. This is documented behavior, not a license constraint, but it is the most common cause of "picture missing after changeover" field tickets.

Multi-User Project with Attached Clients

When the two redundant servers also serve WinCC clients (a multi-user project), the license model expands:

The TIA Portal V21 multi-user system documentation confirms that in a multi-user WinCC RT Professional topology, the WinCC server hosts the project and the clients connect to it. The redundant configuration is layered on top of this topology: both servers are independently projectable, and clients auto-reconnect to the surviving partner after a changeover.

Configuring Redundancy in WinCC V7.x

1. On Server 1, open the WinCC project and select Redundancy in WinCC Explorer.
2. Enable Redundancy partner and enter the partner computer name and redundancy port (default TCP 8010, plus optional serial COM).
3. On Server 2, mirror the same Redundancy settings, swapping the partner name.
4. Activate the WinCC Runtime on Server 1 first. Verify in the WinCC Redundancy Control diagnostics that the partner status is reported as Standby.
5. Activate the WinCC Runtime on Server 2. Verify that Server 1 reports the partner as Active and that the diagnostic counter Synchronized data records is incrementing.
6. From the WinCC client, connect to the configured preferred server; perform a manual changeover via the Redundancy Control dialog on the active server and confirm the client reconnects to the new active server within the configured timeout (default 25 s for the archive switchover).

Configuring Redundancy in WinCC RT Professional (TIA Portal V21)

1. In TIA Portal, open the HMI device for Server 1 and switch to Runtime settings > Redundancy.
2. Enable the redundancy option, set the partner HMI device, and configure the synchronization interval (default 1000 ms; minimum 250 ms; maximum 60 000 ms).
3. On Server 2, repeat the configuration, pointing back to Server 1.
4. Compile both HMI devices and download the project to each station.
5. Start Runtime on Server 1, then on Server 2. The TIA Portal diagnostic view shows the partner state and last successful synchronization timestamp.

Verification Checklist

After commissioning a redundant WinCC server pair, run the following checks:

• Partner status: Confirm the Redundancy Control diagnostic reports one Active and one Standby partner, and that the Online LED is green on both.
• Archive replication: Open the Tag Logging archive on the standby and confirm that values from the last 60 seconds are present (replication lag tolerance is configurable, default 25 s).
• Alarm replication: Force a high-priority alarm on the active server, force a changeover, and confirm the alarm appears in the Alarm Logging view on the new active server with the original time stamp.
• User session continuity: Verify that the operator logged in on the previous active server is automatically re-authenticated on the new active server using the same Windows credentials, without a manual login prompt.
• Client reconnect: From each WinCC client, force a changeover; the client must disconnect from the old active server and reconnect to the new one within the configured client timeout (default 30 s).
• Picture state: With the picture set restricted to the common screen set (screen 1 and 2 if the partners have mismatched monitor counts), verify that no picture is reported as "Picture not found" after a changeover.
• License audit: In the WinCC License Viewer (Server 1), confirm that the Server, RT, and Redundancy license tags are all green and that no trial license is in use.

Troubleshooting Matrix

Operational Notes

• License the engineering station with RC only if engineering will be performed from that station. Two RC licenses are unnecessary for a pure redundant pair; one RC plus one RT is the most common combination when the engineering team works on the standby between incidents.
• Always match the monitor configuration of the two redundant servers. The cheapest way to avoid picture-changeover tickets is identical hardware.
• Use the same Windows user account name on both servers for the WinCC Runtime service account; this simplifies the redundancy service authentication and prevents the standby from showing "service not authorized" on a partner-down event.
• When sizing the tag count for client licenses, count the configured tags (internal + process), not the runtime-visible tags. WinCC counts every tag defined in Tag Management toward the RT Client power tag limit.
• The Redundancy license is consumed per server that participates in redundancy, not per pair. A 3-server redundant topology (less common, supported in some WinCC variants) consumes 3 Redundancy licenses.

FAQ