WinCC Virtualization - support.industry.siemens.com · Warranty and Liability WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 2 ã S i e m e n s A G 2 0 1 8 A l l r i g h t

WinCC Virtualization

WinCC V7.4 SP1 / WinCC Professional V15

https://support.industry.siemens.com/cs/ww/en/view/49368181

SiemensIndustryOnlineSupport


Warranty and Liability

WinCC VirtualizationEntry ID: 49368181, V2.0, 08/2018 2

ãS

iem

ens

AG

2018

All

right

sre

serv

ed

Warranty and Liability

Note The Application Examples are not binding and do not claim to be complete with regard toconfiguration, equipment or any contingencies. The Application Examples do notrepresent customer-specific solutions. They are only intended to provide support fortypical applications. You are responsible for the correct operation of the describedproducts. This Application Example does not relieve you of the responsibility of safely andprofessionally using, installing, operating and servicing equipment. When using thisApplication Example, you recognize that we cannot be made liable for any damage/claimsbeyond the liability clause described. We reserve the right to make changes to thisApplication Example at any time and without prior notice. If there are any deviationsbetween the recommendations provided in this Application Example and other Siemenspublications – e. g. catalogs – the contents of the other documents shall have priority.

We do not accept any liability for the information contained in this document.Any claims against us – based on whatever legal reason – resulting from the use ofthe examples, information, programs, engineering and performance data etc.,described in this Application Example shall be excluded. Such an exclusion shallnot apply in the case of mandatory liability, e.g. under the German Product LiabilityAct (“Produkthaftungsgesetz”), in case of intent, gross negligence, or injury of life,body or health, guarantee for the quality of a product, fraudulent concealment of adeficiency or breach of fundamental contractual obligations (“wesentlicheVertragspflichten”). The compensation for damages due to a breach of afundamental contractual obligation is, however, limited to the foreseeable damage,typical for the type of contract, except in the event of intent or gross negligence orinjury to life, body or health. The above provisions do not imply a change of theburden of proof to your detriment.Any form of duplication or distribution of these Application Examples or excerptshereof is prohibited without the expressed consent of Siemens AG.

Securityinforma-

tion

Siemens provides products and solutions with Industrial Security functions that supportthe secure operation of plants, systems, machines and networks.To protect plants, systems, machines and networks against cyber threats, it is necessaryto implement (and continuously maintain) a holistic, state-of-the-art Industrial Securityconcept. Products and solutions from Siemens are only one part of such a concept.It is the customer’s responsibility to prevent unauthorized access to the customer’s plants,systems, machines and networks. Systems, machines and components should only beconnected with the company’s network or the Internet, when and insofar as this isrequired and the appropriate protective measures (for example, use of firewalls andnetwork segmentation) have been taken.In addition, Siemens’ recommendations regarding appropriate protective action should befollowed. For more information on Industrial Security, visithttp://www.siemens.com/industrialsecurity.Siemens’ products and solutions undergo continuous development to make them evenmore secure. Siemens strongly recommends to carry out updates as soon as therespective updates are available and always only to use the current product versions. Useof product versions that are no longer supported, and failure to apply latest updates mayincrease customer’s exposure to cyber threats.In order to always be informed about product updates, subscribe to the Siemens IndustrialSecurity RSS Feed at http://www.siemens.com/industrialsecurity.

http://www.siemens.com/industrialsecurity

http://www.siemens.com/industrialsecurity

Table of Contents


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

Table of ContentsWarranty and Liability .............................................................................................. 21 Preface ............................................................................................................ 5

1.1 Purpose of the document ................................................................... 51.2 Validity .............................................................................................. 5

2 Automation Task ............................................................................................ 6

2.1 Introduction ....................................................................................... 62.2 Virtualization requirements................................................................. 62.3 Fields of application for virtualization .................................................. 6

3 Automation Solution ...................................................................................... 7

3.1 WinCC system architecture in virtual environment .............................. 73.2 What is virtualization? ........................................................................ 83.2.1 Definition ........................................................................................... 83.2.2 Server-based virtualization (type 1: native) ....................................... 103.2.3 Client-based virtualization (type 2: hosted) ....................................... 103.2.4 Summary of server-based and client-based virtualization ................. 113.2.5 Advantages and disadvantages of the virtualization ......................... 123.3 SIMATIC Virtualization as a Service ................................................. 14

4 Configuration ................................................................................................ 15

4.1 General hardware compatibility ........................................................ 154.1 Configuration of the host systems .................................................... 154.2 Configuration of guest systems ........................................................ 174.2.1 General information ......................................................................... 174.2.2 Configuration of network cards......................................................... 184.3 Remote access ................................................................................ 194.4 Communication................................................................................ 214.4.1 Name resolution .............................................................................. 214.4.2 VLANs ............................................................................................. 214.4.3 Redundancy connection between servers ........................................ 214.5 SIMATIC software redundancy ........................................................ 22

5 Licensing of SIMATIC Products ................................................................... 23

5.1 Licensing with a single license ......................................................... 235.2 Licensing with floating licenses ........................................................ 23

6 Diagnostic capabilities ................................................................................. 24

6.1 Diagnostics using VMware vSphere client ........................................ 246.2 Diagnostics in the virtual system ...................................................... 256.3 Performance problems..................................................................... 27

7 Further Notes, Tips and Tricks .................................................................... 28

7.1 Pass-through (VMDirectPath IO) ...................................................... 287.2 Managed USB HUB ......................................................................... 297.3 General recommendations ............................................................... 307.3.1 Snapshots ....................................................................................... 307.3.2 vMotion or vMotion Storage ............................................................. 307.3.3 SDRS (Storage DRS) ...................................................................... 317.3.4 Fault Tolerance................................................................................ 317.3.5 Cloning virtual machines (VM) ......................................................... 317.3.6 VMware Tools ................................................................................. 317.3.7 Increasing performance of vnetflt.sys driver ..................................... 327.3.8 Hard drives ...................................................................................... 337.3.9 Unnecessary hardware in virtual machines ...................................... 33

Table of Contents


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

7.3.10 Synchronizing the virtual machines .................................................. 337.4 Security settings .............................................................................. 347.4.1 Disabling automatic update of VMware Tools ................................... 347.4.2 Time synchronization through NTP .................................................. 357.4.3 Applying patches for ESXi ............................................................... 357.4.4 Security in general ........................................................................... 35

8 Glossary ........................................................................................................ 369 Appendix ....................................................................................................... 39

9.1 Service and Support ........................................................................ 399.2 Links and literature .......................................................................... 409.3 Change documentation .................................................................... 41

1 Preface


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

1 Preface1.1 Purpose of the document

This document describes the virtualization of WinCC V7 and WinCC Professionalin connection with an ESXi server. In this document you will find· Information on the infrastructure for the use of WinCC· Demonstration of special features· Diagnostic capabilities

1.2 Validity

This document is based on the following versions· WinCC V7.4 SP1· WinCC Professional V15· VMware ESXi V6.0· VMware vSphere V6.0

General statements are also valid for other WinCC V7 and WinCC Professionalversions.Software-dependent releases can be found in the Compatibility tool \3\

https://support.industry.siemens.com/kompatool/pages/main/index.jsf?

2 Automation Task


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

2 Automation Task2.1 Introduction

Virtualization of servers is already of high importance in information technology. Inautomation technology the advantages of virtualization shall also be achieved.

2.2 Virtualization requirements

The availability of the plant and the automation technology has the highest priority.The same applies for plants with real computers and for plants that are operated ina virtual environment.For plant operation in a virtual environment, there should be no visible difference toreal computers.

2.3 Fields of application for virtualization

Depending on the area of application, different hardware and software are used forthe virtualization solutions.

Application Virtualization solution

Engineering, training and short tests VMware Player, VMware Workstation, WindowsVirtual PC…VMware vSphere, HyperV

Production plants VMware vSphere, HyperV

Topics not covered by this applicationThis document describes the use and the approach using VMware ESXi andVMware vSphere.The VMware Workstation or VMware Player is not considered. These products arenot released for productive operation.

3 Automation Solution


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

3 Automation Solution3.1 WinCC system architecture in virtual environment

Figure 3-1



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

3.2 What is virtualization?

3.2.1 Definition

Virtualization is the abstraction of physical hardware from theoperating system. For this purpose, a special virtualization layer, the so-calledhypervisor, is located on a real computer.This makes it possible to implement several virtual machines (VM) that are isolatedfrom each other, with their own virtual hardware components and their proprietaryoperating systems on a real, physical computer (host system).

They act like real computers and can execute applications themselves.

Layout for virtualizationFigure 3-2

Tasks of the hypervisorAmong other things, the hypervisor has the following tasks:· The hypervisor is the virtualization layer in which the VMs run.· The hypervisor manages the resource allocation of the real hardware to the

VMs and the execution of the VMs.· The hypervisor is also called VMM (Virtual Machine Manager or Monitor).



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

Physical and virtual setup

Figure 3-3

VariantsBasically, there are two types of virtualization, which differ in terms of configurationand structure.· Server-based virtualization (type 1: native)· Client-based virtualization (type 2: hosted)



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

3.2.2 Server-based virtualization (type 1: native)

The virtualization variant is characterized by the following characteristics:· The hypervisor runs directly on the hardware of the host and is more efficient.

It requires fewer resources, but has to provide all drivers.

· No direct operation: The VMs are operated via remote clients.

· Fields of application are data centers and production plants.

· Examples for type 1 are "VMware ESX/ESXi" and "Hyper-V".

Figure 3-4

3.2.3 Client-based virtualization (type 2: hosted)

This virtualization variant is characterized by the following characteristics:· The hypervisor is based on a fully-fledged operating system, e.g. Windows,

and uses the device drivers of the operating system.· Direct operation: The VMs are operated directly on the computer via graphics

card and monitor.· Areas of application are mainly engineering and short tests.· Examples for type 2 are "VMware Workstation and VMware Player",

"VirtualBox" or "Windwos Virtual PC".



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

Figure 3-5

Note This document describes only type 1 with VMware ESX/ESXi.

3.2.4 Summary of server-based and client-based virtualization

Server-based virtualizationType 1 native (ESXi server)

Client-based virtualizationType 2 hosted (VMware Workstation)

· The hypervisor runs directly on thehardware of the host and is moreefficient. It requires fewer resources,but has to provide all drivers.

· The hypervisor is based on a fully-fledged operating system (e.g.Windows) and uses the device driversof the operating system.

· No direct operation:The VMs are operated via remoteclients.

· Direct operation:The VMs are operated directly on thecomputer via graphics card andmonitor

· Areas of application:Data centers and production plants

· Areas of application:Engineering and short tests



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

3.2.5 Advantages and disadvantages of the virtualization

Table 3-1

Advantages Disadvantages

Costs Reduction of costs· Consolidation of physical

computers, cables, switches,etc.

· Reduction of energyconsumption

· Reduction of spacerequirements less expensivehardware can be used forclients (so-called thin clientsolutions)

Software costs for the operatingsystem remain.

Additional license costs forvirtualization depending onthe range of functions

Security Increased security· Increased security due to

remote access and centralizedrights management

· Reduced attack possibilitieswith thin clients; centralprotection on the ESXi serverfor the virtual machines

Possibly increased securityexpenses (additional layer,data security)

Availability Increased availability· Easy exchange of virtual

machines on ESXi serverpossible

· Danger of a "SinglePoint of Failure"

· Support may not comefrom a single source

Flexibility Increased flexibility· Hardware independence of the

virtual machines· Virtual machines with different

operating systems on one ESXiserver

· Additional virtual machines canbe added by starting anotherVMware session

· Hardware RAID can beconfigured as software RAID(ESXi Server)

· Securing commissioning· Simple recording in the event of

system failuresSystem complexity · Significantly increasing

system complexity· Higher administration

effort



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

SupportIf a problem occurs while operating a virtual machine, the support required for thismay become time-consuming. In this case, the responsibility must first be clarified,as can be seen in the following diagram.Figure 3-6

Note When using SIMATIC Virtualization as a Service (see chap. 3.3) you not onlyreceive pre-installed and pre-configured ESXi servers including WinCCinstallations in the form of VMs, but also the service for these complete systemsfrom a single source.

You can use a support request to determine the power requirements of avirtualized SIMATIC WinCC system. Further information is available in the followingFAQ: "Where do you obtain technical support for the configuration of a virtualSIMATIC PCS 7 / WinCC System?". \4\

https://support.industry.siemens.com/cs/document/109749129/wo-erhalten-sie-technische-unterst%C3%BCtzung-bei-der-auslegung-eines-virtuellen-simatic-pcs-7-wincc-systems-?dti=0&lc=en-DE

https://support.industry.siemens.com/cs/document/109749129/wo-erhalten-sie-technische-unterst%C3%BCtzung-bei-der-auslegung-eines-virtuellen-simatic-pcs-7-wincc-systems-?dti=0&lc=en-DE



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

3.3 SIMATIC Virtualization as a Service

SIMATIC Virtualization as a Service is a pre-configured, ready-to-use virtualizationsystem for implementing efficient automation solutions for SIMATIC systems.

Figure 3-7

A hypervisor is installed on a powerful server that manages the hardwareresources and dynamically distributes them to the virtual machines. Centralmanagement, configuration and maintenance of the virtual machines and thevirtualization server are carried out via a management console.The virtual machines are equipped with SIMATIC PCS 7 or SIMATIC WinCCinstallations and are preconfigured depending on the automation task (e.g. PCS 7ES/Client, WinCC Server).The virtualization system can be easily and efficiently extended by preconfiguredvirtual machines and is therefore scalable to different plant sizes. A highly availablesystem can be realized by using additional virtualization servers.Further information on SIMATIC Virtualization as a Service is available at thefollowing link:· SIMATIC Virtualization as a Service \5\

https://support.industry.siemens.com/cs/ww/en/sc/3095

4 Configuration


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

4 Configuration4.1 General hardware compatibility

Each ESXi host and its components must be listed in the VMware's HCL(Hardware Compatibility List) for each ESXi version and license.For more information, please use the following link:https://www.vmware.com/resources/compatibility/search.php \6\

4.1 Configuration of the host systems

NOTICE The user/administrator is obliged to provide and secure sufficient systemresources on the virtualization server and the virtual systems.

Minimum system requirements for installing ESXi/ESX (1003661)http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1003661 \7\

Best practices to install or upgrade to ESXi 6.0 (2109712)https://kb.vmware.com/s/article/2109712 \8\

Hardware exampleHere is an example from practical experience.

· The configured main memory (RAM) of all VMs running simultaneouslymust not exceed 90% of the physically available RAM.

· The ratio 2:1 of the virtually configured CPU cores of all simultaneouslyrunning VMs to the physically available CPU cores should not beexceeded.

The following table shows an example of a possible assignment:

Hardware Number Usage

Intel® Xeon® ProcessorE5-2640V4

(25MB Cache, 2.40 GHz,8.00 GT/s QPI)

10 Cores 1 core for host1x ES 4 vCores1x OS Server: 2 vCores5x OS Client: 10 vCores

· For performance reasons, the size of the data stores on the individualRAID systems should not exceed 2TB.

· Using a RAID 10 system for the data stores offers the best read/writeperformance.

· A better performance of WinCC can be achieved if a CPU with fewer coresand higher clock frequency is preferred to a CPU with more cores andlower clock frequency.

https://www.vmware.com/resources/compatibility/search.php

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1003661


https://kb.vmware.com/s/article/2109712

4 Configuration


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

NetworkThe following figure shows an example of the communication principle of avirtualization system:

· The internal communication between ES, WinCC server and WinCC client.· The communication of ES, WinCC server and WinCC client to the outside,

e.g. to the AS via the physical network cards of the ESXi server.

Figure 4-1

4 Configuration


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

4.2 Configuration of guest systems

4.2.1 General information

Features Requirements

VM Version 8,9,10 or 111)

Hard drive storagemanagement

Use type: "Thick Provision Eager Zeroed"

Virtual network modules There are as many network cards to configure as would bethe case with real WinCC stations. A redundant OS serverwould therefore have 3 virtual network cards.

Separation of networks It is recommended to physically/virtually separate terminal,system and redundancy bus and not to use VLANs.The IP addresses of terminal, system and redundancybuses have to be located in different subnets.

Network cards All network cards are assigned to the "Private" networkprofile within Windows via group policy.

CPU load The CPU continuous load of the assigned logical CPUcores must not exceed 70% - 80%.Note:When archiving large data volumes a respective reserve isrequired (high I/O load).This load is given at a capacity of 70% - 80%.

VMware Tools "VMware Tools" must be installed inside the virtualmachines. This results in better performance andmaintainability of the VMs.

Operating states Suspend/Resume of the VMs, as well as VMware options,(e.g. vMotion) are not supported. The VMs must be treatedlike real WinCC stations.

1) A downgrade of the VM version is not possible.

Note Card type of virtual network cards

The card type of the virtual network cards has to be "E1000" or "vmxnet3"(recommended).

The card type "vmxnet3" cannot be used until VMware Tools is installed in theVM.

4 Configuration


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

4.2.2 Configuration of network cards

NOTICE Faulty process communication

· No unused network cards may exist in the Windows "Network and SharingCenter". Unused cards must be disabled or removed from the virtualmachine configuration.

· No network card should be assigned to the public network profile.· When adding/removing network cards, their order changes in Windows. After

making changes to the network configuration, check the order of the networkcards according to the WinCC documentation.

Note The following group policy can be used to ensure that no network card isassigned to the "Public network" network category:

Local Computer Policy > Computer Configuration > Windows Settings > SecuritySettings > Network Manager Policies > Non-identified Networks: Set the locationtype from "Not configured" to "Private".

Note First uninstall unused network cards in the Windows device manager. If you donot do this, "remaining files" will be left in the properties of the VM in Windowsafter you delete network cards. These "remaining files" must first be made visiblein the device manager before they can be uninstalled. If these "remaining files"are not removed, the name of the deleted network card cannot be used again.

Tip: If BGInfo (not included in Windows) is used, the desktop can show whether"remaining files" are available.

4 Configuration


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

4.3 Remote access

The VMs can be accessed with a thin client or a remote system via RDP,RealVNC, vSphere Client or vSphere Web Client.

General informationThe following points apply to all remote connections:· All operator stations can be operated via exactly one open remote connection.· For a remote connection, the existing session must be taken over. This means

that a user must be logged in at the operating station.· Remote Desktop may only be used via "mstsc/console" or "mstsc/admin".· An RDP connection may only be used for access to clients without additional

functions (web functions).· With WinCC servers or the single-user system, RPP is only permitted if WinCC

is running in service mode.· When using an RDP connection to a VM, the automatic logon to Windows has

to be configured in this VM, e.g. using "control userpasswords2" or "Autologonfor Windows" (Windows Sysinternals).

· In order to access a VM with automatic logon via RDP, the following registryentry may not be present as of Windows Server 2012 R2 and Windows 10(default setting): "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\ForceAutoLogon"

· Disabling the TCP auto tuning level: The TCP auto tuning settings can bedisabled using the following command:

netsh interface tcp set global autotuninglevel=disabled

You can find information on this in the FAQ entry: "Which settings should youmake when an OVF export fails using the "VMware vSphere Client"application?" \9\

RealVNCAudio signals cannot be transmitted via a RealVNC connection.The released version of RealVNC for WinCC is included in the compatibility tool:http://www.siemens.de/kompatool \3\




http://www.siemens.de/kompatool%20/3/

4 Configuration


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

vSphere ClientOpening the console ("Open Console") of a VM in the vSphere client can takerelatively long (35 sec). One possible reason for this is that certificates cannot beverified if there is no internet connection. This can be prevented by configuring thefollowing group policy:Set "Computer Configuration\Administrative Templates\System\InternetCommunication Management\Internet Communication settings\Turn off AutomaticRoot Certificates Update" to "enabled".

4 Configuration


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

4.4 Communication

4.4.1 Name resolution

In a virtual environment, a management network is usually also used to managethe virtual infrastructure. In this management network it is recommended to use aDNS server for the name resolution of ESXi servers.

Note The name resolution of the VMs necessary for the operation of WinCC must takeplace when using a DNS/WINS server via the terminal bus or by using the locallyconfigured hosts and lmhosts files.

The name resolution has to be done via the IPv4 protocol.

4.4.2 VLANs

VLANs can be used in WinCC. You can find information on this in the FAQ entry"How do you configure a Virtual Local Area Network (VLAN) in PCS 7?“.\10\

VLANs must not be used on the dedicated network card of the ES to the fieldbus(PROFINET).

4.4.3 Redundancy connection between servers

The connection between redundant WinCC servers for redundancy adjustmentmust be made via Ethernet.The following figure shows settings within the configuration of SIMATIC Shell:· Selection of the virtual network card for the redundancy bus in the redundancy

settings· Disabling the serial port

Figure 4-2


4 Configuration


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

4.5 SIMATIC software redundancy

With a redundant WinCC system, the runtime is active on both servers (master andstandby). This has the following characteristics:· The clients are distributed between both servers (load balancing).· After a failure, the data status is synchronized on both servers by archive

adjustment

The fault tolerance provided by vmWare is not a replacement for the SIMATICredundancy and therefore cannot be used.(see chapter 7.3.4 Fault Tolerance).

5 Licensing of SIMATIC Products


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

5 Licensing of SIMATIC ProductsGeneral information

As a general rule, you have to license all products/software according to therespective manufacturer's license terms and conditions.In terms of licensing, a SIMATIC software installation on a virtual machine does notdiffer from the installation on a real machine. Therefore, each SIMATIC softwareinstallation on a virtual machine,e.g. SIMATIC WinCC and other SIMATIC applications, has to be licensedaccordingly.Likewise, each SIMATIC WinCC Client installation on a virtual machine has to belicensed accordingly.

5.1 Licensing with a single license

Unlimited duration standard license that can be transferred to any computer andused on this computer. The Certificate of License (CoL) defines the type of use.Licenses of the single license type can only be used locally.

5.2 Licensing with floating licenses

Unlimited license duration that can be transferred to any computer and used on thiscomputer. The license can also be obtained from a license server over the network.

Note The freedoms gained in handling virtualization entail the risk of easily damagingor destroying virtual machines. When things get serious, a virtual machine will beirretrievably lost, including all installations and licenses.

To minimize the risk of losing licenses, use a license server with SIMATICfloating licenses. This additionally facilitates handling licenses.

6 Diagnostic capabilities


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

6 Diagnostic capabilitiesTroubleshooting and performance (Chap 4.4 109486064)

VMware provides various means to diagnose performance bottlenecks. Below, wewill briefly describe use of the vSphere Client and of the "esxtop" tool.For more information, see the manual "vSphere Monitoring and Performance".https://www.vmware.com/support/pubs/ \11\

6.1 Diagnostics using VMware vSphere client

General informationYou can use the vSphere Client not only to configure the virtual machines (guestsystems), but also to monitor the ESXi server and the individual virtual systems.

Monitoring optionsYou can display these points as curves with the vSphere client:· Main memory usage· Operating state· CPU load· Hard drive· Network utilization

The procedure in detailTable 6-1

No. Step/action

1. Log on to the ESX(i) server· Start your VMware VSphere client.

The Logon dialog appears:· Enter the IP address of your virtualization server and your user data.

The vSphere Client starts.2. Navigate to ESX(i) server diagnostics

· In the navigation tree, select the top item. (The virtualization server.)· Then select the “Performance” tab.

A diagram appears that shows the performance data graph.3. Customizing the ESX(i) server diagnostics

To monitor the values used for these measurements, proceed as follows:· In the top area of the tab, click “Trend settings…”.

The “Adjust performance trend” dialog appears.· Monitoring the RAM

– In the “Trend settings” tree, expand the “RAM” item.– In “RAM”, click “Realtime”.– In the “Performance logs” fields, deselect everything and select only

“active”.– Confirm with OK.

In the diagram, you can now monitor the active RAM.· Monitoring the CPU load

– In the “Trend settings” tree, expand the “CPU” item.– In “CPU”, click “Realtime”.– In the “Performance logs” field, deselect everything and select only

https://www.vmware.com/support/pubs/



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

No. Step/action“usage”.

– Confirm with OK.In the diagram, you can now monitor the CPU load.

4. Navigate to diagnostics of the virtual system· In the navigation tree, select the item of the virtual system to be monitored.· Then select the “Performance” tab.

A diagram appears that shows the performance data graph.5. Customizing diagnostics of the virtual system

To do this, proceed as described in step 3.

6.2 Diagnostics in the virtual system

For diagnostics in the virtual system, use the Windows toolWindows Performance Monitor.

The procedure in detailTable 6-2

No. Step/action

1. Starting the toolClick “Start > Performing".The “Run...” dialog appears.· Enter “Perfmon” and click OK.

The monitoring tool starts.2. Customizing the performance indicators

Remove all performance logs from the lower right area.· In this area, right-click. In the menu, select “Add performance logs...”.



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

No. Step/action

· The “Add performance logs” dialog appears.· To display the CPU load as a percentage, select the “Processor” data object

and select the “% Processor Time” performance log. Select “_Total” as theinstance.

· Click on "Add…".· To display the main memory allocation, select the “Memory” data object and

select the “Committed Bytes” data object.· Click “Add” and select “Close” to close the dialog.

NoteIt is a problem to display both values simultaneously in one diagram. The axisscaling differs.For optimum display, adjust the scaling using the “Properties” button and the“Graphics” tab.

For more information, follow this link:"What diagnostics options are available for WinCC and PCS 7 OS?" \12\




ãS

iem

ens

AG

2018

All

right

sre

serv

ed

6.3 Performance problems

To prevent your VM from running with poor performance, define the hardwareconfiguration of the VM before installing the operating system. This mainly appliesto:· Number of virtual sockets· Number of virtual cores per socketIf you make changes to the hardware configuration, you must adjust the HCL of theVM again.Further information is available at:· Modifying the Hardware Abstraction Layer (HAL) for a Windows virtual

machine (1003978)https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1003978 \13\

· Troubleshooting a converted virtual machine that experiences poorperformance (1013857)https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1013857 \14\

· Troubleshooting ESX/ESXi virtual machine performance issues (2001003)https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2001003 \15\

https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1003978






7 Further Notes, Tips and Tricks


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

7 Further Notes, Tips and Tricks7.1 Pass-through (VMDirectPath IO)

General informationPass-through support in VMware vSphere Server (ESXi) allows you to pass certainphysical components of the server directly to the virtual machines.The virtual machine detects the new hardware automatically, if necessaryappropriate drivers are installed later.As long as you use pass-through function:· the hardware is a part of the virtual machine· the HyperVisor no longer has accessVarious SIMATIC NET CPs have been tested for the pass-through function andcan be used.

Note This is where you can find information about pass-through configurations

http://kb.vmware.com/kb/1010789 \16\

Note When using SIMATIC NET CPs in a virtual environment, observe therequirements and dependencies of SIMATIC NET.

"SIMATIC NET PC-Software SIMATIC NET PC Software V14 SP1 installationmanual – chapter 3 and 4"Installation, configuration of SIMATIC NET CPs in a VMware vSphere server(ESXi)

https://support.industry.siemens.com/cs/ww/en/view/77377602 \17\

Other compatibilities can be found herehttps://support.industry.siemens.com/kompatool/pages/main/index.jsf \3\

You can use WinCC ASIA dongle via pass-through. The number of ASIA donglesdepends on the international USB hubs and not on the number of USB ports. Onlyone USB HUB is forwarded at a time.

http://kb.vmware.com/kb/1010789


https://support.industry.siemens.com/kompatool/pages/main/index.jsf



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

7.2 Managed USB HUB

General informationThe following diagram shows you how a USB HUB is connected to a virtualinfrastructure via the Ethernet LAN.You configure the assignment of the USB ports to the virtual machine via the hub'sWeb interface.Furthermore, every virtual machine that you connect to the USB HUB needs acorresponding software. Using this software, the virtual machine accesses therespective USB port (port groups). The USB devices connected to these ports arepassed on to the respective virtual machine via the Ethernet LAN.

Note A guide showing the detailed configuration of the USB HUB is available on themanufacturer’s website:http://www.digi.com/products/usb/anywhereusb \18\

Figure 7-1

VM

VM VM VM VM

VM VM VM VM

Ethernet LAN

AnywhereUSB

Remote ClientSmartCard

USB Device

RealPort USBsoftware drivers

The following USB HUBs were compatibility-tested:

http://www.digi.com/products/usb/anywhereusb#docs



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

http://www.digi.com/products/usb/anywhereusb \18\You can use WinCC ASIA dongle via USB HUB.

7.3 General recommendations

7.3.1 Snapshots

Do not use snapshots during productive operation. This can negatively affect thevirtual machine's general performance capability.For more information, follow this link:https://www.vmware.com/pdf/vcops-vapp-585-deploy-guide.pdf (p. 15) \19\Search KB entry 2000986 "Snapshots are not backups" for "Best practices forvirtual machine snapshots in the VMware environment".https://kb.vmware.com/selfservice/microsites/microsite.do \20\

7.3.2 vMotion or vMotion Storage

Do not use vMotion or vMotion Storage for virtual machines in which SIMATICsoftware is active.

http://www.digi.com/products/usb/anywhereusb

https://www.vmware.com/pdf/vcops-vapp-585-deploy-guide.pdf

https://kb.vmware.com/selfservice/microsites/microsite.do



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

7.3.3 SDRS (Storage DRS)

Storage DRS enables moving virtual machines automatically within a data storecluster. A data storage cluster consists of individual data stores.Do not move virtual machines with active SIMATIC software.

7.3.4 Fault Tolerance

Fault Tolerance (FT) provides uninterrupted availability by assuring that the statesof the primary and secondary virtual machine are identical for the entire time theinstruction is being executed.FT is not supported in conjunction with SIMATIC software and is not considered inthis application example.

7.3.5 Cloning virtual machines (VM)

Cloning a virtual machine is not compatibility-tested and not released.

7.3.6 VMware Tools

Install the latest version of the VMware Tools.



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

7.3.7 Increasing performance of vnetflt.sys driver

You can increase the performance of WinCC within the VM by uninstalling the"vnetflt.sys" driver.

Table 7-1

1. Start the VMware converter.2. Select "Change" and click on the “Next" button3. Uninstall the "NSX Network Introspection Driver" in "VMCI Driver > NSX File

Introspection Driver"

4. Restart the computer.



ãS

iem

ens

AG

2018

All

right

sre

serv

ed

7.3.8 Hard drives

Thick provisioned eager zeroed FormatCreate the hard drives in the format "Thick Provision Eager Zeroed". It will providethe best performance properties.For more information, follow this link:https://www.vmware.com/pdf/vcops-vapp-585-deploy-guide.pdf (p. 15) \19\

Distributing multiple hard drives of a virtual machineDistribute the hard drives evenly across the virtual SCSI adapters.For more information, see the book "Virtualizing Microsoft Business CriticalApplications on VMware vSphere" (p. 90).

I/O-intensive applicationsUse the paravirtual storage adapter (PVSCSI) for I/O intensive applications. Itreduces the CPU load and is capable of improving especially the system's overallperformance. Also observe the information provided by the following links. Formore information, follow this link:https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/vmware-perfbest-practices-vsphere6-0-white-paper.pdf \21\

Or in KB article 1010398. Search for "Configuring disks to use VMware ParavirtualSCSI adapters".https://kb.vmware.com/selfservice/microsites/microsite.do \20\

Note The use of SSD brings a considerable improvement in performance.

7.3.9 Unnecessary hardware in virtual machines

Remove all unnecessary hardware from the configuration. Each unnecessaryelement can negatively affect the performance capability of your virtual machine.For more information, follow this link:https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/vmware-perfbest-practices-vsphere6-0-white-paper.pdf \21\

This includes:· Floppy disk· CD ROM· HD audio

7.3.10 Synchronizing the virtual machines

The host (ESXi) must use the same time source as the operating systems withinthe virtual machines. Before time synchronization mechanisms take effect in thevirtual machine, the host's time is used when starting the virtual machine. If the twotimes differ, undesired behavior can occur as a result.In the virtual machine, use one of the following time synchronization methods:


https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/vmware-perfbest-practices-vsphere6-0-white-paper.pdf







ãS

iem

ens

AG

2018

All

right

sre

serv

ed

· VMware Tools or

· Time synchronization - Time synchronization in the automation environmentIn this entry you will find the most important entries on the 'Time Synchronization' topicin Industry Online Support.https://support.industry.siemens.com/cs/ww/en/view/86535497.\22\

Synchronization of the hostsThe ESXi hosts need a time source. Set this source accordingly using the vSphereClient.Figure 7-2

Figure 7-3

7.4 Security settings

7.4.1 Disabling automatic update of VMware Tools

An automatic upgrade of the VMware Tools may cause the host operating systemto be restarted automatically.

Note During the restart, e.g. a WinCC server is not available or WinCC clients cannotbe operated.

Disable the automatic installation of VMware Tools:




ãS

iem

ens

AG

2018

All

right

sre

serv

ed

7.4.2 Time synchronization through NTP

Synchronize your ESXi host with a time source. Use the same time source as fortime synchronization of your operating systems within the VMs.

7.4.3 Applying patches for ESXi

Always keep the patches of your ESXi hosts up to date. You can do so using theUpdate Manager for example.

NOTICE Restart of the host and thus also the virtualized machines necessary

You may need to restart the host to successfully install patches. Note that thevirtual machines running on the server also have to be restarted.

WinCC servers of this host are not available for this period and WinCC clients ofthis host cannot be operated. WinCC servers or WinCC clients of other hosts arenot affected.

For more information, follow this link:https://www.vmware.com/support/policies/security_response \24\

7.4.4 Security in general

Siemens provides products and solutions with Industrial Security functions thatsupport the secure operation of plants, systems, machines and networks.Further information can be found at the following links.

· Which security precautions help against unauthorized access in theSIMATIC PCS 7 / WinCC environment?https://support.industry.siemens.com/cs/ww/en/view/44443744 \23\

· SIMATIC process control system PCS 7 safety concept PCS 7 & WinCC(basic)https://support.industry.siemens.com/cs/ww/en/view/60119725

https://www.vmware.com/support/policies/security_response

https://support.industry.siemens.com/cs/ww/en/view/44443744%20/23/


8 Glossary


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

8 GlossaryESX(i)

Product from VMware. The software has/is its own operating system and providesvirtual systems with workspace.

The software is used for virtualization on the server side.

Core installationOperating system installation without a graphical user interface; replaced by asimplified platform such as a CMD command prompt or PowerShell.

GuestA guest is a virtualized computer running within a host (equivalent to VM).

HostThe “host” for virtual machines, regardless of whether this refers to the “host” fordesktop or server virtualization.

In this document, “host” is equivalent to virtualization server.

HyperVThis software environment is provided by Microsoft through different paths andallows the user to provide, manage and run virtual machines on a Windows serveror core server.

HyperVisorSoftware for virtualization (of a virtualization server).

Hyper-threadingTechnology for better processing of commands for the processor. Here,with hyper-threading, one processor core appears as 2 process cores to theoperating system.

IOPSInput/Output Operations per Second.

Management StationA PC that performs the configuration, maintenance and monitoring of one or morevirtualization servers.The VMware Converter or vSphere Client applications can be used in this context.

RDPRemote Desktop Protocol is a Microsoft solution for operator control andmonitoring of remote computers.

8 Glossary


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

SCADASCADA stands for “Supervisory Control and Data Acquisition”.

SSDSD stands for "solid-state drive" and is a data memory.

VDSVirtual Distributed Switch

Virtualization server (and virtual system)The real PC on which the VMware ESX(i) software runs that provides its resourcesto virtual systems.Computers that run within the VMware ESXi software are virtualized systems.

Virtual hardwareReal resources are not directly provided to the virtualized systems to allow shareduse. Such shared hardware can be network cards, processor cores or hard drives. This hardware can be used partially and jointly by all virtualized systems.

Virtual processor coreA processor core provided to the virtual machine.A vCPU is not equivalent to a pCPU or pCore. A vCPU also includes the “doublecores” due to HT. In addition, VMware does not distinguish between the core and the CPU; this isonly relevant to the guest system.

Virtual networkA network which only exists within a virtualization server and allows communicationbetween multiple virtual systems (within one virtualization server).

VNCVirtual Network Control is an option for operator control and monitoring of remotecomputers.

VMwareCompany and vendor of virtualization software.

VMware vCenter ConverterA VMware product for converting, transferring and creating virtual systems.

VMware WorkstationA VMware product for creating and using virtual systems on existing operatingsystems.

vSphere ClientA VMware product for configuring, monitoring and running a VMware ESXi Server.

vSphere ServerA VMware product that is installed on the server hardware.

8 Glossary


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

Also known as a HyperVisor, VMware ESX(i) Server or ESX(i) host.

vSphere vCenter ServerA VMware product that is used in order to manage multiple ESX(i) HyperVisorsusing a vSphere Client. The vSphere VCenter Server is used to combine multiple ESX(i) hosts into acluster, which increases effectiveness based on the available functionality.

VSSVirtual Standard Switches

9 Appendix


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

9 Appendix9.1 Service and Support

Industry Online SupportDo you have any questions or need support?Siemens Industry Online Support offers access to our entire service and supportknow-how as well as to our services.Siemens Industry Online Support is the central address for information on ourproducts, solutions and services.Product information, manuals, downloads, FAQs and application examples – allinformation is accessible with just a few mouse clicks athttps://support.industry.siemens.com

Technical SupportSiemens Industry's Technical Support offers quick and competent supportregarding all technical queries with numerous tailor-made offers– from basic support right up to individual support contracts.Please address your requests to the Technical Support via the web form:www.siemens.en/industry/supportrequest

SITRAIN – Training for IndustryWith our globally available training courses for our products and solutions andusing innovative teaching methods, we help you achieve your goals.More information on the training courses offered as well as on locations and datesis available at:www.siemens.en/sitrain

Service offerOur service offer comprises, among other things, the following services:· Product Training· Plant Data Services· Spare Parts Services· Repair Services· On Site and Maintenance Services· Retrofit and Modernization Services· Service Programs and AgreementsDetailed information on our service offer is available in the Service Catalog:https://support.industry.siemens.com/cs/sc

Industry Online Support appThanks to the "Siemens Industry Online Support" app, you will get optimumsupport even when you are on the move. The app is available for Apple iOS,Android and Windows Phone:https://support.industry.siemens.com/cs/ww/en/sc/2067

https://support.industry.siemens.com/cs/start?lc=en-DE

https://support.industry.siemens.com/My/ww/en/requests

https://www.sitrain-learning.siemens.com/DE/en/index.do

https://support.industry.siemens.com/cs/sc?lc=en-DE


9 Appendix


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

9.2 Links and literatureTable 9-1

No. Topic

\1\ Siemens Industry Online Supporthttps://support.industry.siemens.com

\2\ Link to the entry page of the application examplehttps://support.industry.siemens.com/cs/ww/en/view/49368181

\3\ Compatibility toolhttps://siemens.com/kompatool

\4\ Where do you obtain technical support for the configuration of a virtual SIMATICPCS 7 / WinCC System?https://support.industry.siemens.com/cs/en/en/view/109749129

\5\ SIMATIC Virtualization as a Servicehttps://support.industry.siemens.com/cs/ww/en/sc/3095

\6\ VMware Compatibility Guidehttps://www.vmware.com/resources/compatibility/search.php

\7\ Minimum system requirements for installing ESXi/ESX (1003661)http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1003661

\8\ Best practices to install or upgrade to ESXi 6.0 (2109712)https://kb.vmware.com/s/article/2109712

\9\ Which settings should you make when an OVF export fails using the "VMwarevSphere Client" application?https://support.industry.siemens.com/cs/ww/en/view/98158088"

\10\ How do you configure a Virtual Local Area Network (VLAN) in PCS 7?https://support.industry.siemens.com/cs/ww/en/view/66807297"

\11\ Manual for vSphere monitoring and performancehttps://www.vmware.com/support/pubs/

\12\ What diagnostics options are available for WinCC and PCS 7 OS?https://support.industry.siemens.com/cs/ww/en/view/48698507

\13\ Modifying the Hardware Abstraction Layer (HAL) for a Windows virtual machine(1003978)https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1003978

\14\ Troubleshooting a converted virtual machine that experiences poor performance(1013857)https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1013857

\15\ Troubleshooting ESX/ESXi virtual machine performance issues (2001003)https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2001003

\16\ Configuring VMDirectPath I/O pass-through devices on a VMware ESX or VMwareESXi host (1010789)http://kb.vmware.com/kb/1010789

\17\ SIMATIC NET: PC Software SIMATIC NET PC Software V14 SP1 >Installation, configuration of SIMATIC NET CPs in a VMware vSphere server (ESXi)https://support.industry.siemens.com/cs/ww/en/view/77377602

\18\ DIGI AnywhereUSBhttp://www.digi.com/products/usb/anywhereusb#docs

\19\ vApp Deployment and Configuration Guidehttps://www.vmware.com/pdf/vcops-vapp-585-deploy-guide.pdf

https://support.industry.siemens.com/cs/start?lc=en-DE


https://support.industry.siemens.com/kompatool/pages/main/index.jsf?sitc=wwdfi10002

https://support.industry.siemens.com/cs/document/109749129/where-do-you-obtain-technical-support-for-the-configuration-of-a-virtual-simatic-pcs-7-wincc-system-?dti=0&lc=en-DE


https://www.vmware.com/resources/compatibility/search.php



https://kb.vmware.com/s/article/2109712



https://www.vmware.com/support/pubs/








http://kb.vmware.com/kb/1010789


http://www.digi.com/products/usb/anywhereusb#docs


9 Appendix


ãS

iem

ens

AG

2018

All

right

sre

serv

ed

No. Topic

\20\ VMware Knowledge Basehttps://kb.vmware.com/selfservice/microsites/microsite.do

\21\ Performance Best Practices for VMware vSphere 6.0https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/vmware-perfbest-practices-vsphere6-0-white-paper.pdf

\22\ Time synchronization - Time synchronization in the automation environmenthttps://support.industry.siemens.com/cs/ww/en/view/86535497

\23\ Which security precautions help against unauthorized access in the SIMATIC PCS7 / WinCC environment?https://support.industry.siemens.com/cs/ww/en/view/44443744

\24\ vmware Security Response Policyhttps://www.vmware.com/support/policies/security_response

9.3 Change documentationTable 9-2

Version Date Modification

V1.0 07/2015 First versionV2.0 08/2018 Reworking






https://www.vmware.com/support/policies/security_response

Documents

WinCC Virtualization - support.industry.siemens.com · Warranty and Liability WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 2 ã S i e m e n s A G 2 0 1 8 A l l r i g h t