WinCC Virtualization WinCC V7.4 SP1 / WinCC Professional V15 https://support.industry.siemens.com/cs/ww/en/view/49368181 Siemens Industry Online Support Warranty and Liability Warranty and Liability ã Siemens AG 2018 All rights reserved Note The Application Examples are not binding and do not claim to be complete with regard to configuration, equipment or any contingencies. The Application Examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible for the correct operation of the described products. This Application Example does not relieve you of the responsibility of safely and professionally using, installing, operating and servicing equipment. When using this Application Example, you recognize that we cannot be made liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to this Application Example at any time and without prior notice. If there are any deviations between the recommendations provided in this Application Example and other Siemens publications – e. g. catalogs – the contents of the other documents shall have priority. We do not accept any liability for the information contained in this document. Any claims against us – based on whatever legal reason – resulting from the use of the examples, information, programs, engineering and performance data etc., described in this Application Example shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act (“Produkthaftungsgesetz”), in case of intent, gross negligence, or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or breach of fundamental contractual obligations (“wesentliche Vertragspflichten”). The compensation for damages due to a breach of a fundamental contractual obligation is, however, limited to the foreseeable damage, typical for the type of contract, except in the event of intent or gross negligence or injury to life, body or health. The above provisions do not imply a change of the burden of proof to your detriment. Any form of duplication or distribution of these Application Examples or excerpts hereof is prohibited without the expressed consent of Siemens AG. Security information Siemens provides products and solutions with Industrial Security functions that support the secure operation of plants, systems, machines and networks. To protect plants, systems, machines and networks against cyber threats, it is necessary to implement (and continuously maintain) a holistic, state-of-the-art Industrial Security concept. Products and solutions from Siemens are only one part of such a concept. It is the customer’s responsibility to prevent unauthorized access to the customer’s plants, systems, machines and networks. Systems, machines and components should only be connected with the company’s network or the Internet, when and insofar as this is required and the appropriate protective measures (for example, use of firewalls and network segmentation) have been taken. In addition, Siemens’ recommendations regarding appropriate protective action should be followed. For more information on Industrial Security, visit http://www.siemens.com/industrialsecurity. Siemens’ products and solutions undergo continuous development to make them even more secure. Siemens strongly recommends to carry out updates as soon as the respective updates are available and always only to use the current product versions. Use of product versions that are no longer supported, and failure to apply latest updates may increase customer’s exposure to cyber threats. In order to always be informed about product updates, subscribe to the Siemens Industrial Security RSS Feed at http://www.siemens.com/industrialsecurity. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 2 Table of Contents Table of Contents Warranty and Liability .............................................................................................. 2 1 Preface ............................................................................................................ 5 1.1 1.2 2 Automation Task ............................................................................................ 6 2.1 2.2 2.3 3 Licensing with a single license ......................................................... 23 Licensing with floating licenses ........................................................ 23 Diagnostic capabilities ................................................................................. 24 ã Siemens AG 2018 All rights reserved 6.1 6.2 6.3 7 General hardware compatibility ........................................................ 15 Configuration of the host systems .................................................... 15 Configuration of guest systems ........................................................ 17 General information ......................................................................... 17 Configuration of network cards......................................................... 18 Remote access ................................................................................ 19 Communication................................................................................ 21 Name resolution .............................................................................. 21 VLANs ............................................................................................. 21 Redundancy connection between servers ........................................ 21 SIMATIC software redundancy ........................................................ 22 Licensing of SIMATIC Products ................................................................... 23 5.1 5.2 6 WinCC system architecture in virtual environment.............................. 7 What is virtualization? ........................................................................ 8 Definition ........................................................................................... 8 Server-based virtualization (type 1: native)....................................... 10 Client-based virtualization (type 2: hosted) ....................................... 10 Summary of server-based and client-based virtualization ................. 11 Advantages and disadvantages of the virtualization ......................... 12 SIMATIC Virtualization as a Service................................................. 14 Configuration ................................................................................................ 15 4.1 4.1 4.2 4.2.1 4.2.2 4.3 4.4 4.4.1 4.4.2 4.4.3 4.5 5 Introduction ....................................................................................... 6 Virtualization requirements................................................................. 6 Fields of application for virtualization.................................................. 6 Automation Solution ...................................................................................... 7 3.1 3.2 3.2.1 3.2.2 3.2.3 3.2.4 3.2.5 3.3 4 Purpose of the document ................................................................... 5 Validity .............................................................................................. 5 Diagnostics using VMware vSphere client ........................................ 24 Diagnostics in the virtual system ...................................................... 25 Performance problems..................................................................... 27 Further Notes, Tips and Tricks .................................................................... 28 7.1 7.2 7.3 7.3.1 7.3.2 7.3.3 7.3.4 7.3.5 7.3.6 7.3.7 7.3.8 7.3.9 WinCC Virtualization Entry ID: 49368181, V2.0, Pass-through (VMDirectPath IO)...................................................... 28 Managed USB HUB ......................................................................... 29 General recommendations............................................................... 30 Snapshots ....................................................................................... 30 vMotion or vMotion Storage ............................................................. 30 SDRS (Storage DRS) ...................................................................... 31 Fault Tolerance................................................................................ 31 Cloning virtual machines (VM) ......................................................... 31 VMware Tools ................................................................................. 31 Increasing performance of vnetflt.sys driver ..................................... 32 Hard drives ...................................................................................... 33 Unnecessary hardware in virtual machines ...................................... 33 08/2018 3 Table of Contents 7.3.10 7.4 7.4.1 7.4.2 7.4.3 7.4.4 Synchronizing the virtual machines .................................................. 33 Security settings .............................................................................. 34 Disabling automatic update of VMware Tools ................................... 34 Time synchronization through NTP .................................................. 35 Applying patches for ESXi ............................................................... 35 Security in general ........................................................................... 35 8 Glossary........................................................................................................ 36 9 Appendix....................................................................................................... 39 Service and Support ........................................................................ 39 Links and literature .......................................................................... 40 Change documentation .................................................................... 41 ã Siemens AG 2018 All rights reserved 9.1 9.2 9.3 WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 4 1 Preface 1 Preface 1.1 Purpose of the document This document describes the virtualization of WinCC V7 and WinCC Professional in connection with an ESXi server. In this document you will find 1.2 · Information on the infrastructure for the use of WinCC · Demonstration of special features · Diagnostic capabilities Validity ã Siemens AG 2018 All rights reserved This document is based on the following versions · WinCC V7.4 SP1 · WinCC Professional V15 · VMware ESXi V6.0 · VMware vSphere V6.0 General statements are also valid for other WinCC V7 and WinCC Professional versions. Software-dependent releases can be found in the Compatibility tool \3\ WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 5 2 Automation Task 2 Automation Task 2.1 Introduction Virtualization of servers is already of high importance in information technology. In automation technology the advantages of virtualization shall also be achieved. 2.2 Virtualization requirements The availability of the plant and the automation technology has the highest priority. The same applies for plants with real computers and for plants that are operated in a virtual environment. For plant operation in a virtual environment, there should be no visible difference to real computers. 2.3 Fields of application for virtualization Depending on the area of application, different hardware and software are used for the virtualization solutions. ã Siemens AG 2018 All rights reserved Application Virtualization solution Engineering, training and short tests VMware Player, VMware Workstation, Windows Virtual PC… VMware vSphere, HyperV Production plants VMware vSphere, HyperV Topics not covered by this application This document describes the use and the approach using VMware ESXi and VMware vSphere. The VMware Workstation or VMware Player is not considered. These products are not released for productive operation. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 6 3 Automation Solution 3 Automation Solution 3.1 WinCC system architecture in virtual environment ã Siemens AG 2018 All rights reserved Figure 3-1 WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 7 3 Automation Solution 3.2 What is virtualization? 3.2.1 Definition Virtualization is the abstraction of physical hardware from the operating system. For this purpose, a special virtualization layer, the so-called hypervisor, is located on a real computer. This makes it possible to implement several virtual machines (VM) that are isolated from each other, with their own virtual hardware components and their proprietary operating systems on a real, physical computer (host system). They act like real computers and can execute applications themselves. Layout for virtualization ã Siemens AG 2018 All rights reserved Figure 3-2 Tasks of the hypervisor Among other things, the hypervisor has the following tasks: · The hypervisor is the virtualization layer in which the VMs run. · The hypervisor manages the resource allocation of the real hardware to the VMs and the execution of the VMs. · The hypervisor is also called VMM (Virtual Machine Manager or Monitor). WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 8 3 Automation Solution Physical and virtual setup ã Siemens AG 2018 All rights reserved Figure 3-3 Variants Basically, there are two types of virtualization, which differ in terms of configuration and structure. · Server-based virtualization (type 1: native) · Client-based virtualization (type 2: hosted) WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 9 3 Automation Solution 3.2.2 Server-based virtualization (type 1: native) The virtualization variant is characterized by the following characteristics: · The hypervisor runs directly on the hardware of the host and is more efficient. It requires fewer resources, but has to provide all drivers. · No direct operation: The VMs are operated via remote clients. · Fields of application are data centers and production plants. · Examples for type 1 are "VMware ESX/ESXi" and "Hyper-V". ã Siemens AG 2018 All rights reserved Figure 3-4 3.2.3 Client-based virtualization (type 2: hosted) This virtualization variant is characterized by the following characteristics: · The hypervisor is based on a fully-fledged operating system, e.g. Windows, and uses the device drivers of the operating system. · Direct operation: The VMs are operated directly on the computer via graphics card and monitor. · Areas of application are mainly engineering and short tests. · Examples for type 2 are "VMware Workstation and VMware Player", "VirtualBox" or "Windwos Virtual PC". WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 10 3 Automation Solution Figure 3-5 Note Summary of server-based and client-based virtualization ã Siemens AG 2018 All rights reserved 3.2.4 This document describes only type 1 with VMware ESX/ESXi. Server-based virtualization Type 1 native (ESXi server) Client-based virtualization Type 2 hosted (VMware Workstation) · The hypervisor runs directly on the hardware of the host and is more efficient. It requires fewer resources, but has to provide all drivers. · The hypervisor is based on a fullyfledged operating system (e.g. Windows) and uses the device drivers of the operating system. · No direct operation: The VMs are operated via remote clients. · Direct operation: The VMs are operated directly on the computer via graphics card and monitor · Areas of application: Data centers and production plants · Areas of application: Engineering and short tests WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 11 3 Automation Solution 3.2.5 Advantages and disadvantages of the virtualization Table 3-1 ã Siemens AG 2018 All rights reserved Advantages Disadvantages Costs Reduction of costs · Consolidation of physical computers, cables, switches, etc. · Reduction of energy consumption · Reduction of space requirements less expensive hardware can be used for clients (so-called thin client solutions) Software costs for the operating system remain. Additional license costs for virtualization depending on the range of functions Security Increased security · Increased security due to remote access and centralized rights management · Reduced attack possibilities with thin clients; central protection on the ESXi server for the virtual machines Possibly increased security expenses (additional layer, data security) Availability Increased availability · Easy exchange of virtual machines on ESXi server possible · Flexibility · Increased flexibility · Hardware independence of the virtual machines · Virtual machines with different operating systems on one ESXi server · Additional virtual machines can be added by starting another VMware session · Hardware RAID can be configured as software RAID (ESXi Server) · Securing commissioning · Simple recording in the event of system failures System complexity · · WinCC Virtualization Entry ID: 49368181, V2.0, Danger of a "Single Point of Failure" Support may not come from a single source 08/2018 Significantly increasing system complexity Higher administration effort 12 3 Automation Solution Support If a problem occurs while operating a virtual machine, the support required for this may become time-consuming. In this case, the responsibility must first be clarified, as can be seen in the following diagram. Figure 3-6 ã Siemens AG 2018 All rights reserved Note When using SIMATIC Virtualization as a Service (see chap. 3.3) you not only receive pre-installed and pre-configured ESXi servers including WinCC installations in the form of VMs, but also the service for these complete systems from a single source. You can use a support request to determine the power requirements of a virtualized SIMATIC WinCC system. Further information is available in the following FAQ: "Where do you obtain technical support for the configuration of a virtual SIMATIC PCS 7 / WinCC System?". \4\ WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 13 3 Automation Solution 3.3 SIMATIC Virtualization as a Service SIMATIC Virtualization as a Service is a pre-configured, ready-to-use virtualization system for implementing efficient automation solutions for SIMATIC systems. ã Siemens AG 2018 All rights reserved Figure 3-7 A hypervisor is installed on a powerful server that manages the hardware resources and dynamically distributes them to the virtual machines. Central management, configuration and maintenance of the virtual machines and the virtualization server are carried out via a management console. The virtual machines are equipped with SIMATIC PCS 7 or SIMATIC WinCC installations and are preconfigured depending on the automation task (e.g. PCS 7 ES/Client, WinCC Server). The virtualization system can be easily and efficiently extended by preconfigured virtual machines and is therefore scalable to different plant sizes. A highly available system can be realized by using additional virtualization servers. Further information on SIMATIC Virtualization as a Service is available at the following link: · SIMATIC Virtualization as a Service \5\ WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 14 4 Configuration 4 Configuration 4.1 General hardware compatibility Each ESXi host and its components must be listed in the VMware's HCL (Hardware Compatibility List) for each ESXi version and license. For more information, please use the following link: https://www.vmware.com/resources/compatibility/search.php \6\ 4.1 NOTICE Configuration of the host systems The user/administrator is obliged to provide and secure sufficient system resources on the virtualization server and the virtual systems. Minimum system requirements for installing ESXi/ESX (1003661) http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd= displayKC&externalId=1003661 \7\ Best practices to install or upgrade to ESXi 6.0 (2109712) ã Siemens AG 2018 All rights reserved https://kb.vmware.com/s/article/2109712 \8\ Hardware example Here is an example from practical experience. · The configured main memory (RAM) of all VMs running simultaneously must not exceed 90% of the physically available RAM. · The ratio 2:1 of the virtually configured CPU cores of all simultaneously running VMs to the physically available CPU cores should not be exceeded. The following table shows an example of a possible assignment: Hardware Number Intel® Xeon® Processor E5-2640V4 (25MB Cache, 2.40 GHz, 8.00 GT/s QPI) 10 Cores Usage 1 core for host 1x ES 1x OS Server: 5x OS Client: 4 vCores 2 vCores 10 vCores · For performance reasons, the size of the data stores on the individual RAID systems should not exceed 2TB. · Using a RAID 10 system for the data stores offers the best read/write performance. · A better performance of WinCC can be achieved if a CPU with fewer cores and higher clock frequency is preferred to a CPU with more cores and lower clock frequency. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 15 4 Configuration Network The following figure shows an example of the communication principle of a virtualization system: · The internal communication between ES, WinCC server and WinCC client. · The communication of ES, WinCC server and WinCC client to the outside, e.g. to the AS via the physical network cards of the ESXi server. ã Siemens AG 2018 All rights reserved Figure 4-1 WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 16 4 Configuration 4.2 Configuration of guest systems 4.2.1 General information ã Siemens AG 2018 All rights reserved Features 1) Note Requirements 1) VM Version 8,9,10 or 11 Hard drive storage management Use type: "Thick Provision Eager Zeroed" Virtual network modules There are as many network cards to configure as would be the case with real WinCC stations. A redundant OS server would therefore have 3 virtual network cards. Separation of networks It is recommended to physically/virtually separate terminal, system and redundancy bus and not to use VLANs. The IP addresses of terminal, system and redundancy buses have to be located in different subnets. Network cards All network cards are assigned to the "Private" network profile within Windows via group policy. CPU load The CPU continuous load of the assigned logical CPU cores must not exceed 70% - 80%. Note: When archiving large data volumes a respective reserve is required (high I/O load). This load is given at a capacity of 70% - 80%. VMware Tools "VMware Tools" must be installed inside the virtual machines. This results in better performance and maintainability of the VMs. Operating states Suspend/Resume of the VMs, as well as VMware options, (e.g. vMotion) are not supported. The VMs must be treated like real WinCC stations. A downgrade of the VM version is not possible. Card type of virtual network cards The card type of the virtual network cards has to be "E1000" or "vmxnet3" (recommended). The card type "vmxnet3" cannot be used until VMware Tools is installed in the VM. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 17 4 Configuration 4.2.2 NOTICE Note Configuration of network cards Faulty process communication · No unused network cards may exist in the Windows "Network and Sharing Center". Unused cards must be disabled or removed from the virtual machine configuration. · No network card should be assigned to the public network profile. · When adding/removing network cards, their order changes in Windows. After making changes to the network configuration, check the order of the network cards according to the WinCC documentation. The following group policy can be used to ensure that no network card is assigned to the "Public network" network category: Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Network Manager Policies > Non-identified Networks: Set the location type from "Not configured" to "Private". ã Siemens AG 2018 All rights reserved Note First uninstall unused network cards in the Windows device manager. If you do not do this, "remaining files" will be left in the properties of the VM in Windows after you delete network cards. These "remaining files" must first be made visible in the device manager before they can be uninstalled. If these "remaining files" are not removed, the name of the deleted network card cannot be used again. Tip: If BGInfo (not included in Windows) is used, the desktop can show whether "remaining files" are available. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 18 4 Configuration 4.3 Remote access The VMs can be accessed with a thin client or a remote system via RDP, RealVNC, vSphere Client or vSphere Web Client. General information ã Siemens AG 2018 All rights reserved The following points apply to all remote connections: · All operator stations can be operated via exactly one open remote connection. · For a remote connection, the existing session must be taken over. This means that a user must be logged in at the operating station. · Remote Desktop may only be used via "mstsc/console" or "mstsc/admin". · An RDP connection may only be used for access to clients without additional functions (web functions). · With WinCC servers or the single-user system, RPP is only permitted if WinCC is running in service mode. · When using an RDP connection to a VM, the automatic logon to Windows has to be configured in this VM, e.g. using "control userpasswords2" or "Autologon for Windows" (Windows Sysinternals). · In order to access a VM with automatic logon via RDP, the following registry entry may not be present as of Windows Server 2012 R2 and Windows 10 (default setting): "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceAutoLogon" · Disabling the TCP auto tuning level: The TCP auto tuning settings can be disabled using the following command: netsh interface tcp set global autotuninglevel=disabled You can find information on this in the FAQ entry: "Which settings should you make when an OVF export fails using the "VMware vSphere Client" application?" \9\ RealVNC Audio signals cannot be transmitted via a RealVNC connection. The released version of RealVNC for WinCC is included in the compatibility tool: http://www.siemens.de/kompatool \3\ WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 19 4 Configuration vSphere Client ã Siemens AG 2018 All rights reserved Opening the console ("Open Console") of a VM in the vSphere client can take relatively long (35 sec). One possible reason for this is that certificates cannot be verified if there is no internet connection. This can be prevented by configuring the following group policy: Set "Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings\Turn off Automatic Root Certificates Update" to "enabled". WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 20 4 Configuration 4.4 Communication 4.4.1 Name resolution In a virtual environment, a management network is usually also used to manage the virtual infrastructure. In this management network it is recommended to use a DNS server for the name resolution of ESXi servers. Note The name resolution of the VMs necessary for the operation of WinCC must take place when using a DNS/WINS server via the terminal bus or by using the locally configured hosts and lmhosts files. The name resolution has to be done via the IPv4 protocol. 4.4.2 VLANs VLANs can be used in WinCC. You can find information on this in the FAQ entry "How do you configure a Virtual Local Area Network (VLAN) in PCS 7?“.\10\ ã Siemens AG 2018 All rights reserved VLANs must not be used on the dedicated network card of the ES to the fieldbus (PROFINET). 4.4.3 Redundancy connection between servers The connection between redundant WinCC servers for redundancy adjustment must be made via Ethernet. The following figure shows settings within the configuration of SIMATIC Shell: · Selection of the virtual network card for the redundancy bus in the redundancy settings · Disabling the serial port Figure 4-2 WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 21 4 Configuration 4.5 SIMATIC software redundancy With a redundant WinCC system, the runtime is active on both servers (master and standby). This has the following characteristics: · The clients are distributed between both servers (load balancing). · After a failure, the data status is synchronized on both servers by archive adjustment ã Siemens AG 2018 All rights reserved The fault tolerance provided by vmWare is not a replacement for the SIMATIC redundancy and therefore cannot be used. (see chapter 7.3.4 Fault Tolerance). WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 22 5 Licensing of SIMATIC Products 5 Licensing of SIMATIC Products General information As a general rule, you have to license all products/software according to the respective manufacturer's license terms and conditions. In terms of licensing, a SIMATIC software installation on a virtual machine does not differ from the installation on a real machine. Therefore, each SIMATIC software installation on a virtual machine, e.g. SIMATIC WinCC and other SIMATIC applications, has to be licensed accordingly. Likewise, each SIMATIC WinCC Client installation on a virtual machine has to be licensed accordingly. 5.1 Licensing with a single license Unlimited duration standard license that can be transferred to any computer and used on this computer. The Certificate of License (CoL) defines the type of use. Licenses of the single license type can only be used locally. ã Siemens AG 2018 All rights reserved 5.2 Licensing with floating licenses Unlimited license duration that can be transferred to any computer and used on this computer. The license can also be obtained from a license server over the network. Note The freedoms gained in handling virtualization entail the risk of easily damaging or destroying virtual machines. When things get serious, a virtual machine will be irretrievably lost, including all installations and licenses. To minimize the risk of losing licenses, use a license server with SIMATIC floating licenses. This additionally facilitates handling licenses. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 23 6 Diagnostic capabilities 6 Diagnostic capabilities Troubleshooting and performance (Chap 4.4 109486064) VMware provides various means to diagnose performance bottlenecks. Below, we will briefly describe use of the vSphere Client and of the "esxtop" tool. For more information, see the manual "vSphere Monitoring and Performance". https://www.vmware.com/support/pubs/ \11\ 6.1 Diagnostics using VMware vSphere client General information You can use the vSphere Client not only to configure the virtual machines (guest systems), but also to monitor the ESXi server and the individual virtual systems. Monitoring options ã Siemens AG 2018 All rights reserved You can display these points as curves with the vSphere client: · Main memory usage · Operating state · CPU load · Hard drive · Network utilization The procedure in detail Table 6-1 No. Step/action 1. Log on to the ESX(i) server · Start your VMware VSphere client. The Logon dialog appears: · Enter the IP address of your virtualization server and your user data. The vSphere Client starts. 2. Navigate to ESX(i) server diagnostics · In the navigation tree, select the top item. (The virtualization server.) · Then select the “Performance” tab. A diagram appears that shows the performance data graph. 3. Customizing the ESX(i) server diagnostics To monitor the values used for these measurements, proceed as follows: · In the top area of the tab, click “Trend settings…”. The “Adjust performance trend” dialog appears. · Monitoring the RAM – In the “Trend settings” tree, expand the “RAM” item. – In “RAM”, click “Realtime”. – In the “Performance logs” fields, deselect everything and select only “active”. – Confirm with OK. In the diagram, you can now monitor the active RAM. · Monitoring the CPU load – In the “Trend settings” tree, expand the “CPU” item. – In “CPU”, click “Realtime”. – In the “Performance logs” field, deselect everything and select only WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 24 6 Diagnostic capabilities No. Step/action – 6.2 “usage”. Confirm with OK. In the diagram, you can now monitor the CPU load. 4. Navigate to diagnostics of the virtual system · In the navigation tree, select the item of the virtual system to be monitored. · Then select the “Performance” tab. A diagram appears that shows the performance data graph. 5. Customizing diagnostics of the virtual system To do this, proceed as described in step 3. Diagnostics in the virtual system For diagnostics in the virtual system, use the Windows tool Windows Performance Monitor. The procedure in detail Table 6-2 ã Siemens AG 2018 All rights reserved No. Step/action 1. Starting the tool Click “Start > Performing". The “Run...” dialog appears. · Enter “Perfmon” and click OK. The monitoring tool starts. 2. Customizing the performance indicators Remove all performance logs from the lower right area. · In this area, right-click. In the menu, select “Add performance logs...”. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 25 6 Diagnostic capabilities No. Step/action · · · · ã Siemens AG 2018 All rights reserved · The “Add performance logs” dialog appears. To display the CPU load as a percentage, select the “Processor” data object and select the “% Processor Time” performance log. Select “_Total” as the instance. Click on "Add…". To display the main memory allocation, select the “Memory” data object and select the “Committed Bytes” data object. Click “Add” and select “Close” to close the dialog. Note It is a problem to display both values simultaneously in one diagram. The axis scaling differs. For optimum display, adjust the scaling using the “Properties” button and the “Graphics” tab. For more information, follow this link: "What diagnostics options are available for WinCC and PCS 7 OS?" \12\ WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 26 6 Diagnostic capabilities 6.3 Performance problems To prevent your VM from running with poor performance, define the hardware configuration of the VM before installing the operating system. This mainly applies to: · Number of virtual sockets · Number of virtual cores per socket If you make changes to the hardware configuration, you must adjust the HCL of the VM again. Further information is available at: · Modifying the Hardware Abstraction Layer (HAL) for a Windows virtual machine (1003978) ã Siemens AG 2018 All rights reserved https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd =displayKC&externalId=1003978 \13\ · Troubleshooting a converted virtual machine that experiences poor performance (1013857) https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cm d=displayKC&externalId=1013857 \14\ · Troubleshooting ESX/ESXi virtual machine performance issues (2001003) https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cm d=displayKC&externalId=2001003 \15\ WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 27 7 Further Notes, Tips and Tricks 7 Further Notes, Tips and Tricks 7.1 Pass-through (VMDirectPath IO) General information Pass-through support in VMware vSphere Server (ESXi) allows you to pass certain physical components of the server directly to the virtual machines. The virtual machine detects the new hardware automatically, if necessary appropriate drivers are installed later. As long as you use pass-through function: · the hardware is a part of the virtual machine · the HyperVisor no longer has access Various SIMATIC NET CPs have been tested for the pass-through function and can be used. Note This is where you can find information about pass-through configurations ã Siemens AG 2018 All rights reserved http://kb.vmware.com/kb/1010789 \16\ Note When using SIMATIC NET CPs in a virtual environment, observe the requirements and dependencies of SIMATIC NET. "SIMATIC NET PC-Software SIMATIC NET PC Software V14 SP1 installation manual – chapter 3 and 4" Installation, configuration of SIMATIC NET CPs in a VMware vSphere server (ESXi) https://support.industry.siemens.com/cs/ww/en/view/77377602 \17\ Other compatibilities can be found here https://support.industry.siemens.com/kompatool/pages/main/index.jsf \3\ You can use WinCC ASIA dongle via pass-through. The number of ASIA dongles depends on the international USB hubs and not on the number of USB ports. Only one USB HUB is forwarded at a time. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 28 7 Further Notes, Tips and Tricks 7.2 Managed USB HUB General information The following diagram shows you how a USB HUB is connected to a virtual infrastructure via the Ethernet LAN. You configure the assignment of the USB ports to the virtual machine via the hub's Web interface. Furthermore, every virtual machine that you connect to the USB HUB needs a corresponding software. Using this software, the virtual machine accesses the respective USB port (port groups). The USB devices connected to these ports are passed on to the respective virtual machine via the Ethernet LAN. Note A guide showing the detailed configuration of the USB HUB is available on the manufacturer’s website: http://www.digi.com/products/usb/anywhereusb \18\ ã Siemens AG 2018 All rights reserved Figure 7-1 VM VM VM VM VM VM VM VM VM RealPort USB software drivers Ethernet LAN AnywhereUSB USB Device SmartCard Remote Client The following USB HUBs were compatibility-tested: WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 29 7 Further Notes, Tips and Tricks http://www.digi.com/products/usb/anywhereusb \18\ You can use WinCC ASIA dongle via USB HUB. 7.3 General recommendations 7.3.1 Snapshots Do not use snapshots during productive operation. This can negatively affect the virtual machine's general performance capability. For more information, follow this link: https://www.vmware.com/pdf/vcops-vapp-585-deploy-guide.pdf (p. 15) \19\ Search KB entry 2000986 "Snapshots are not backups" for "Best practices for virtual machine snapshots in the VMware environment". https://kb.vmware.com/selfservice/microsites/microsite.do \20\ 7.3.2 vMotion or vMotion Storage ã Siemens AG 2018 All rights reserved Do not use vMotion or vMotion Storage for virtual machines in which SIMATIC software is active. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 30 7 Further Notes, Tips and Tricks 7.3.3 SDRS (Storage DRS) Storage DRS enables moving virtual machines automatically within a data store cluster. A data storage cluster consists of individual data stores. Do not move virtual machines with active SIMATIC software. 7.3.4 Fault Tolerance Fault Tolerance (FT) provides uninterrupted availability by assuring that the states of the primary and secondary virtual machine are identical for the entire time the instruction is being executed. FT is not supported in conjunction with SIMATIC software and is not considered in this application example. 7.3.5 Cloning virtual machines (VM) Cloning a virtual machine is not compatibility-tested and not released. 7.3.6 VMware Tools ã Siemens AG 2018 All rights reserved Install the latest version of the VMware Tools. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 31 7 Further Notes, Tips and Tricks 7.3.7 Increasing performance of vnetflt.sys driver You can increase the performance of WinCC within the VM by uninstalling the "vnetflt.sys" driver. Table 7-1 Start the VMware converter. 2. Select "Change" and click on the “Next" button 3. Uninstall the "NSX Network Introspection Driver" in "VMCI Driver > NSX File Introspection Driver" 4. Restart the computer. ã Siemens AG 2018 All rights reserved 1. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 32 7 Further Notes, Tips and Tricks 7.3.8 Hard drives Thick provisioned eager zeroed Format Create the hard drives in the format "Thick Provision Eager Zeroed". It will provide the best performance properties. For more information, follow this link: https://www.vmware.com/pdf/vcops-vapp-585-deploy-guide.pdf (p. 15) \19\ Distributing multiple hard drives of a virtual machine Distribute the hard drives evenly across the virtual SCSI adapters. For more information, see the book "Virtualizing Microsoft Business Critical Applications on VMware vSphere" (p. 90). I/O-intensive applications ã Siemens AG 2018 All rights reserved Use the paravirtual storage adapter (PVSCSI) for I/O intensive applications. It reduces the CPU load and is capable of improving especially the system's overall performance. Also observe the information provided by the following links. For more information, follow this link: https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/v mware-perfbest-practices-vsphere6-0-white-paper.pdf \21\ Or in KB article 1010398. Search for "Configuring disks to use VMware Paravirtual SCSI adapters". https://kb.vmware.com/selfservice/microsites/microsite.do \20\ Note 7.3.9 The use of SSD brings a considerable improvement in performance. Unnecessary hardware in virtual machines Remove all unnecessary hardware from the configuration. Each unnecessary element can negatively affect the performance capability of your virtual machine. For more information, follow this link: https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/v mware-perfbest-practices-vsphere6-0-white-paper.pdf \21\ This includes: 7.3.10 · Floppy disk · CD ROM · HD audio Synchronizing the virtual machines The host (ESXi) must use the same time source as the operating systems within the virtual machines. Before time synchronization mechanisms take effect in the virtual machine, the host's time is used when starting the virtual machine. If the two times differ, undesired behavior can occur as a result. In the virtual machine, use one of the following time synchronization methods: WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 33 7 Further Notes, Tips and Tricks · VMware Tools or · Time synchronization - Time synchronization in the automation environment In this entry you will find the most important entries on the 'Time Synchronization' topic in Industry Online Support. https://support.industry.siemens.com/cs/ww/en/view/86535497.\22\ Synchronization of the hosts The ESXi hosts need a time source. Set this source accordingly using the vSphere Client. ã Siemens AG 2018 All rights reserved Figure 7-2 Figure 7-3 7.4 Security settings 7.4.1 Disabling automatic update of VMware Tools An automatic upgrade of the VMware Tools may cause the host operating system to be restarted automatically. Note During the restart, e.g. a WinCC server is not available or WinCC clients cannot be operated. Disable the automatic installation of VMware Tools: WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 34 7 Further Notes, Tips and Tricks 7.4.2 Time synchronization through NTP Synchronize your ESXi host with a time source. Use the same time source as for time synchronization of your operating systems within the VMs. 7.4.3 Applying patches for ESXi Always keep the patches of your ESXi hosts up to date. You can do so using the Update Manager for example. NOTICE Restart of the host and thus also the virtualized machines necessary You may need to restart the host to successfully install patches. Note that the virtual machines running on the server also have to be restarted. WinCC servers of this host are not available for this period and WinCC clients of this host cannot be operated. WinCC servers or WinCC clients of other hosts are not affected. ã Siemens AG 2018 All rights reserved For more information, follow this link: https://www.vmware.com/support/policies/security_response \24\ 7.4.4 Security in general Siemens provides products and solutions with Industrial Security functions that support the secure operation of plants, systems, machines and networks. Further information can be found at the following links. · Which security precautions help against unauthorized access in the SIMATIC PCS 7 / WinCC environment? https://support.industry.siemens.com/cs/ww/en/view/44443744 \23\ · SIMATIC process control system PCS 7 safety concept PCS 7 & WinCC (basic) https://support.industry.siemens.com/cs/ww/en/view/60119725 WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 35 8 Glossary 8 Glossary ESX(i) Product from VMware. The software has/is its own operating system and provides virtual systems with workspace. The software is used for virtualization on the server side. Core installation Operating system installation without a graphical user interface; replaced by a simplified platform such as a CMD command prompt or PowerShell. Guest A guest is a virtualized computer running within a host (equivalent to VM). Host ã Siemens AG 2018 All rights reserved The “host” for virtual machines, regardless of whether this refers to the “host” for desktop or server virtualization. In this document, “host” is equivalent to virtualization server. HyperV This software environment is provided by Microsoft through different paths and allows the user to provide, manage and run virtual machines on a Windows server or core server. HyperVisor Software for virtualization (of a virtualization server). Hyper-threading Technology for better processing of commands for the processor. Here, with hyper-threading, one processor core appears as 2 process cores to the operating system. IOPS Input/Output Operations per Second. Management Station A PC that performs the configuration, maintenance and monitoring of one or more virtualization servers. The VMware Converter or vSphere Client applications can be used in this context. RDP Remote Desktop Protocol is a Microsoft solution for operator control and monitoring of remote computers. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 36 8 Glossary SCADA SCADA stands for “Supervisory Control and Data Acquisition”. SSD SD stands for "solid-state drive" and is a data memory. VDS Virtual Distributed Switch Virtualization server (and virtual system) The real PC on which the VMware ESX(i) software runs that provides its resources to virtual systems. Computers that run within the VMware ESXi software are virtualized systems. Virtual hardware Real resources are not directly provided to the virtualized systems to allow shared use. Such shared hardware can be network cards, processor cores or hard drives. This hardware can be used partially and jointly by all virtualized systems. ã Siemens AG 2018 All rights reserved Virtual processor core A processor core provided to the virtual machine. A vCPU is not equivalent to a pCPU or pCore. A vCPU also includes the “double cores” due to HT. In addition, VMware does not distinguish between the core and the CPU; this is only relevant to the guest system. Virtual network A network which only exists within a virtualization server and allows communication between multiple virtual systems (within one virtualization server). VNC Virtual Network Control is an option for operator control and monitoring of remote computers. VMware Company and vendor of virtualization software. VMware vCenter Converter A VMware product for converting, transferring and creating virtual systems. VMware Workstation A VMware product for creating and using virtual systems on existing operating systems. vSphere Client A VMware product for configuring, monitoring and running a VMware ESXi Server. vSphere Server A VMware product that is installed on the server hardware. WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 37 8 Glossary Also known as a HyperVisor, VMware ESX(i) Server or ESX(i) host. vSphere vCenter Server A VMware product that is used in order to manage multiple ESX(i) HyperVisors using a vSphere Client. The vSphere VCenter Server is used to combine multiple ESX(i) hosts into a cluster, which increases effectiveness based on the available functionality. VSS ã Siemens AG 2018 All rights reserved Virtual Standard Switches WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 38 9 Appendix 9 Appendix 9.1 Service and Support Industry Online Support Do you have any questions or need support? Siemens Industry Online Support offers access to our entire service and support know-how as well as to our services. Siemens Industry Online Support is the central address for information on our products, solutions and services. Product information, manuals, downloads, FAQs and application examples – all information is accessible with just a few mouse clicks at https://support.industry.siemens.com Technical Support Siemens Industry's Technical Support offers quick and competent support regarding all technical queries with numerous tailor-made offers – from basic support right up to individual support contracts. ã Siemens AG 2018 All rights reserved Please address your requests to the Technical Support via the web form: www.siemens.en/industry/supportrequest SITRAIN – Training for Industry With our globally available training courses for our products and solutions and using innovative teaching methods, we help you achieve your goals. More information on the training courses offered as well as on locations and dates is available at: www.siemens.en/sitrain Service offer Our service offer comprises, among other things, the following services: · Product Training · Plant Data Services · Spare Parts Services · Repair Services · On Site and Maintenance Services · Retrofit and Modernization Services · Service Programs and Agreements Detailed information on our service offer is available in the Service Catalog: https://support.industry.siemens.com/cs/sc Industry Online Support app Thanks to the "Siemens Industry Online Support" app, you will get optimum support even when you are on the move. The app is available for Apple iOS, Android and Windows Phone: https://support.industry.siemens.com/cs/ww/en/sc/2067 WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 39 9 Appendix 9.2 Links and literature Table 9-1 ã Siemens AG 2018 All rights reserved No. Topic \1\ Siemens Industry Online Support https://support.industry.siemens.com \2\ Link to the entry page of the application example https://support.industry.siemens.com/cs/ww/en/view/49368181 \3\ Compatibility tool https://siemens.com/kompatool \4\ Where do you obtain technical support for the configuration of a virtual SIMATIC PCS 7 / WinCC System? https://support.industry.siemens.com/cs/en/en/view/109749129 \5\ SIMATIC Virtualization as a Service https://support.industry.siemens.com/cs/ww/en/sc/3095 \6\ VMware Compatibility Guide https://www.vmware.com/resources/compatibility/search.php \7\ Minimum system requirements for installing ESXi/ESX (1003661) http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=dis playKC&externalId=1003661 \8\ Best practices to install or upgrade to ESXi 6.0 (2109712) https://kb.vmware.com/s/article/2109712 \9\ Which settings should you make when an OVF export fails using the "VMware vSphere Client" application? https://support.industry.siemens.com/cs/ww/en/view/98158088" \10\ How do you configure a Virtual Local Area Network (VLAN) in PCS 7? \11\ Manual for vSphere monitoring and performance https://www.vmware.com/support/pubs/ \12\ What diagnostics options are available for WinCC and PCS 7 OS? https://support.industry.siemens.com/cs/ww/en/view/48698507 \13\ Modifying the Hardware Abstraction Layer (HAL) for a Windows virtual machine (1003978) https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=dis playKC&externalId=1003978 \14\ Troubleshooting a converted virtual machine that experiences poor performance (1013857) https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=dis playKC&externalId=1013857 \15\ Troubleshooting ESX/ESXi virtual machine performance issues (2001003) https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=dis playKC&externalId=2001003 \16\ Configuring VMDirectPath I/O pass-through devices on a VMware ESX or VMware ESXi host (1010789) http://kb.vmware.com/kb/1010789 \17\ SIMATIC NET: PC Software SIMATIC NET PC Software V14 SP1 > Installation, configuration of SIMATIC NET CPs in a VMware vSphere server (ESXi) https://support.industry.siemens.com/cs/ww/en/view/77377602 \18\ DIGI AnywhereUSB http://www.digi.com/products/usb/anywhereusb#docs \19\ vApp Deployment and Configuration Guide https://www.vmware.com/pdf/vcops-vapp-585-deploy-guide.pdf https://support.industry.siemens.com/cs/ww/en/view/66807297" WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 40 9 Appendix No. \20\ VMware Knowledge Base https://kb.vmware.com/selfservice/microsites/microsite.do \21\ Performance Best Practices for VMware vSphere 6.0 https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/v mware-perfbest-practices-vsphere6-0-white-paper.pdf \22\ Time synchronization - Time synchronization in the automation environment https://support.industry.siemens.com/cs/ww/en/view/86535497 Which security precautions help against unauthorized access in the SIMATIC PCS 7 / WinCC environment? https://support.industry.siemens.com/cs/ww/en/view/44443744 \23\ \24\ 9.3 Topic vmware Security Response Policy https://www.vmware.com/support/policies/security_response Change documentation ã Siemens AG 2018 All rights reserved Table 9-2 Version Date V1.0 07/2015 First version V2.0 08/2018 Reworking WinCC Virtualization Entry ID: 49368181, V2.0, 08/2018 Modification 41
