Capabilities, Constraints, and Network Simulation Rules for S7-PLCSIM in SIMATIC PCS 7

In SIMATIC PCS 7 engineering, S7-PLCSIM (classic) provides controller logic emulation for S7-400 and S7-300 automation systems, allowing testing of Continuous Function Charts (CFC), Sequential Function Charts (SFC), and WinCC OS communications without physical hardware. The latest release for STEP 7 V5.5 and PCS 7 V8/V9 is S7-PLCSIM V5.4 SP5 Update 1. While PLCSIM executes cyclic user programs and timer interrupts, it cannot simulate hardware redundancy coupling in S7-400H CPUs, genuine diagnostic interrupts (OB82/OB84), or CP 443-1 ISO transport protocols. For complete virtual commissioning involving high-availability controller pairs and fieldbus networks, plants must transition to SIMIT Simulation Platform paired with S7-PLCSIM Advanced.

S7-PLCSIM Architecture and Simulation Engine in PCS 7

The S7-PLCSIM software package (6ES7841-0CC05-0YA5) integrates directly into SIMATIC Manager to execute compiled STEP 7 user programs in a virtual software controller running on the Windows operating system. Within SIMATIC PCS 7, PLCSIM serves as the standard tool for validating CFC technological interlocks, batch phase logic in SFC, and WinCC operator station faceplates before downloading code to physical hardware.

PLCSIM operates by virtualizing the CPU memory areas: process image inputs (PII), process image outputs (PIQ), bit memory (M), timers (T), counters (C), and data blocks (DB). The simulation engine executes cyclic organization blocks (such as OB1 and cyclic interrupts OB30 through OB38) deterministically based on virtual clock cycles. For operator station integration, PLCSIM establishes virtual communication channels via PLCSIM(MPI), PLCSIM(DP), and PLCSIM(TCP/IP), allowing WinCC OS servers and single stations on the local engineering PC to read and write tags.

Key Functional Boundaries: PLCSIM Classic vs. Real Controllers

Engineers conducting factory acceptance testing (FAT) or virtual commissioning must account for the fundamental architectural differences between S7-PLCSIM Classic and real S7-400 hardware:

Absence of S7-400H Hardware Redundancy Simulation: S7-PLCSIM Classic cannot simulate the redundant synchronization link of S7-400H controller pairs. You can only simulate a single CPU instance (Rack 0 or Rack 1) as a standalone station. Failover switching, self-synchronizing optical links, and Bumpless Redundancy (H-Sync) cannot be tested in PLCSIM Classic.
Communication Protocol Restrictions: PLCSIM Classic does not support genuine ISO transport protocols (RFC 1006 is partially emulated via TCP/IP), hardnet communication processors (CP 1613 / CP 1623), or direct peripheral communication with remote field devices over PROFIBUS DP or PROFINET IO.
Diagnostic Interrupt Handling: Real S7-400 CPUs trigger OB82 (diagnostic interrupt), OB83 (insert/remove module), and OB85 (priority class error) directly from peripheral module ASICs. In PLCSIM, these interrupts are only executed if manually triggered via the PLCSIM menu (Execute -> Trigger Error OB).
Execution Cycle Determinism: PLCSIM execution timing depends on the Windows PC processor load and does not provide hard real-time determinism. High-speed closed-loop control algorithms may behave differently than on real S7-410 hardware.

S7-PLCSIM vs. S7-PLCSIM Advanced vs. SIMIT Feature Matrix

The following table compares simulation capabilities across Siemens controller emulation platforms:

Simulation CapabilityS7-PLCSIM Classic V5.4S7-PLCSIM Advanced V2.0+SIMIT Simulation PlatformTarget Controller FamilyS7-300 / S7-400 / WinACS7-1500 / ET 200SPVirtual Plant Behavior & I/ORedundant H-CPU SimulationUnsupported (Single CPU only)Supports S7-1500R/HSupported with Virtual Controller (VC)Virtual Ethernet NetworkingLocal loopback (PLCSIM.TCPIP)Full Virtual PC Adapter (Ethernet)OPC UA, PROFINET, Shared MemoryMultiple CPU InstancesLimited (Up to 8, high CPU load)Multiple distributed virtual CPUsHundreds of virtual controllersProcess Model Dynamic ModelingManual forcing of bits/wordsRequires external API connectionNative graphical physical modelingLicense Requirement (ALM)6ES7841-0CC05-0YA56ES7823-1FA00-0YA56ES7910-0AA00-0YA0

Step-by-Step Procedure to Configure and Test PCS 7 with S7-PLCSIM

To simulate a PCS 7 project using S7-PLCSIM V5.4 SP5 Update 1:

Start S7-PLCSIM from SIMATIC Manager:
- In SIMATIC Manager, click the Simulation On/Off icon in the toolbar (or select Options -> Simulate Modules).
- In the S7-PLCSIM window, select the communication interface dropdown and choose PLCSIM(TCP/IP) (or PLCSIM(MPI)).
- Set the CPU operating mode switch to STOP.
Download Hardware Configuration and S7 Program:
- In SIMATIC Manager, open HW Config for the target AS station and click Download to Module.
- Select target rack and slot (Rack 0, Slot 3 or 4 for CPU), then download.
- Open CFC, select Chart -> Compile -> Changes Only; once compiled, click Download.
- In the download dialog, select Entire Program (for initial simulation download) and confirm.
Switch CPU to RUN and Configure WinCC OS Connection:
- On the PLCSIM interface window, switch the CPU operating mode to RUN-P (or RUN).
- Open WinCC Explorer for the OS project.
- In Tag Management, locate the SIMATIC S7 PROTOCOL SUITE -> Industrial Ethernet (or TCP/IP channel unit).
- Right-click the channel unit, select System Parameter, open the Unit tab, and ensure the logical device name points to PLCSIM.TCPIP.1.
- Activate WinCC Runtime; verify that faceplates and block icons connect to the virtual CPU and show live values.

Verification

Verify PLCSIM simulation functionality:
1. In S7-PLCSIM, open an Insert -> Variable View; enter a process input address (e.g., IW512) and force a value.
2. In CFC, open the chart online and verify that the driver block reads the forced input value.
3. In WinCC Runtime, verify that the corresponding block icon updates dynamically without quality code errors (16#80).
4. Trigger an alarm condition in CFC; confirm that WinCC Alarm Logging receives and displays the alarm.

Limitations and Operational Precautions

Redundancy Testing Limitation: Do not use S7-PLCSIM Classic to validate high-availability failover sequences. Redundancy validation requires physical S7-400H hardware or SIMIT Virtual Controller.
Process Timing Sensitivity: Fast PID control loops or batch dosing algorithms with sub-second step transitions may experience timing jitter in PLCSIM due to Windows operating system scheduling.
Commercial Accuracy Notice: Ensure that standalone S7-PLCSIM licenses (6ES7841-0CC05-0YA5) or PCS 7 Engineering bundles (6ES7651-5AA58-0YA0) are validated against official Siemens ordering data.

Engineer FAQ

What is the latest version of PLCSIM for STEP 7 V5.5 and PCS 7?

The latest version is S7-PLCSIM V5.4 SP5 Update 1, which provides full 64-bit compatibility with Windows 7 and Windows 10 Enterprise LTSB.

Can S7-PLCSIM simulate an S7-400H redundant system?

No. S7-PLCSIM Classic can only simulate a single standalone CPU. It cannot execute H-redundancy synchronization or simulate fiber-optic sync link breaks.

Why does WinCC show disconnected tags when connected to PLCSIM?

The WinCC channel unit logical device name must be set to 'PLCSIM.TCPIP.1' in Tag Management System Parameters, and the PG/PC Interface must be set to PLCSIM(TCP/IP).

Can I connect PLCSIM Classic to a physical remote HMI station across a network?

By default no. PLCSIM Classic operates on local loopback. Bridging PLCSIM to physical networks requires specialized tools like NetToPLCSim or migrating to S7-PLCSIM Advanced.