Connecting S7-PLCSIM to WinCC OS Server Across Distributed Physical Computers

Classic S7-PLCSIM V5.4 communicates solely via internal shared memory interfaces and cannot natively bind to physical network adapters to listen for remote network connections from an external WinCC OS Server computer. To connect WinCC OS Runtime running on a separate physical machine to S7-PLCSIM on an Engineering Station (ES), you must employ a network forwarding bridge such as NetToPLCSim, migrate to S7-PLCSIM Advanced, or co-locate WinCC OS Runtime locally on the ES. Additionally, ensure the WinCC project operating mode is configured as 'Standard' rather than 'Service' mode to permit interactive simulation communication.

Architecture of S7-PLCSIM Local Virtual Bus

Siemens S7-PLCSIM V5.4 (bundled with SIMATIC PCS 7 V8.x and V9.0) simulates the execution of S7-400 and S7-300 CPUs by emulating controller memory, accumulator registers, timers, and cyclically executing downloaded program blocks. Unlike real hardware controllers, classic S7-PLCSIM does not control the physical network interface card (NIC) of the host computer.

Instead, S7-PLCSIM establishes a local virtual communication layer accessible only via local PG/PC interface access points such as PLCSIM(MPI), PLCSIM(PROFIBUS), PLCSIM(ISO), and PLCSIM(TCP/IP). These virtual adapters use Windows inter-process communication (IPC) and internal memory pointers, making them completely invisible to other physical computers on the local area network.

Limitations of Cross-Computer Simulation with Onboard Tools

When an engineer deploys a distributed multi-station client-server architecture (e.g. ES, OS Server, and OS Client), attempting to point the remote OS Server to an S7-PLCSIM instance running on the ES fails immediately because:

No Network Socket Listening: S7-PLCSIM V5.4 does not bind to TCP port 102 (ISO-on-TCP) on the ES physical NIC.
PG/PC Interface Restriction: The OS Server's PG/PC Interface contains real network adapters (e.g., CP 1623 or Intel Industrial Ethernet), but does not have a PLCSIM endpoint because PLCSIM is not installed or executable as a distributed network service.
S7 Protocol Routing: Standard S7 routing via Step 7 NetPro requires a physical hardware router or an S7 CPU configured with dual subnets, which cannot route into a local memory-only PLCSIM instance.

Integration Architecture Using NetToPLCSim

When testing multi-station architectures without physical S7-400 controllers, the third-party open-source utility NetToPLCSim bridges the physical network adapter and S7-PLCSIM:

Stop Conflicting Services: Windows services utilizing TCP port 102 (such as s7oiehsx64 / SIMATIC IEPG Help Service) must be temporarily halted so NetToPLCSim can bind to port 102 on the ES network card.
Configure IP Mapping: In NetToPLCSim, map the ES physical network IP address to the virtual S7-PLCSIM IP address assigned in the STEP 7 HW Config.
Configure Remote OS Server: On the remote WinCC OS Server, configure the S7 Protocol Suite connection (Industrial Ethernet or Named Connections) pointing directly to the ES physical IP address with Rack 0, Slot 2 (or Slot 3 for redundant controllers).

WinCC Operating Mode Configuration: Standard vs Service Mode

WinCC projects can run in two distinct operating modes under project properties:

Standard Mode: WinCC Runtime executes within the interactive user desktop session. Graphic runtime windows and communication channels initialize under the logged-on Windows credentials.
Service Mode: WinCC Runtime executes as a background Windows service without requiring an interactive user logon. This mode prevents direct desktop IPC and blocks local simulation hooks.

To simulate communication reliably, the WinCC project properties on the OS Server must be configured to Standard Mode.

Technical Comparison of Simulation Architectures

The table below compares cross-machine simulation approaches for SIMATIC PCS 7 systems:

Simulation ApproachNetwork SupportHost ConfigurationMulti-Station OS SupportSiemens Approval StatusClassic S7-PLCSIM V5.4 (Local)Local IPC only (No LAN)Single ES / Single PCNo (Local OS Runtime only)Official standard toolS7-PLCSIM V5.4 with NetToPLCSimFull TCP/IP (Port 102)ES + External PCYes (Remote OS Server connects)Third-party utilityS7-PLCSIM Advanced (V2.0+)Virtual Ethernet SwitchES / HypervisorYes (Promiscuous mode IP support)Officially released for TIA/S7-1500SIMIT Simulation PlatformVirtual Controller (VC)Dedicated Virtual ServerYes (Emulates full AS 410 station)Officially released for PCS 7

Verification

Follow this protocol to verify distributed simulation communication:

On the ES, start S7-PLCSIM and download the AS hardware configuration and CFC charts.
Verify S7-PLCSIM CPU status transitions to RUN-P.
Launch NetToPLCSim as Administrator, start the capture server, and confirm port 102 is successfully bound.
On the remote OS Server, open WinCC Explorer and start WinCC Runtime.
Open WinCC Channel Diagnosis (WinCCChnDiag.exe), inspect the SIMATIC S7 Protocol Suite connection, and confirm the connection status is green with status OK.

Limitations and Operational Precautions

Note the following constraints when executing multi-station simulations:

Never Deploy on Production Networks: Running NetToPLCSim on a live production control network can cause IP conflicts or intercept telegrams intended for real S7-400 controllers.
Port 102 Conflict Resolution: When returning the ES to normal operation, terminate NetToPLCSim and restart the SIMATIC IEPG Help Service to allow standard engineering downloads.
High-Speed Cyclic Performance: Virtual network bridging introduces network jitter and cannot benchmark real-time deterministic performance of CP 1623 communication.

Engineer FAQ

Can I install S7-PLCSIM on the dedicated OS Server to connect locally?

While S7-PLCSIM can be installed on an OS Server with engineering software, the OS Server would simulate its own local PLC instance. It would not connect to the PLC instance running on the ES unless bridged via network translation tools.

Why does WinCC in Service Mode fail to communicate with simulation tools?

Service Mode executes WinCC background processes in a non-interactive Windows session (Session 0). S7-PLCSIM V5.4 and certain desktop simulation tools rely on user session interactive memory spaces, blocking communication across session boundaries.

What is the official Siemens solution for distributed PCS 7 virtual testing?

The officially supported Siemens solution for distributed PCS 7 system simulation is SIMIT with the SIMIT Virtual Controller (VC) package, which fully emulates AS 410-5H controllers across physical network subnets.