How to Download and Monitor S7-PLCSIM Across the Network Using NetToPLCsim

To download automation station programs and monitor S7-PLCSIM V5.4 across a local network without manually copying '.plc' files between computers, install the open-source utility NetToPLCsim on the remote machine running PLCSIM. Standard S7-PLCSIM only listens on local IPC pipes and cannot bind directly to external network adapters. NetToPLCsim captures incoming ISO-on-TCP telegrams on TCP port 102 of the network adapter and bridges them into the local PLCSIM instance, enabling remote engineering stations to compile, download, and test CFC charts online.

Communication Architecture of S7-PLCSIM V5.4

In SIMATIC PCS 7 simulation and software testing testbeds, engineers frequently distribute computing roles:
* Engineering Station (ES): Hosts SIMATIC Manager, CFC, and project source files.
* Remote Simulation / OS Server: Runs WinCC Runtime and simulates Automation Stations (S7-410H / S7-400) to test operator graphics, alarms, and scripts.

Historically, S7-PLCSIM V5.4 was designed strictly as a local single-PC simulation tool. It communicates with local applications via proprietary shared memory pipes (S7ONLINE = PLCSIM). It does not bind to physical Ethernet network interface cards (NICs) and does not listen on external network sockets.

As a result, engineers running PLCSIM on an OS Server were forced into cumbersome workarounds: downloading the PLC locally on the ES, saving the .plc memory snapshot file, manually copying it across the network to the OS Server, and loading it into PLCSIM. Crucially, this offline file-transfer workflow completely prevents the ES from establishing dynamic online connections to the simulated controller.

How NetToPLCsim Bridges ISO-on-TCP Across Network Adapters

NetToPLCsim is an established industrial simulation bridge that enables standard network communication for S7-PLCSIM:
1. Socket Interception: NetToPLCsim binds to TCP port 102 (the standard RFC 1006 / ISO-on-TCP port utilized by Siemens S7 communication) on the remote machine's physical network adapter.
2. S7 Protocol Translation: When the ES dispatches an S7 connection request or download command over Industrial Ethernet to the remote machine's IP, NetToPLCsim captures the raw ISO-on-TCP packets.
3. Local Loopback Routing: NetToPLCsim routes the payload into the local S7-PLCSIM shared memory interface using Siemens s7prosim.dll API calls.
4. Bidirectional Response: Controller responses are repackaged into ISO-on-TCP frames and transmitted back across the network to the ES.

Step-by-Step Configuration on Remote OS Server and Engineering Station

Follow this setup sequence to enable seamless network downloading:

Stop Conflicting Windows Port 102 Services:
* On the remote PC hosting PLCSIM, Windows may run the SIMATIC IEPG Help Service (s7oiehsx.exe), which binds to TCP port 102.
* Open Windows Services (services.msc), locate SIMATIC IEPG Help Service, and set its startup type to Manual and click Stop (NetToPLCsim can also automate this via its GUI).
Launch S7-PLCSIM on the Remote PC:
* Start S7-PLCSIM on the remote machine.
* Select the appropriate interface (e.g., PLCSIM(ISO) or PLCSIM(TCP/IP)).
Configure NetToPLCsim:
* Launch NetToPLCsim.exe with administrative privileges.
* Click Add.
* In the Station configuration dialog:
- Network IP Address: Select the IP address of the physical network card on the remote PC.
- PLCSIM IP Address: Click the browse button to automatically detect the running S7-PLCSIM instance.
- Rack / Slot: Enter the CPU rack (typically 0) and slot (typically 2 for S7-300 or 3/4 for S7-400; check HW Config).
- Click Start Server. Confirm that the status indicator turns green and displays RUNNING.
Download from the Engineering Station:
* On the ES, open SIMATIC Manager.
* Open Set PG/PC Interface. Ensure S7ONLINE is set to TCP/IP -> [Your Network Adapter].
* In HW Config or NetPro, ensure the CPU IP address matches the remote PC's IP, or use the "Accessible Nodes" / Direct IP download dialog.
* Initiate download: PLC -> Download. The ES will communicate across the Ethernet cable directly into PLCSIM.

Verification

On the ES, open a CFC chart and click the Test Mode (glasses) icon. Confirm that dynamic blue/yellow value bars populate in real time.
On the remote OS Server, open WinCC Channel Diagnosis. Confirm that Named Connections show an active connection to the simulated controller.
Modify a setpoint on the WinCC OS faceplate. Confirm that the new value appears immediately inside the live CFC chart on the ES.

Limitations and Operational Precautions

NetToPLCsim is designed for development and simulation testing; it must never be deployed on production networks controlling active physical machinery.
Only one application can bind to TCP port 102 on a single network adapter. If multiple simulated CPUs are required on a single physical host, configure virtual secondary IP addresses or run S7-PLCSIM Advanced.
Ensure Windows Firewall on the remote PC allows inbound TCP port 102 traffic.

Engineer FAQ

Can NetToPLCsim simulate S7-400H redundant CPU pairs?
Yes, but because PLCSIM V5.4 simulates a single CPU core, redundant H-system failover cannot be simulated. S7-400H projects simulate as a standalone CPU.
Does NetToPLCsim require Siemens licenses?
NetToPLCsim is an open-source tool released under GNU LGPL. It requires a valid Siemens license only for the underlying S7-PLCSIM and STEP 7 software.
Why does NetToPLCsim report 'Port 102 is already in use'?
The Siemens IEPG Help service or a local WinCC communication channel is already listening on port 102. Stop the service in services.msc before starting NetToPLCsim.

Technical References

NetToPLCsim Documentation and Network Architecture Guide.
SIMATIC S7-PLCSIM V5.4 Operating Manual (A5E00992393-01).
Siemens Industry Online Support Entry ID 109801081: Network Simulation Strategies for PCS 7.

Related Tags

PCS 7, PLCSIM, NetToPLCsim, Simulation, Networking, S7-400, Testing, Virtual Commissioning

How to Download and Monitor S7-PLCSIM Across the Network Using NetToPLCsim