Multi-User Engineering Workflows: Sharing S7-PLCSIM Simulation Sessions Across Multiple ES Stations

In SIMATIC PCS 7 Multi-User Engineering, S7-PLCSIM Classic (v5.4) cannot be shared across a physical network natively because it is a single-node desktop application that communicates exclusively via local shared memory and named pipes ('PC Internal.local.1'). A secondary remote Engineering Station (ES) on the LAN cannot target PLCSIM over IP browsing. To allow multiple engineers to work concurrently against a single simulated controller, teams must deploy console takeover tools (such as VNC), utilize the enterprise SIMATIC SIMIT simulation platform with Virtual Controllers, or route network packets using specialized gateway utilities like NetToPLCSim.

Architecture of S7-PLCSIM Classic and Local Memory Binding

In SIMATIC PCS 7 engineering environments, Multi-User Engineering enables engineering teams to collaborate simultaneously on a centralized Multi-project stored on a master Engineering Station (Server ES):
* Decoupled Development: Engineer A configures plant hierarchy charts for Unit 1, while Engineer B configures charts for Unit 2 on a client ES.
* The S7-PLCSIM Simulation Engine (6ES7841-0CC05-0YA5):
During software staging and factory acceptance testing (FAT), S7-PLCSIM emulates the memory, execution cycles, and I/O image of an S7-400 or CPU 410 controller.
* The Local Named Pipe Binding:
S7-PLCSIM Classic was architected strictly as a local software process (s7wlapxb.exe). It binds its communication interface to the local Windows kernel memory using the access point PC Internal.local.1 (or local virtual MPI/DP/IP loops). It does not open a real TCP/IP listening socket on the host machine's physical network adapter.

Why PLCSIM Rejects Remote Network Access in Multi-User Projects

When Engineer B on an external client ES attempts to download a CFC chart to the S7-PLCSIM instance running on Engineer A's master ES:
* The Communication Failure:
SIMATIC Manager on Engineer B's PC broadcasts S7 communication requests across the physical LAN targeting the simulated CPU's IP address.
* TCP Port 102 Rejection:
Because S7-PLCSIM does not bind to the physical Ethernet NIC's TCP port 102 (ISO-on-TCP, RFC 1006), the host operating system returns an immediate TCP reset (RST) or drops the packet.
* The RDP Limitation:
Attempting to circumvent this using standard Windows Remote Desktop (RDP) multi-session fails because SIMATIC Manager and PCS 7 database engines (s7tgtopx.exe) strictly prohibit concurrent multi-user execution on the same operating system instance, blocking dual RDP logins.

Solution 1: Console Takeover via VNC / Remote Access Tools

The simplest, fully compliant, zero-cost workflow for multi-user commissioning utilizes Console Session Mirroring:

How It Operates:
PLCSIM runs locally on the Master ES. Instead of attempting to bridge network packets, the remote engineer takes over the active physical console session (Session 0) using industrial VNC tools (such as RealVNC, TightVNC, or UltraVNC).
Benefits:
Does not spawn separate Windows terminal sessions (avoiding SIMATIC database locks).
Engineer B sees the exact active SIMATIC Manager, CFC charts, and PLCSIM diagnostic window running on the master PC.
Constraint:
Only one engineer can interact with the screen at a time, requiring verbal coordination during shared testing sessions.

Solution 2: SIMATIC SIMIT Simulation Platform and Virtual Controllers

For true concurrent, plant-wide multi-user testing in large industrial projects, Siemens provides the SIMATIC SIMIT Simulation Platform (6DL8913-0AK00-0AB5):

The Virtual Controller (SIMIT VC):
SIMIT does not rely on desktop PLCSIM. It provides emulated SIMIT Virtual Controllers that execute the identical firmware and compiled code of S7-400, S7-400H, and CPU 410-5H controllers.
Network-Accessible Simulation:
SIMIT Virtual Controllers open authentic TCP/IP listening ports on the simulation server's physical network adapters.
True Multi-Client Access:
Engineer A on ES 1, Engineer B on ES 2, and redundant WinCC OS Servers can all connect across the physical LAN simultaneously. Engineers can download CFC charts, test interlocks, and run dynamic process simulations concurrently without interference.

Solution 3: Network Packet Bridging via NetToPLCSim (Testing Staging)

In staging environments where SIMIT is not available, engineers frequently deploy the utility NetToPLCSim:

Operational Mechanism:
NetToPLCSim is a lightweight packet proxy that binds to the physical network card's TCP port 102 on the machine running PLCSIM. When incoming S7 telegrams arrive from remote ES stations across the LAN, NetToPLCSim captures the packets and forwards them locally into PLCSIM's internal named memory pipe.
Enabling Multi-ES Download:
Remote engineering stations point their target connection to the IP address of the master PC. NetToPLCSim transparently routes the downloads and online monitoring frames into PLCSIM.
Precaution:
NetToPLCSim is an open-source community tool. While highly effective for testing, it is not officially supported by Siemens Technical Support.

Comparison Table: Multi-User Simulation Deployment Methods

The following table compares the different approaches for sharing simulation environments across multiple engineers:

Evaluation DimensionConsole VNC SessionSIMATIC SIMIT PlatformNetToPLCSim UtilityStandard Remote Desktop (RDP)Supported Users1 active at a time (Shared screen)Unlimited concurrent engineersMultiple concurrent engineersFails (Database lock)Network IP RoutingLocal only (video streaming)True native LAN TCP/IPBridged LAN TCP/IPMultiple session conflictRedundant S7-400HSingle CPU emulation onlyFull redundant H-system syncSingle CPU emulationNot supportedProcess ModelingNone (manual forcing)Full thermodynamic physicsNone (manual forcing)Not supportedLicensing RequirementFree VNC softwareSIMIT License (6DL8913-...)Free utilityWindows Server CALSiemens QualificationFully compliant workflowOfficial Siemens Digital TwinUnofficial testing toolExplicitly UnreleasedRecommended ScopeSmall commissioning teamsLarge enterprise FAT testingOffline test benchesDo not deploy

Step-by-Step Procedure to Establish Multi-User Simulation Workflows

Follow this verified engineering procedure to configure a collaborative multi-user simulation environment:

Method A: Implementing Console VNC Takeover (Standard FAT):
1. On the Master ES hosting the multi-project, install an industrial VNC server (e.g., UltraVNC).
2. Configure the VNC server to attach strictly to Display 0 / Console Session.
3. Launch S7-PLCSIM on the Master ES; open CPU and set to RUN-P.
4. On the remote client ES, launch VNC Viewer and connect to the Master ES IP address.
5. Both engineers can now monitor CFC charts, inspect PLCSIM registers, and test faceplates collaboratively.

Method B: Configuring SIMIT Virtual Controllers (Enterprise FAT):
1. On the simulation server, launch SIMATIC SIMIT.
2. Create a new simulation project and add a Virtual Controller (VC) component.
3. Assign the target S7-400 CPU IP address and subnet to the Virtual Controller network adapter.
4. Start the SIMIT simulation.
5. From any engineering station on the network, open SIMATIC Manager, select the AS, and click Download to PLC.
6. The download executes over standard PROFINET/IP directly into the SIMIT Virtual Controller.

Verification

Verify that multi-user simulation executes reliably:
1. In SIMATIC Manager on the client ES, initiate an online connection (Ctrl+D Module Information); verify that the dialog displays the simulated CPU state.
2. Open a CFC chart on the client ES and toggle Test Mode (online); verify that dynamic variables update smoothly without communication timeout dialogs.
3. Trigger an analog alarm in the simulated logic; confirm that the alarm appears simultaneously on connected WinCC OS client screens.
4. Verify that multiple engineers can edit separate charts in the multi-project without encountering file access collisions.

Limitations and Operational Precautions

RDP Session Prohibitions: Never use standard Windows Remote Desktop Protocol (RDP) to host multi-user PCS 7 engineering. RDP creates isolated virtual display sessions that desynchronize Sybase database transactions and corrupt the multi-project plant hierarchy.
CPU Scan Timing Accuracy: S7-PLCSIM executes on standard Windows threads and does not guarantee deterministic real-time scan times. Cycle execution times in PLCSIM are significantly slower than physical hardware; never use PLCSIM to tune fast closed-loop PID control loops.
Fail-Safe S7 F Systems: While S7-PLCSIM supports basic F-block execution, it does not fully simulate physical PROFIsafe communication timeouts. SIMIT is strictly required for formal fail-safe validation.
Commercial Accuracy: Simulation software—such as S7-PLCSIM (6ES7841-0CC05-0YA5) and SIMATIC SIMIT (6DL8913-0AK00-0AB5)—requires valid Automation License Manager licenses. Validate software options with an authorized Siemens distributor quotation.

Engineer FAQ

Can two engineers edit the same CFC chart simultaneously in Multi-User Engineering?

No. In PCS 7 Multi-User Engineering, individual CFC charts are locked by the engineer who opened them. However, Engineer A can edit Chart 1 while Engineer B edits Chart 2 within the same multi-project simultaneously.

Why does SIMATIC Manager give a database error when accessed via Windows RDP?

PCS 7 relies on local database locks (lock files in ApiLog). RDP multi-session creates concurrent process instances that attempt to access the same database records simultaneously, triggering fatal access violations.

Does S7-PLCSIM support Named Connections to WinCC?

Yes. When WinCC and PLCSIM run on the same computer, Named Connections communicate seamlessly via the local PC Internal.local.1 access point.

What is the difference between PLCSIM and SIMIT Virtual Controller?

PLCSIM is a single-user desktop emulator designed for basic logic testing. SIMIT Virtual Controller is an enterprise-grade digital twin platform supporting multi-node networking, high-speed physical modeling, and hardware-in-the-loop testing.