Simulating Fault-Tolerant S7-400H Controllers and WinCC Connections Using S7-PLCSIM

In SIMATIC PCS 7, S7-PLCSIM cannot simulate dual redundant S7-400H controller pairs simultaneously or establish fault-tolerant S7 'Named Connections'. S7-PLCSIM emulates only a single CPU instance (representing the Master CPU). To establish communication between WinCC OS Runtime and S7-PLCSIM for process graphics testing, open the AS-OS Compile dialog on the Engineering Station, change the connection type from 'Named Connections' to 'Industrial Ethernet' (or 'TCP/IP'), and set the WinCC Tag Management logical device name under TCP/IP to 'PLCSIM.TCPIP.1'.

Executive Summary

Testing supervisory graphics, alarm dynamics, and APL faceplates prior to commissioning high-availability SIMATIC S7-400H or CPU 410-5H automation systems is essential for verifying engineering quality. When engineers attempt to simulate a redundant H-system using S7-PLCSIM inside a virtual machine or engineering workstation, they frequently discover that while CFC charts download cleanly to PLCSIM, NetPro connections fail to download, and WinCC OS Runtime remains disconnected with greyed-out faceplates and deactivated tags.

This behavior is an architectural boundary of S7-PLCSIM (V5.4): PLCSIM is a single-node emulator incapable of replicating optical synchronization links, redundant rack hardware, or multi-path fault-tolerant Named Connections. This guide provides the complete workaround procedure to compile and re-route WinCC communication across standard Industrial Ethernet (TCP/IP) protocols into PLCSIM.TCPIP.1, enabling complete operator graphics and logic simulation.

Architecture and Fundamental Mechanics

The communication gap between physical S7-400H systems and S7-PLCSIM originates in the network transport layer:

Physical S7-400H Named Connections: In a production PCS 7 plant, S7-400H controllers communicate with WinCC OS Servers via 'Fault-tolerant S7 connections' (Named Connections). The connection endpoint utilizes dual communication paths (Path A and Path B) routed through CP 443-1 cards or internal PN interfaces. WinCC coordinates path redundancy through SIMATIC NET drivers (CP1623 / Softnet) and the Redundancy Data Manager.
S7-PLCSIM Architectural Limits: Standard S7-PLCSIM (V5.4 SP8) emulates only one S7-400 CPU core at a time. It cannot simulate optical sync modules, fiber tracking, or dual-rack redundancy arbitration. Crucially, S7-PLCSIM does NOT support the Named Connections protocol stack. Any attempt to download NetPro network connections configured as Named Connections to PLCSIM aborts with error codes.
The TCP/IP Communication Redirection: To establish communication between WinCC and PLCSIM, the connection must be simplified to a non-redundant Industrial Ethernet connection:
- In the AS-OS Compile wizard, the communication link is shifted from 'Named Connections' to 'Industrial Ethernet'.
- In WinCC Explorer > Tag Management > SIMATIC S7 Protocol Suite > TCP/IP, the communication driver's 'Logical Device Name' is redirected from the physical network adapter (e.g., CP1623(ISO)) to the virtual simulation interface: PLCSIM.TCPIP.1 (or PLCSIM.ISO.1).
- WinCC then bypasses physical Ethernet cards and streams read/write requests directly into PLCSIM shared memory.

Step-by-Step Implementation Procedure

Follow these steps to configure S7-PLCSIM with an S7-400H project and establish online connectivity with WinCC OS Runtime:

Launch S7-PLCSIM and Prepare for Single-CPU Emulation:
- On the Engineering Station, launch S7-PLCSIM (File > Open... or Start menu).
- In PLCSIM, verify the interface selection box: select PLCSIM(TCP/IP) (or PLCSIM(ISO) depending on network preference).
- Note: S7-PLCSIM emulates Rack 0 (Master CPU). Do not attempt to open a second PLCSIM instance for Rack 1.
Download Hardware and Program to PLCSIM:
- In SIMATIC Manager, open HW Config for the S7-400H station.
- Select 'PLC > Download to Module...'. In the target module dialog, select CPU 0 (Rack 0, Slot 3 or 4). Download the hardware configuration to PLCSIM.
- In SIMATIC Manager, select the Charts folder.
- Select 'PLC > Download...'. Select 'Entire program' and download the CFC program to PLCSIM.
- In PLCSIM, switch the operating mode switch from STOP to RUN-P.
Switch AS-OS Connection from Named Connections to TCP/IP:
- In SIMATIC Manager Component View, right-click the OS project (e.g., OS_SRV) and select 'Compile'.
- In the AS-OS Compile Wizard, advance to the 'Select the network connection' step.
- Under 'Connection', locate the S7-400H connection entry.
- By default, it is set to Named Connections. Click the connection dropdown and change it to Industrial Ethernet (or TCP/IP).
- Complete the compile wizard ('Compile Changes' or 'Entire OS').
Reconfigure Logical Device Name in WinCC Explorer:
- Open the OS project in WinCC Explorer.
- In the navigation pane, expand 'Tag Management' > 'SIMATIC S7 Protocol Suite'.
- Right-click the 'TCP/IP' channel unit (or 'Industrial Ethernet') and select 'System Parameter'.
- Switch to the 'Unit' tab.
- In the 'Logical device name' dropdown, select PLCSIM.TCPIP.1 (or PLCSIM.ISO.1).
- Click 'OK'.
Activate WinCC Runtime and Test Simulation:
- Click 'Activate' in WinCC Explorer to launch WinCC Runtime.
- Open WinCC Channel Diagnosis (WinCCChannelDiagnosis.exe):
- Verify that under 'TCP/IP', the connection reports 'State: OK' and counters increment.
- Open process mimic graphics: confirm that block icons and faceplates show live process values and respond to mouse clicks.

Verification

In S7-PLCSIM, observe cyclic execution (RUN indicator is solid green, no cycle timeout stops).
In WinCC Runtime, open a motor faceplate (MotL): toggle from Auto to Manual, press 'Start', and verify that the motor icon changes from grey (stopped) to green (running).
Open a CFC chart in SIMATIC Manager and click 'Test Mode' (glasses icon): verify that online values in CFC match the numerical readings on the WinCC faceplate in real time.
Check WinCC Alarm Logging: verify that simulated process alarms and operator input messages appear correctly in the alarm banner.

Limitations and Operational Precautions

Before deploying the final project to physical site hardware, you MUST switch the AS-OS connection back to 'Named Connections' and recompile the OS; failing to do so will leave the physical OS servers unable to establish fault-tolerant redundant communication with the live S7-400H CPUs. S7-PLCSIM cannot simulate fiber sync cable breaks or bumpless H-switchovers; for high-fidelity hardware redundancy simulation, deploy SIMIT Virtual Controller (VC) or SIMIT Unit hardware. Software licenses and SIMIT simulation options should be validated with an authorized Siemens distributor or the Siemens Industry Mall.

Engineer FAQ

Can S7-PLCSIM simulate two H-CPUs with redundancy switchovers?

No. Standard S7-PLCSIM V5.4 simulates only a single S7-400 CPU instance and cannot simulate optical synchronization links or redundant switchover mechanisms.

Why did NetPro fail to download to PLCSIM?

NetPro aborts because PLCSIM cannot instantiate the complex fault-tolerant S7 connection drivers required for Named Connections.

What must I remember to do before downloading to physical plant hardware?

You must change the AS-OS compile connection back to 'Named Connections', reset the WinCC logical device name to the physical network card (e.g., CP1623(ISO)), and recompile the OS.

What simulation software supports full redundant CPU 410-5H simulation?

Siemens SIMIT Simulation Platform with SIMIT Virtual Controller (VC) supports multi-controller and redundancy emulation.

Does S7-PLCSIM require a separate license in PCS 7?

S7-PLCSIM is included with the PCS 7 Engineering Station license bundle, but requires an active S7-PLCSIM license key in Automation License Manager.