Running an HMI panel project against a virtual PLC is the standard way to validate screen logic, tag connections, alarm behavior, and recipe handling before any physical hardware is wired. For the legacy SIMATIC environment built on STEP 7 V5.x and ProTool/Pro (later extended to WinCC Flexible), the virtual PLC is S7-PLCSIM and the HMI runtime talks to it over the local S7Online backplane through an MPI access point. This reference documents the complete procedure, parameter values, and known failure modes for that integration.
1. Prerequisites and Supported Versions
Before configuring the connection, verify that the host PC carries a compatible software stack. The classic toolchain consists of three products that must be installed in the order shown:
- STEP 7 V5.x (SIMATIC Manager). Supported baseline versions: V5.3 SP3 through V5.5 SP4. STEP 7 V5.5 is the most widely deployed for PLCSIM-based HMI testing.
- S7-PLCSIM V5.x. The last publicly released build is S7-PLCSIM V5.4 SP5, which runs on Windows XP SP3, Windows 7 SP1 (32-bit), and Windows Server 2003/2008. PLCSIM V5.4 requires STEP 7 V5.4 or higher and is licensed via the STEP 7 license key bundled with the SIMATIC package or a separately purchased PLCSIM-only license.
- ProTool/Pro V6.0 (SP2 or SP3) for OP/TP panels, or WinCC Flexible 2004 SP1 / 2005 / 2007 / 2008 for the integrated HMI engineering environment that replaced ProTool. The same MPI access point mechanism applies to both.
| Tool | Minimum Version | Recommended Version | Notes |
|---|---|---|---|
| STEP 7 (SIMATIC Manager) | V5.3 SP3 | V5.5 SP4 | Provides the S7Online access point and the PLCSIM MPI driver. |
| S7-PLCSIM | V5.3 | V5.4 SP5 | SP5 contains fixes for PLCSIM crash on Win7 and 64-bit hosts. |
| ProTool/Pro | V6.0 SP2 | V6.0 SP3 | SP3 fixes OPC/ProAgent integration and screen update issues. |
| WinCC Flexible | 2004 SP1 | 2008 SP3 | Same MPI mechanism, but configured under "Communication" in the project tree. |
| Windows OS | Windows XP SP3 | Windows 7 SP1 32-bit | PLCSIM V5.4 is not supported on 64-bit Windows; use VMware for 64-bit testing. |
Confirm that the S7-PLCSIM entry appears in Start » SIMATIC » S7-PLCSIM V5.4. If absent, reinstall the PLCSIM component from the STEP 7 setup under "SIMATIC Manager / S7-PLCSIM" and re-run the Automation License Manager to activate the PLCSIM license.
2. PG/PC Interface Configuration
The PG/PC interface is the Windows-level routing table that tells STEP 7 (and ProTool/WinCC Flexible runtimes) which device driver to use when no physical CP is present. The PLCSIM integration is achieved by selecting a virtual access point whose target is the PLCSIM process itself.
- Open SIMATIC Manager.
- From the menu bar select Options » Set PG/PC Interface.
- In the Access Point of the Application drop-down, choose S7ONLINE (STEP 7) → PLCSIM (MPI).
- Click Properties to inspect the MPI parameters. Defaults are acceptable for a single-node offline simulation:
- Transmission rate: 187.5 kbps (MPI default)
- Highest MPI address: 31
- Own MPI address: 0 (PG/PC)
- Click OK and confirm any warning about overriding the existing S7Online access point.
Repeat the same selection for the S7ONLINE access point used by WinCC Flexible if both tools are installed. The PLCSIM MPI driver is shared between the two products and is not product-specific.
3. Starting S7-PLCSIM and Loading the STEP 7 Project
- Start S7-PLCSIM V5.4 from the SIMATIC program group. The PLCSIM control panel appears; the CPU indicator initially shows "No project loaded".
- In SIMATIC Manager, open the S7 program (e.g. S7_Program) that you wish to simulate.
- From the menu select PLC » Download to Target System (or press Ctrl+L). Confirm that the target is the PLCSIM (MPI) instance detected at MPI address 2.
- After successful download, PLCSIM displays the simulated CPU in RUN-P. Use the PLCSIM panel toggle to switch to RUN, STOP, or MRES as needed for the test.
Verify the simulated CPU is reachable: in SIMATIC Manager select PLC » Monitor/Modify. The status bar should read Online - PLCSIM (MPI). If the status reads Offline, the S7Online access point was not redirected to PLCSIM, and the previous section must be revisited.
4. ProTool/Pro Controller Configuration
The ProTool/Pro project must declare the HMI's connection peer. This is set in the controller area of the project, not in the runtime.
- Open the ProTool/Pro project for the target panel (e.g. TP170A.ppc) in ProTool/Pro V6.0.
- In the project tree, expand Controller and select the controller (default name: PLC_1, type: SIMATIC S7 MPI).
- Open the Properties dialog and verify the following parameters:
| Parameter | Field in ProTool | Required Value | Comment |
|---|---|---|---|
| HMI station address | HMI Address | 1 | MPI address of the panel. Default 1. |
| PLC address | PLC Address | 2 | Must match the MPI address configured in HW Config for the S7 CPU. |
| Slot | Slot | 2 | Slot 2 for S7-300 CPU; slot 3 for S7-400 CPU. |
| Profile | Profile | MPI | Do not select Profibus-DP for PLCSIM unless the simulated CPU is configured for Profibus. |
| Baud rate | Network Parameters | 187.5 kbps | Must match the PG/PC interface baud rate. |
| Highest station address | Network Parameters | 31 | Default MPI bus address limit. |
| Online | Off-line check-box | UNCHECKED | This is the most common misconfiguration. With "off-line" enabled ProTool/Pro starts a local simulation that does not poll PLCSIM. |
Save the project. The controller dialog persists the values; re-verification is required only if the project is migrated from one panel series to another or copied between stations.
5. ProTool/Pro Runtime Network Parameters
The HMI runtime on the engineering PC is launched through the WinCC Flexible / ProTool Loader. For the PLCSIM connection, the runtime uses the same S7Online access point as STEP 7.
- From ProTool/Pro select File » Compile » Compile All. The compile output must report 0 Errors; warnings about unsupported objects can be acknowledged but should be reviewed.
- Select File » Download » Start RT (with Active Connection) (or the corresponding icon). The Loader is launched with the compiled project.
- Confirm the Loader status bar shows Connecting to PLC_1 via MPI ... followed by Connection established within 5 s.
For the on-board runtime (TP/OP panels), compile the project to the panel's backup format and transfer it with ProSave. The PLCSIM test loop uses the on-PC runtime exclusively; flashing a real panel is not part of the PLCSIM simulation.
6. Going Online and Verification Checklist
Use the following matrix to confirm a healthy PLCSIM ↔ ProTool session. Each item is observable from the engineering PC; no physical hardware is required.
| Check | Method | Expected Result |
|---|---|---|
| PLCSIM RUN state | PLCSIM panel CPU indicator | Green RUN, yellow RUN-P |
| PG/PC interface | SIMATIC Manager status bar | "Online - PLCSIM (MPI)" |
| HMI connection | ProTool/Pro Loader status bar | "Connection established to MPI/2" |
| Tag polling | ProTool tag diagnostics | Update rate < 1 s for boolean tags |
| Bit memory test | PLCSIM bit memory view ↔ ProTool output field | Value change visible on ProTool within 1 cycle |
| Alarm simulation | Trigger S7 program alarm from PLCSIM | Alarm appears in ProTool event log |
| Recipe round-trip | Download recipe from ProTool to PLCSIM DB | DB contents match in PLCSIM monitor view |
If the Loader shows Connection failed - check station address and baud rate, the most likely cause is that the S7Online access point was reverted to a real CP card. Re-run the procedure in Section 2.
7. WinCC Flexible Equivalent Procedure
WinCC Flexible (2004 SP1 onward) uses the same S7Online backplane but exposes the connection under a different menu path. The mapping from ProTool/Pro to WinCC Flexible is direct:
| ProTool/Pro field | WinCC Flexible field | Value for PLCSIM |
|---|---|---|
| Controller » PLC_1 » Address | Project tree » Communication » Connections » MPI » Station address | 2 |
| Controller » PLC_1 » Slot | Connections » MPI » Slot | 2 (S7-300) / 3 (S7-400) |
| Controller » PLC_1 » Profile | Connection type | MPI |
| Controller » PLC_1 » Network » Baud rate | Properties » MPI » Baud rate | 187.5 kbps |
| PG/PC interface selection | Options » Set PG/PC Interface (or via WinCC Flexible Control Panel) | S7Online (STEP7) → PLCSIM (MPI) |
The same procedure applies to WinCC V7.x (SCADA) and WinCC Professional (TIA Portal) when the runtime is configured to communicate with PLCSIM V5.4 (legacy) or PLCSIM V13/14/15/16 (TIA Portal). In the TIA Portal WinCC Professional case, the equivalent access point is PLCSIM S7-1200/S7-1500 and the simulated CPU's IP is 192.168.0.1 (default).
8. Troubleshooting Matrix
| Symptom | Likely Root Cause | Corrective Action |
|---|---|---|
| ProTool runtime shows "No connection" | Off-line check-box is enabled in ProTool controller | Uncheck the off-line check-box, recompile, restart RT. |
| ProTool runtime shows "No connection" | S7Online points to real CP card | Re-select S7Online (STEP7) → PLCSIM (MPI) in Set PG/PC Interface. |
| Loader reports "Wrong slot" | Slot set to 3 for S7-300 (or vice versa) | Correct slot to 2 for S7-300, 3 for S7-400. |
| Connection established but no tag updates | MPI address conflict (e.g. two CPUs at address 2) | Open HW Config and assign a unique MPI address to the simulated CPU. |
| PLCSIM crashes when ProTool starts | Incompatible PLCSIM/SP level | Upgrade to PLCSIM V5.4 SP5; install the latest STEP 7 SP. |
| Compile error: "Invalid S7 connection" | Controller type set to Profibus in ProTool but CPU is MPI | Change profile to MPI in the controller properties. |
| Connection works, alarms not visible | Alarm configuration uses S7 diagnostic events not enabled in PLCSIM | Switch to bit-triggered alarms in ProTool for PLCSIM testing. |
| Loader reports "License not found" | PLCSIM runtime license not activated | Run Automation License Manager; transfer the PLCSIM license to the local hard disk. |
9. Migration to TIA Portal Context
The procedure above applies to the STEP 7 V5.x and ProTool/Pro toolchain. For projects that have been migrated to TIA Portal V13 or later, the equivalent integration is between PLCSIM V13+ and WinCC Professional / Comfort Panel. The conceptual model is identical: the HMI runtime is pointed at a virtual access point that terminates in the PLCSIM process.
Key differences for TIA Portal:
- The default protocol becomes PROFINET over the local loopback rather than MPI; the simulated CPU's IP is 192.168.0.1 by default.
- The "off-line check-box" is replaced by a project-level "Simulation" toggle in WinCC Professional's RT settings.
- Slot is replaced by the "IO device / IO controller" PROFINET terminology; the slot value is implicit in the device configuration.
- PLCSIM V13 and later support S7-1200 and S7-1500 in addition to S7-300/400.
When migrating a ProTool project, use the ProTool/Pro -> WinCC Flexible converter for the first hop, then the TIA Portal migration tool to import the WinCC Flexible project. After migration, re-validate the connection against PLCSIM V13+ before touching the production PLC.
10. Field Commissioning and Safety Notes
Although the PLCSIM ↔ ProTool connection is purely virtual, several engineering hygiene rules still apply:
- Always load a consistent S7 program into PLCSIM; partial downloads can leave the simulated DBs at stale sizes and cause ProTool alarms to reference nonexistent tag bits.
- Disable the PLCSIM Pause function during automated HMI tests. Pausing freezes the simulated CPU scan; the HMI runtime will log a connection timeout that is easy to misdiagnose as a configuration error.
- Use the PLCSIM » Save Snapshot feature to capture a deterministic state for regression tests. The HMI screen and the snapshot can be replayed together to reproduce field-reported issues.
- PLCSIM V5.4 is not a real-time simulator. Tag update latency may be 100 ms to 2 s depending on host load. Do not derive worst-case HMI response-time measurements from PLCSIM.
- Do not run two PLCSIM instances with the same default MPI address on the same PC; the second instance will fail to start the S7Online driver. Either use a VM or assign different MPI addresses via HW Config.
11. Reference: Key Parameter Set Recap
| Parameter | Value |
|---|---|
| PG/PC access point | S7Online (STEP7) → PLCSIM (MPI) |
| MPI baud rate | 187.5 kbps |
| Highest MPI address | 31 |
| PG/PC MPI address | 0 |
| Simulated CPU MPI address | 2 |
| Simulated CPU slot (S7-300) | 2 |
| Simulated CPU slot (S7-400) | 3 |
| HMI station MPI address | 1 |
| ProTool profile | MPI |
| Off-line check-box | UNCHECKED |
For the official Siemens Knowledge Base article covering this topic, refer to entry 13283804 in the Siemens Industry Online Support portal. The S7-PLCSIM V5.4 SP5 user manual (entry 12405836) and the STEP 7 V5.5 programming manual (entry 18652056) provide the underlying specification for the MPI access point and the PLCSIM driver interface. For the ProTool/Pro V6.0 documentation set, see entry 13510815.
FAQ
Why does ProTool runtime show "No connection" even though STEP 7 connects to PLCSIM successfully?
The off-line check-box in the ProTool/Pro controller properties is enabled. Uncheck it, recompile the project (File » Compile » Compile All), and restart the runtime. ProTool then polls the S7Online backplane that STEP 7 uses, which is already pointing at PLCSIM.
Which MPI address and slot must I configure for the simulated S7-300 CPU?
Set the CPU MPI address to 2 (default in HW Config) and the slot to 2. For an S7-400 CPU, the slot is 3. The HMI station address is 1, and the PG/PC address is 0. All three MPI nodes must share a baud rate of 187.5 kbps.
Can I use the same setup for WinCC Flexible or WinCC Professional instead of ProTool/Pro?
Yes. WinCC Flexible 2004-2008 uses the identical S7Online (STEP7) → PLCSIM (MPI) access point, with the connection parameters entered under "Communication » Connections » MPI" in the project tree. For TIA Portal WinCC Professional, the equivalent is the PLCSIM V13+ PROFINET access point and the default IP 192.168.0.1.
What versions of PLCSIM and STEP 7 are still supported for ProTool integration?
S7-PLCSIM V5.4 SP5 paired with STEP 7 V5.5 SP4 is the latest supported combination for ProTool/Pro and WinCC Flexible 2008. The product line is in maintenance; new panels must be engineered with TIA Portal and PLCSIM V16+.
Why is the S7Online access point reverting to my real CP 5611 MPI card after each reboot?
STEP 7 stores the PG/PC interface selection in the registry under HKLM\SOFTWARE\Siemens\Automation\Step7\S7Online. Re-apply the PLCSIM MPI selection after any change to the physical CP configuration or after reinstalling the SIMATIC NET drivers. Use the "Set PG/PC Interface" dialog and confirm with "OK" to persist the change.