Connect WinCC Flexible to PLCSIM: MPI, Profibus and Ethernet Setup

WinCC Flexible ES and the WinCC Flexible Runtime can be run against S7-PLCSIM instead of a physical S7-300, S7-400 or ET 200S CPU. This lets you validate HMI screens, tag connections, alarm flows and recipe handling entirely on a development PC before commissioning. The integration uses a virtual bus inside the STEP 7 project, so the panel and PLC exchange data on the same simulated network segment that STEP 7 builds when the S7-PLCSIM module is started.

This reference covers the three supported transport methods (simulated MPI, simulated PROFIBUS, and simulated Ethernet/TCP), the software matrix that gates them, the PG/PC interface selection that determines which simulated channel becomes active, and the field-proven checks that confirm the link is actually carrying tags before you trust the screens.

1. Why Run WinCC Flexible Against PLCSIM

PLCSIM loads the compiled STEP 7 program (the S7 program in the S7 container) into a virtual PLC that runs as a Windows process. The WinCC Flexible Runtime Simulator (RT) can attach to that process as if it were a real panel, so:

• You validate I/O field references, button actions, screen navigation, and alarm acknowledgements without powering an MPI/PROFIBUS/Ethernet cable plant.
• You test process faults by forcing inputs in the PLCSIM variable table (VAT) and watching the panel react.
• You reproduce customer-reported issues offline on a laptop, which is invaluable for travel-light commissioning.
• You accelerate classroom and lab training, since one PC can host STEP 7, PLCSIM, WinCC Flexible ES, and the RT simulator simultaneously.

The combined solution is sometimes referred to as the SIEMENS HMI/PLC simulation bundle or the STEP 7 + WinCC Flexible integration. It is officially supported by Siemens as long as the package versions are matched to a compatible Windows operating system.

2. Prerequisites and Software Matrix

Before any cable-less integration works you must align four version axes: STEP 7, S7-PLCSIM, WinCC Flexible, and the Windows host OS. A mismatch on any axis typically results in WinCC Flexible showing Connection failure with the diagnostic buffer of PLCSIM listing 0x001E / 0x0001 (object management error).

The same matrix is published on the Siemens automation support portal under entry 22645302 for STEP 7 V5.4 and 24309218 for the cross-product compatibility list. Always verify the entry ID against your installed Service Pack level before commissioning.

2.1 Licensing

• STEP 7 V5.x requires a valid V5.4 or V5.5 license (floating or single).
• S7-PLCSIM V5.4 / V5.5 ships with STEP 7 Professional 2010 or is added as a separate authorising license (6ES7 841-0CC05-0YA5 for V5.4, 6ES7 841-0CC06-0YA5 for V5.5).
• WinCC Flexible ES is required to compile the flexible project; the WinCC Flexible Runtime Simulator activates automatically with the ES license for development use.

3. Architecture and Communication Topology

All three transport methods use the same logical structure: STEP 7 acts as the bus server, S7-PLCSIM terminates the CPU side, and WinCC Flexible Runtime terminates the HMI side. The transport bits (MPI/PROFIBUS/Ethernet) are abstracted by the SIMATIC interface so that the panel configuration in WinCC Flexible does not change — you simply pick the connection in the HMI tag editor and the bus selection in the PG/PC interface controls which simulated channel carries it.

The PG/PC interface dialog in Control Panel > Set PG/PC Interface is the routing layer. It exposes three SIMATIC Net Application Access Points named S7ONLINE pointing at the various PLCSIM adapters.

4. Build an Integrated STEP 7 + WinCC Flexible Project

The integration works only when WinCC Flexible is embedded inside the STEP 7 project. A standalone WinCC Flexible project cannot reach a PLCSIM instance because it lacks the shared station/configuration database.

1. Open SIMATIC Manager and create a new project (File > New Project).
2. Insert an S7-300 or S7-400 station (Insert > Station > SIMATIC 300/400 Station). For an MP370 touch test a 317-2 PN/DP or 315-2 DP/PN is typical.
3. Open HW Config and configure the CPU with the rack you intend to virtualise. Note the MPI/PROFIBUS/Ethernet interface settings — they will be picked up automatically by PLCSIM.
4. Insert an HMI station matching the physical panel you are emulating (e.g., MP370 Touch). For Runtime-only testing, select the WinCC Flexible Runtime device.
5. Right-click the HMI station > WinCC Flexible > Configure to launch the integrated WinCC Flexible ES inside STEP 7.
6. In WinCC Flexible, open Project > Transfer > Transfer Settings; on the Channel tab pick Ethernet, PROFIBUS, or MPI and enter the IP address / PROFIBUS address / MPI address of the CPU as configured in HW Config.
7. Compile the WinCC Flexible project and save.

Save the integrated project before the next step — closing WinCC Flexible without saving causes the HMI station link inside STEP 7 to break.

5. Method 1 — Simulated MPI (Default Path, All Versions)

MPI was the first method supported and still works in every PLCSIM release because MPI is the channel used internally by STEP 7 for online functions.

5.1 CPU configuration

• Open HW Config, double-click the CPU, Properties > MPI.
• MPI address = 2 (default, matches PLCSIM).
• MPI baud rate = 187.5 kbps (default). PLCSIM only supports 187.5 kbps for MPI; do not change it.
• Highest MPI address = 31 (default).

5.2 PG/PC interface

1. Open Control Panel > Set PG/PC Interface.
2. For Application Access Point S7ONLINE select PLCSIM(MPI).
3. Click Properties — the MPI address of the PG/PC should be set to 0 (auto) or a unique station number not used by the CPU.
4. Close with OK — Windows will warn that the change takes effect after the next STEP 7 restart.

5.3 Start sequence

1. In SIMATIC Manager, right-click the S7 station > PLC > Download — confirm Target system: PLCSIM.
2. S7-PLCSIM opens in a new window showing the CPU scan. If prompted, set MPI to 2 (it should auto-detect from the downloaded HW Config).
3. Switch the CPU to RUN-P using the small RUN/STOP switch on the PLCSIM window.
4. In the integrated WinCC Flexible project, click Start Runtime (the small triangle icon) or press F5.
5. The Runtime opens the configured panel and immediately begins polling tags over the simulated MPI bus.

6. Method 2 — Simulated PROFIBUS (PLCSIM V5.4 SP5+)

PROFIBUS support arrived in PLCSIM V5.4 SP5 and is required for panel projects originally targeted at DP-capable panels such as the MP 270B or OP 270.

6.1 CPU configuration

• Open HW Config, double-click the DP interface of the CPU, Properties > PROFIBUS.
• Set address = 2 and baud rate = 1.5 Mbps. PLCSIM emulates PROFIBUS at 1.5 Mbps maximum; do not exceed it.
• Operate the bus in DP-Master or DP-Slave as the project requires.

6.2 PG/PC interface

1. Open Set PG/PC Interface.
2. Set S7ONLINE to PLCSIM(PROFIBUS).
3. In Properties, set the PG/PC PROFIBUS address to 0 (or any unused address 1…126) and keep the baud rate at 1.5 Mbps.

6.3 NetPro cross-check

Open NetPro, select the PROFIBUS subnet, and confirm:

• The CPU's DP master interface is connected to the same PROFIBUS subnet as the HMI station.
• The HMI station has a PROFIBUS node assigned with the same bus parameters as the CPU (1.5 Mbps, profile DP).

If the WinCC Flexible Runtime still shows no connection, recompile the HMI station (Right-click HMI station > Compile) — NetPro generates the S7 routing tables for the runtime, and a stale build is the single most common cause of PROFIBUS simulation failure.

7. Method 3 — Simulated Ethernet/TCP (PLCSIM V5.5+)

TCP/IP was added in PLCSIM V5.5 and is the preferred path for OP 170/270/277 and Comfort Panel retrofits because modern panels default to PROFINET/TCP.

7.1 CPU configuration

• Open HW Config, double-click the PN interface of the CPU.
• Assign IP address 192.168.0.2, subnet mask 255.255.255.0, router not required.
• Ensure the Ethernet interface is enabled and assigned to the same Ethernet subnet the HMI station will use.

7.2 PG/PC interface

1. Open Set PG/PC Interface.
2. For S7ONLINE select PLCSIM(TCP/IP).
3. The TCP/IP entry uses the Windows loopback adapter — no real NIC is required, but the loopback must be enabled in Device Manager if it was disabled.

7.3 WinCC Flexible connection settings

Open Project > Transfer > Transfer Settings in the integrated WinCC Flexible project and set:

• Channel: Ethernet
• PLC IP address: 192.168.0.2 (must match the CPU PN interface)
• Connection mode: S7-300/400 (ISO-on-TCP / TCP native)
• Port: 102 (default for S7 communication)

Click Check connection — the dialog must report Connection established. If it returns timeout, verify the Windows firewall rule Allow inbound on TCP 102 — on Windows 7+ the rule is not present by default and must be created manually.

8. PG/PC Interface Reference Table

The PG/PC interface is the routing layer between STEP 7, PLCSIM, and the WinCC Flexible Runtime. Each bus type requires the corresponding SIMATIC Net access point.

If the entry PLCSIM(TCP/IP) is missing from the list, the SIMATIC Net installation included with STEP 7 is too old; install the matching version from the STEP 7 V5.5 DVD or the SIMATIC Net PC Software V8.x DVD.

9. NetPro Verification Checklist

NetPro is the canonical place to confirm that the panel and the PLC share a consistent route. Always run through this list after a project edit:

1. Open NetPro from SIMATIC Manager (Options > NetPro).
2. Click the HMI station — its connection row must show an active S7 connection (green dot).
3. Right-click the connection > Object Properties > Connection. Verify the partner matches the PLC CPU slot and rack.
4. Confirm the connection type field shows S7 connection (not S7 connection (unspecified)).
5. Select Network > Verify all connections — the status bar must report 0 errors.
6. If errors appear, re-run PLC > Compile and Download Objects in SIMATIC Manager.

10. Runtime Verification Steps

Once both PLCSIM and WinCC Flexible RT are running, validate the link with this sequence:

1. In PLCSIM, open the variable table (VAT) for the project and add a tag (e.g., DB1.DBD0).
2. Force the tag to a known value (e.g., 123) using the Modify button.
3. In the WinCC Flexible Runtime, open the screen containing the I/O field tied to DB1.DBD0. The value 123 must appear within two polling cycles.
4. Reverse the test — enter a new value in the I/O field on the panel and confirm PLCSIM updates the VAT accordingly.
5. Trigger a programmed alarm in PLCSIM by toggling a bit assigned to an alarm line; confirm the alarm appears in the Runtime alarm view.

If step 2 or 3 fails, the connection is partial. The most useful single diagnostic is the PLCSIM diagnostic buffer: PLC > Module Information > Diagnostic Buffer. Look for entries with ID 0x001E (object management) or 0x0001 (connection aborted).

11. Troubleshooting Matrix

12. Performance and Field Tips

• Polling rate: the WinCC Flexible Runtime polls tags every 1 s by default. Lower the acquisition cycle to 250 ms in Project > Properties > Cycles if you simulate fast process changes; PLCSIM can sustain ~5 k tags/s on a Core i5.
• Connection count: PLCSIM V5.5 limits each CPU to 16 simultaneous S7 connections. Each panel uses one connection; limit yourself to 12–14 panels per simulated CPU to leave headroom for STEP 7 online.
• Multiple panels: simulate two MP 370 panels against the same PLCSIM by inserting a second HMI station in STEP 7 and giving it a unique HMI connection. Both Runtime windows can run concurrently.
• Recipe / archive tests: point WinCC Flexible recipe paths at a local folder (C:\SimRecipes) and PLCSIM data blocks at DB100+; that way restart of PLCSIM does not wipe your test data.
• Snapshot save: in PLCSIM use File > Save Snapshot to capture the CPU state before each test scenario; you can then roll back to known conditions in seconds.
• Watch the diagnostic buffer: never close the PLCSIM window while WinCC Flexible RT is still polling — it will log a flood of connection errors that obscure the real failure when you re-test.

13. Migrating Older MPI-Only Setups to TCP/IP

Many long-running MP 270B / OP 270 projects still configure MPI by default. With PLCSIM V5.5+ you can switch to TCP without rewriting HMI logic:

1. In HW Config, add an Ethernet interface to the CPU (CP 343-1 Lean or use the integrated PN port for S7-300 PN/DP CPUs).
2. Assign a free IP address (e.g., 192.168.0.2 / 255.255.255.0).
3. In WinCC Flexible, open Project > Transfer > Transfer Settings, change the Channel from MPI to Ethernet, set the IP and port 102, then recompile.
4. In NetPro add an Ethernet subnet to the S7 station and connect the new CP/PN port to it. Connect the HMI station to the same subnet.
5. Change PG/PC interface to PLCSIM(TCP/IP), restart PLCSIM, and re-test.

This conversion is also the recommended pre-step before exporting the project to TIA Portal, because TIA Portal projects almost always target PROFINET.

14. Mini-Reference of Useful Register / Address Locations

15. FAQ