Connecting a Physical Siemens HMI to PLCSIM via NetToPLCSim in TIA Portal

Engineers commissioning TIA Portal applications frequently need to validate HMI screen behavior, runtime scripts, and tag mapping against a virtual PLC before connecting to production hardware. The standard TIA Portal PLCSIM instance blocks external I/O on TCP/102 by design, so a physical SIMATIC Comfort Panel, KTP, or Basic Panel cannot discover the simulated S7-1200 or S7-1500. This article documents the supported and unsupported paths, the NetToPLCSim bridging workflow, exact IP/subnet/PG/PC interface settings, and a field-tested troubleshooting matrix for the most common failure modes.

1. Problem Statement and Symptoms

The PLCSIM instance integrated with TIA Portal V15.x, V16, V17, V18, and V19 is implemented as a local in-process simulation. It does not bind a network socket on the engineering station's physical adapter, and it refuses every S7 communication partner that is not the TIA Portal online dialog itself. The visible symptoms when an engineer attempts to use a real panel with the simulation are:

• Online > Accessible nodes in TIA Portal returns only the PLCSIM instance, never the physical HMI on Profinet/Ethernet.
• Project transfer to the Comfort Panel fails with "Device not found" or "Connection to partner could not be established".
• TIA Portal prevents a second Go online; the only online target available is the PLCSIM slot.
• The HMI runtime, once manually loaded, raises a connection fault: "Value could not be written to the PLC" or "Connection to PLC interrupted".

The same restriction applies in the opposite direction: an S7-PLCSIM cannot be paired with a physical HMI unless an external bridge (NetToPLCSim) or a licensed PLCSIM Advanced instance terminates the S7 protocol on TCP/102 of the engineering station.

2. Root Cause: Why Standard PLCSIM Is Local-Only

The integrated PLCSIM is a Windows process launched by S7-PLCSIM.exe as a child of the TIA Portal online subsystem. It uses a private inter-process channel rather than the ISO-on-TCP stack that real S7 CPUs publish on port 102. As a result, the simulation is not addressable by any peer on the network, including the Comfort Panel's runtime transfer service and the WinCC Runtime Advanced built into the panel.

PLCSIM Advanced is a separate product line that publishes the simulated CPU on a real or virtual network adapter using the same S7Comm or S7Comm-Plus (TLS) stack as a physical CPU, which is why external partners (a real HMI, a remote TIA Portal, a third-party SCADA) can connect to it. The trade-off is licensing cost and a reduced CPU support matrix.

3. PLCSIM vs PLCSIM Advanced Capability Matrix

The single most important fact for S7-1200 users: PLCSIM Advanced does not support the S7-1200 family. S7-1200 CPUs can only be simulated with the integrated PLCSIM, which means the only path to a physical HMI on an S7-1200 is the NetToPLCSim bridge described in this article.

4. NetToPLCSim Architecture

NetToPLCSim is an open-source utility (SourceForge project) that listens on TCP/102 of the engineering station's network adapter and proxies S7Comm/S7Comm-Plus traffic to the local PLCSIM instance. From the panel's perspective, the PC looks like a CPU with the IP address assigned to the PC adapter. The simulation still runs locally in the TIA Portal process tree; NetToPLCSim is purely a protocol bridge.

Note the IP address assignment: the PC adapter must be configured with the IP that the simulated PLC is supposed to have. The HMI configuration points its connection partner at that same IP. This swap is the most common configuration mistake and the single biggest source of "device not found" errors.

5. Prerequisites

6. Step-by-Step Configuration

6.1 Configure the PC network adapter

1. Open Control Panel > Network and Sharing Center > Change adapter settings.
2. Open Properties of the Ethernet adapter that connects to the HMI.
3. Select Internet Protocol Version 4 (TCP/IPv4) > Properties.
4. Assign a static IP identical to the PLC IP used in the TIA Portal project (for example, 192.168.1.10) and a 255.255.255.0 mask.
5. Leave the gateway and DNS fields empty unless the panel sits behind a router.

Confirm the address with ipconfig /all in an elevated command prompt. The IPv4 address must show 192.168.1.10 on the same adapter you will use for the HMI transfer.

6.2 Start NetToPLCSim and capture port 102

1. Right-click NetToPLCSim.exe and select Run as administrator. This must be the first Siemens-related process launched after a clean Windows boot.
2. In the main window click Install, then Start. NetToPLCSim binds TCP/102; if another process is already holding the port the dialog reports "Address already in use". Stop the conflicting service (commonly the Siemens S7DOS help service or a TIA Portal Gateway) before retrying.
3. Leave the main window open; do not close it during the session.

6.3 Configure the TIA Portal project

1. Open the project in TIA Portal.
2. Open the PLC device configuration and confirm the PLC IP address matches the PC adapter IP from Section 6.1 (for example, 192.168.1.10).
3. Compile the PLC station and download it to the PLCSIM instance using Online > Download to device. The PG/PC interface must be set to PLCSIM for this download.
4. Start the PLCSIM instance from Online > Simulation > Start or use the PLCSIM toolbar button. Confirm the simulated CPU is in RUN.

6.4 Configure NetToPLCSim station

1. Return to NetToPLCSim and click Add to create a new station.
2. Enter the Network IP address matching the PC adapter (for example, 192.168.1.10).
3. Enter the PLCSIM IP address. With the standard PLCSIM this is typically 127.0.0.1 or the loopback address; consult the NetToPLCSim release notes for the expected loopback port.
4. Click Start Server. The status indicator should turn green.

6.5 Configure the HMI transfer settings

1. In the HMI project, open Device configuration > Transfer and verify the transfer mode is Automatic (so the panel accepts a project push without a manual confirm prompt).
2. Set the HMI IP to an address on the same /24 subnet, for example 192.168.1.15.
3. Set the HMI connection partner IP to the PC adapter IP (192.168.1.10).
4. Compile the HMI station and use Online > Download to device > Accessible nodes to transfer. The PG/PC interface for this transfer must be the physical Ethernet adapter (TCPIP.1), not PLCSIM.

6.6 PG/PC interface selection

PG/PC interface management lives in Control Panel > PG/PC Interface (the 32-bit legacy dialog, even on 64-bit Windows). Two access points matter:

7. Security: PutGet, TLS, and Access Protection

The TIA Portal PLC protection model exposes three relevant switches:

• PutGet permission (read/write from remote partner) — not required for NetToPLCSim because the proxy establishes a local S7 connection rather than a routed one. Leave at the default unless a third-party tool is involved.
• Access protection (know-how protect / copy protection) — irrelevant to the bridge, but it does affect HMI read/write on protected blocks.
• S7Comm-Plus with TLS (TIA V16+) — NetToPLCSim supports the encrypted S7Comm-Plus variants. Make sure the NetToPLCSim version matches the TIA Portal major version to avoid TLS handshake failures.

8. Verification

1. From the PC, ping the HMI: ping 192.168.1.15. Expect four replies with sub-millisecond times on a direct Ethernet connection.
2. In TIA Portal, open Online > Accessible nodes with the PG/PC interface set to TCPIP.1. The HMI must appear with its configured IP and Profinet device name.
3. Download the HMI project. The panel's transfer dialog should report success within a few seconds.
4. From the HMI runtime, force a tag write (for example, set a bit via a button) and confirm the change is visible in the TIA Portal watch table against the PLCSIM instance.
5. Run a VB script on the panel that writes a tag back to the PLC. The script should complete without "value could not be written to the PLC".

9. Troubleshooting Matrix

10. Engineering Best Practices

• Establish a clean boot order: PC reboot → NetToPLCSim (admin) → TIA Portal → PLCSIM → NetToPLCSim station start. The most common silent failure is starting TIA Portal before NetToPLCSim, which lets the S7DOS service grab port 102.
• Use a dedicated Ethernet adapter for the HMI/PLCSIM traffic. Hyper-V virtual switches, Docker bridges, and VPN tunnels create virtual adapters that frequently steal TCP/102.
• Document the IP swap. The PC, the PLC, and the HMI connection partner must all reference the same address. Tag the panel connection with a comment that reads "Points at engineering PC" to avoid confusion when the same project is later deployed to a real PLC.
• Keep a single PLCSIM instance per project during HMI script testing. Multiple instances can coexist but require a port other than 102 and are not bridged by NetToPLCSim.
• Prefer a Comfort panel with a service USB or PN cable for the first download. Once the project is loaded, switch the connection partner to the PLCSIM IP for runtime testing.
• For long-running test sessions, lock the PC power profile to High performance. Some Windows power plans drop the Ethernet link after a sleep cycle, which manifests as a transient connection loss to the HMI.

11. Frequently Asked Questions