Connecting ProTool Runtime to S7-PLCSIM: Step-by-Step Setup

Overview

Siemens S7-PLCSIM is a software-based simulation environment that emulates a SIMATIC S7-300 or S7-400 CPU on a Field PG or engineering workstation. It executes the compiled STEP 7 program block-for-block exactly as a real CPU would, including OB, FB, FC, DB, SFB, and SFC code, so that engineers can validate logic, force I/O, and inspect online watch tables without a physical rack. Combined with a runtime HMI such as ProTool/Pro Runtime (or later WinCC flexible Runtime), the full control loop — PLC scan, tag updates, alarms, and operator screens — can be exercised on a single development machine.

This article documents the canonical method to attach a ProTool Pro Runtime project to S7-PLCSIM, the configuration that has been field-proven across Step 7 V5.1 / V5.2 / V5.3 + ProTool V6.0 and the legacy ProTool V5.2 SP3 path. The most common failure symptom is the dialog "No S7 connection found", which almost always traces to a PG/PC interface assignment mismatch between the STEP 7 project, S7-PLCSIM, and ProTool. The configuration below resolves that fault and provides a deterministic commissioning procedure.

Prerequisites

Verify that the following software components are installed and licensed on the engineering station before attempting the connection.

How S7-PLCSIM and ProTool Runtime Communicate

Both S7-PLCSIM and ProTool Runtime use the same PG/PC interface assigned by the SIMATIC Manager. S7-PLCSIM creates a virtual MPI/DP subnet (or PROFINET, depending on the option) that listens on a local soft channel. When ProTool Runtime is started, it resolves its configured connection target through the same soft interface and opens an S7 connection to the simulated CPU. The single most important rule is:

1. The STEP 7 hardware configuration (HW Config) must assign the simulated CPU to an MPI address in the same subnet that ProTool expects.
2. The PG/PC interface selected in Start → SIMATIC → PG-PC Interface (or Set PG/PC Interface) must be the same for the SIMATIC Manager, S7-PLCSIM, and ProTool Runtime.

The two interface parameter sets must therefore be identical for all three applications — this is the root cause of the "No S7 connection found" message in roughly 80% of support cases.

Step-by-Step Configuration

Step 1 — Assign the PG/PC Interface to PLCSIM (MPI)

1. Open Windows Start → SIMATIC → STEP 7 → Set PG/PC Interface.
2. In the Interface Parameter Assignment Used dropdown, select PLCSIM (MPI) (or PLCSIM (PROFIBUS) if you want DP coupling).
3. Click Properties and confirm the following defaults:
   • Transmission rate: 187.5 kbps (MPI default) or 1.5 Mbps (PROFIBUS default).
   • Highest MPI / PROFIBUS address: 31 (or 126 for PROFIBUS).
   • Local address of PG/PC: 0 (PG) — keep this unless another PG is online.
4. Click OK, then OK again to commit. Restart any open SIMATIC applications so the new interface is picked up.

Step 2 — Configure the Simulated CPU in HW Config

1. In SIMATIC Manager, open the S7 project and double-click Hardware to launch HW Config.
2. Insert a CPU 314, 315, 316, 317, 318, or 412/414/416 from the catalog, matching the real machine you intend to commission.
3. Select the CPU's MPI/DP interface and confirm:
   • MPI address: 2 (typical default; avoid 0 because that is the PG).
   • Subnet: MPI(1) created automatically; double-click to verify transmission rate matches Step 1.
4. Compile and save (Station → Save and Compile). Closing HW Config is not required.

Step 3 — Start S7-PLCSIM and Download the Program

1. From SIMATIC Manager, choose Options → SIMATIC Simulation, or click the Simulation icon on the toolbar. S7-PLCSIM opens a virtual CPU window with LEDs (RUN, STOP, SF, BF, DP) and a small MPI status display.
2. Click the POWER LED so it goes green (simulating the CPU receiving power).
3. Click the MRES button once to perform a memory reset; the simulated CPU is now in STOP state.
4. In SIMATIC Manager select the S7 program (or Blocks folder) and press Ctrl+L or choose PLC → Download to push all OBs, FBs, FCs, DBs, and SDBs to the simulated CPU.
5. Switch the simulated CPU to RUN by clicking the RUN-P or RUN switch. The RUN LED should stay solid green if the program downloaded cleanly and the OB1 scan completes.

Step 4 — Configure the ProTool HMI Connection

1. Open the ProTool/Pro CS project for the HMI.
2. From the project tree choose Control Panel → Connections (or System → Connections in ProTool V6).
3. For the HMI station, set:
   • Protocol: SIMATIC S7 MPI (or S7 PROFIBUS for DP coupling).
   • PLC address: the same MPI address assigned to the CPU in Step 2 (e.g. 2).
   • HMI address: 1 (default; must be unique on the MPI subnet and must not equal the PG address 0 or the CPU address 2).
   • Network parameter: transmission rate 187.5 kbps, highest station address 31.
4. Confirm that the HMI station's Set PG/PC Interface — when running on the same machine — is also set to PLCSIM (MPI), matching the value from Step 1.

Step 5 — Compile and Start Runtime

1. In ProTool/Pro CS, choose File → Compile → All (Complete) to rebuild the runtime file with the updated connection parameters.
2. Click the Start Runtime button (or press F11) from inside ProTool/Pro CS, or launch protmgr.exe from Start → SIMATIC → ProTool → ProTool/Pro Runtime outside the configuration tool.
3. Runtime will detect the active S7-PLCSIM via the PLCSIM soft interface, open the S7 connection, and start polling configured tags. Tag values from the simulated CPU should appear on screen and update at the configured acquisition cycle (default 1 s).

Verification

After completing the five steps above, run the following checks to confirm the full stack is online.

The Accessible Nodes tool (PLC → Accessible Nodes or PG → Show Accessible Nodes) is the single most useful diagnostic when chasing a connection fault. If you can see both the simulated CPU at MPI 2 and the ProTool HMI at MPI 1 listed with the green connected icon, every S7 connection path is healthy.

Troubleshooting the "No S7 Connection Found" Fault

This dialog is the canonical ProTool error when the runtime cannot establish the S7 connection at startup. The table below maps the typical causes to the corrective action.

Advanced Diagnostic: Setting Up MPI Watch with Accessible Nodes

1. In SIMATIC Manager, choose PLC → Accessible Nodes.
2. If the PLCSIM (MPI) interface is correctly assigned, the simulated CPU at MPI address 2 should appear in the list within a few seconds.
3. Start ProTool Runtime. Re-open Accessible Nodes — the HMI station at MPI address 1 should now also be listed.
4. If the HMI is not listed after Runtime startup, ProTool is still using the wrong PG/PC interface. Repeat Step 1 of the configuration procedure and re-launch ProTool Runtime.

Version Compatibility Matrix

The configuration has been validated against the combinations below. Mismatched major versions are not supported and will not be re-branded by Siemens — verify your installed base against this table before commissioning.

For S7-1500 and S7-1200 controllers, the legacy PLCSIM V5 path is not applicable. Use S7-PLCSIM Advanced with TIA Portal and either WinCC Unified / TIA Portal HMI Runtime or ProTool's successor (WinCC flexible) through the Softnet IE soft channel. The Advanced API exposes a TCP-based interface to the simulated CPU on port 102 (ISO-on-TCP) which is more firewall-friendly and supports multiple virtual instances per workstation.

Field-Commissioning Procedure

The following 10-minute procedure is the shortest path to a working simulated system on a clean engineering station.

1. Install STEP 7 + S7-PLCSIM and license both.
2. Install ProTool/Pro CS and ProTool/Pro Runtime and license the runtime.
3. Reboot once to register all SIMATIC services and shell extensions.
4. Open Set PG/PC Interface and select PLCSIM (MPI).
5. Open the STEP 7 project, launch HW Config, confirm CPU MPI address = 2 and 187.5 kbps.
6. Open S7-PLCSIM, power on, MRES, download blocks from SIMATIC Manager, switch CPU to RUN-P.
7. In ProTool/Pro CS open the HMI project, set the connection PLC address = 2, HMI address = 1, protocol S7 MPI, rate 187.5 kbps.
8. Recompile the ProTool project (Complete).
9. Start ProTool Runtime from inside ProTool CS.
10. Open Accessible Nodes from SIMATIC Manager and confirm both MPI 1 and MPI 2 are visible.

If all ten steps complete without error, the simulated system is operational. You can now exercise PLC logic, force I/O via PLCSIM's variable table (Monitor/Modify), and validate the HMI behavior in the runtime.

Multi-Project Simulation and Limitations

A single S7-PLCSIM instance can host exactly one simulated CPU. For multi-CPU simulation (S7-400 with multiple CPUs, or S7-300 with AS-AS coupling) you must launch multiple S7-PLCSIM windows from multiple STEP 7 projects, or upgrade to S7-PLCSIM Advanced which supports up to 16 virtual instances. ProTool Runtime can connect to any one of those simulated CPUs by pointing its connection target at the appropriate MPI address — the runtime itself supports up to 4 active S7 connections depending on the project license.

Limitations to keep in mind during simulation:

• Hardware interrupts from physical I/O are not generated; you must trigger OB40 entries via PLCSIM's Trigger Hardware Interrupt menu.
• Time-of-day is taken from the host PC clock; OB1 scan and OB35 cycle timers run in real time.
• Communication over TCP/IP (ISO-on-TCP, TCP, UDP) is not supported by PLCSIM V5.x — only MPI/DP soft channel and (in V5.4) S7 communication over the soft channel.
• Fault OB90 and the redundancy OB72/OB73 are partially emulated; for full H-CPU failover behavior use PLCSIM Advanced.

Migrating to S7-PLCSIM Advanced and TIA Portal

New machines and greenfield projects should move to the S7-PLCSIM Advanced path. The migration steps are:

1. Convert the STEP 7 V5 project to TIA Portal using the TIA Portal migration tool (TIA Portal V15 or later recommended).
2. Convert the ProTool/Pro project to a TIA Portal HMI (WinCC Unified or WinCC Comfort/Advanced) using the ProTool converter in TIA Portal.
3. Replace S7-PLCSIM V5 with S7-PLCSIM Advanced; the new simulator is launched from TIA Portal and exposes a soft S7-1500 CPU on a configurable IP address (default 127.0.0.1).
4. Update the HMI connection target to the simulated IP/port and re-compile.

The functional behavior is identical — same STEP 7 program, same HMI screens — but the soft interface is now TCP/IP rather than MPI, which simplifies firewall handling and remote engineering.

FAQ