Connecting S7-400 PLCSIM to OPC Server with Nettoplcsim

Overview: S7-400 PLCSIM and External OPC Connectivity

Engineers developing STEP 7 V5.5 SP3 logic for a SIMATIC S7-400 CPU with integrated 2-port PROFINET (commonly the 416-3 PN/DP) routinely need to validate OPC DA or OPC UA communication against a real client before the physical PLC arrives on the bench. The catch is that PLCSIM V5.4 SP5 Update 2 implements the S7-400 backplane, the CPU firmware, and the MPI/PROFIBUS/PROFINET interfaces entirely inside one process (S7SIM32X.exe). The simulated CPU has no MAC address, no IP address, and no externally visible ISO-on-TCP (port 102) or TCP socket. Any external client that opens an S7 connection to the simulated CPU is rejected at the network layer because the packets never leave the host.

The same restriction applies to:

• The S7 OPC DA server inside SIMATIC NET v8.2 when configured against the PLCSIM station.
• The Station Configurator's "Online" diagnostics, which expects to walk the PC Station over a Softnet or a CP.
• STEP 7 / SIMATIC Manager running on a second engineering PC, even if the same Windows user account is used.
• SCADA clients (WinCC, third-party OPC clients) speaking ISO-on-TCP or S7 communication.

This article documents the only practical path for the S7-400 line on a developer workstation: the free, open-source Nettoplcsim tunnel. It is the same tool Siemens engineers and integrators have used since 2008 specifically to expose PLCSIM V5.4 to external OPC, HMI, and SCADA clients without buying hardware.

Why PLCSIM v5.4 Has No External Network Stack

PLCSIM V5.4 was designed to replace the CPU hardware inside a STEP 7 project. The simulator loads the same System Data (SDB) and user program as the physical CPU, but it runs the user program and the internal protocol engines in a single Windows process. The "interfaces" you configure in HW Config (PN-IO, PROFIBUS-DP, MPI) are emulated only as far as STEP 7's online functions are concerned. The PROFIBUS-DP and PROFINET stacks present in a real CP 443-1 are not loaded; only the internal backplane bus is.

From the network point of view, the simulated CPU:

The STEP 7 V5.5 online path that does work without Nettoplcsim uses the proprietary S7DOS DLL inside PLCSIM. Only the SIMATIC Manager on the same machine uses that DLL. Anything that goes outside the S7SIM32X process needs a tunnel.

Decision Matrix: Choosing a Workaround

For S7-400 the only path on an engineering workstation is Nettoplcsim. PLCSIM Advanced is S7-1500 only. The CP 443-1 OPC UA cannot be simulated. The matrix makes that explicit so that you do not waste a week trying to load CP 443-1 firmware into a PLCSIM rack.

Architecture: How Nettoplcsim Bridges PLCSIM to the LAN

Nettoplcsim is a small Windows service (NetToPLCSim.exe) plus a configuration GUI (NetToPLCSim-Server.exe or the legacy NetToPLCSim.exe in older builds). It opens a normal Windows TCP socket on port 102 (ISO-on-TCP), on the host's real network interface, and forwards the bytes into PLCSIM through the proprietary S7DOS interface that STEP 7 already uses to talk to PLCSIM locally. To the outside world the simulated CPU looks as if it has the IP address of the engineering PC. To PLCSIM the external client looks as if it is a local connection.

Both ends can be on the same workstation (PLCSIM, SIMATIC NET, and the OPC Scout test client all on one machine) or on different machines in the same routed subnet. The Nettoplcsim service has to run on the PC that hosts PLCSIM. The OPC client only needs normal network reachability to that PC. There is no need to install Nettoplcsim on the OPC client PC.

Prerequisites

The combination STEP 7 V5.5 + PLCSIM V5.4 + SIMATIC NET v8.2 is the only officially co-installable set that covers the user's reported environment. Mixing in a TIA Portal installation on the same PC is supported but requires a fixed installation order: TIA first, then STEP 7 V5.5, then SIMATIC NET, then Nettoplcsim. Reversing the order can break the SIMATIC NET OPC server enumeration.

Step-by-Step: Tunneling PLCSIM to an External OPC Server

Step 1 - Install PLCSIM and load the project

1. Open the STEP 7 V5.5 SP3 project that contains the S7-400 station (CPU 416-3 PN/DP, 6ES7416-3ES06-0AB0 or compatible).
2. Confirm the CPU is configured with the option "CPU contains simulation module" or the equivalent checkbox in the project. For PLCSIM V5.4 the online path "PLC → Download to Module → PLCSIM" is enabled as soon as the project contains a valid PC/PG interface assignment "PLCSIM (PROFIBUS)" or "PLCSIM (MPI)".
3. Start PLCSIM from the SIMATIC Manager toolbar (icon with the chip) or via Start → SIMATIC → STEP 7 → S7-PLCSIM. Verify that the S7SIM32X window appears and reports the simulated CPU type and order number.
4. Power on the simulated CPU (RUN-P switch) and download the hardware configuration and user program. The PLCSIM status indicator turns green when the CPU is in RUN.

Step 2 - Install and start Nettoplcsim

1. Download the latest signed installer from the Nettoplcsim project page. The build is currently distributed as NetToPLCSim-1.2.5-setup.exe and works under Windows 10 / Server 2019 without compatibility shims.
2. Run the installer as administrator. It registers the NetToPLCSim-Server Windows service and the NetToPLCSim GUI in the Start menu.
3. Launch the GUI. The window has three editable fields: Server IP Address, Server Port, and Plcsim IP Address (the simulated CPU's IP, used by STEP 7 to reach PLCSIM locally).
4. Set Server IP Address to the engineering PC's primary Ethernet IPv4 address (for example 192.168.0.50). Do not leave it as 0.0.0.0 if the OPC client runs on a different machine; that bind is not reachable from outside the loopback.
5. Set Server Port to 102. This is the ISO-on-TCP/RFC1006 port reserved for S7 communication. Nettoplcsim does not support changing this port because the S7 protocol hard-codes 102 in its connection establishment.
6. Set Plcsim IP Address to 127.0.0.1 (loopback). Nettoplcsim talks to PLCSIM through the local S7DOS interface, not over IP.
7. Click Start Server. The status bar at the bottom of the GUI must change from red "Stopped" to green "Server is running".

Step 3 - Configure SIMATIC NET v8.2 to reach the simulated CPU

1. Open the SIMATIC NET Station Configurator (Start → SIMATIC → SIMATIC NET → Communication Settings → Station Configurator).
2. Add a new OPC Server slot (index 1) and an S7 connection slot. The default S7 connection uses the application "OPC-Server".
3. Set the partner IP to the engineering PC's real IP (192.168.0.50), not 127.0.0.1. SIMATIC NET will resolve this through Nettoplcsim, which in turn forwards to PLCSIM's local S7DOS port.
4. Save the configuration. The Station Configurator writes a PCStation.xml that the SIMATIC NET runtime reads on next service start.

Step 4 - Start the SIMATIC NET PC Station runtime

1. Open the Windows Services console (services.msc).
2. Set the following services to Automatic (delayed start) and start them in this exact order:
   • S7DOS Help Service
   • SIMATIC NET Configuration Service
   • SIMATIC NET OPC Server (this is the COM/DCOM server OPC.SimaticNET)
   • SIMATIC NET Runtime
3. Confirm in the Station Configurator that the ring icon next to the OPC Server slot turns green. Red means the configuration does not match the runtime; orange means the partner is not reachable (i.e., Nettoplcsim is not running, or the partner IP in the S7 connection is wrong).

Step 5 - Test with OPC Scout V10

1. Launch OPC Scout V10 (Start → SIMATIC → SIMATIC NET → OPC Scout V10).
2. In the server tree, add the local server OPC.SimaticNET. The Add Server dialog accepts the ProgID; do not use DCOMCNFG for the local case.
3. Right-click OPC.SimaticNET → Connect. The status indicator at the bottom of the main window should turn green.
4. Add an item, for example S7:[CPU416-3 PN/DP]DB1,W0 (assuming DB1 is present in the S7-400 program). The syntax is fully described in the SIMATIC NET OPC Server manual.
5. Drag the item onto a strip chart or a numeric indicator. If the value updates when you change the tag in PLCSIM's variable table, the tunnel is working end-to-end.

Connecting a Second Engineering PC to the Same PLCSIM

A common follow-up question is whether a second engineering PC running SIMATIC Manager can monitor the simulated CPU. With Nettoplcsim, the answer is yes. The procedure is the same as for a real CPU:

1. On the second PC, open Set PG/PC Interface and select TCP/IP → <Network card>.
2. In the SIMATIC Manager choose PLC → Online → Accessible Nodes. The simulated CPU on the Nettoplcsim PC appears with its real IP.
3. Open the project, go online, and monitor blocks. The user program runs only in PLCSIM on the first PC; the second PC is just a viewer.

The first PC's SIMATIC Manager must release its exclusive S7DOS handle to PLCSIM before the second PC connects, otherwise Nettoplcsim logs "S7DOS busy" errors. Stop any open online windows on the first PC first.

OPC UA Option: Why You Cannot Get It for Free on S7-400 PLCSIM

OPC UA on the S7-400 line is implemented exclusively in the CP 443-1 OPC UA communication processor (order number 6GK7443-1BX30-0XE0 and successors). The OPC UA server endpoint is enabled in HW Config on the CP and listens on a configurable port; the default is 4840, which is the OPC UA Binary Protocol default defined in the OPC UA specification. The simulated CPU in PLCSIM V5.4 cannot load a CP 443-1 OPC UA because PLCSIM's rack definition file SIMATIC.S7Sim.Rack.ini only contains CPU models.

If your SCADA only speaks OPC UA, the only fully supported option is:

PLCSIM Advanced's OPC UA server uses the same default port 4840 that a real S7-1500 would use, so a SCADA configured against an S7-1500 project can be pointed at the PLCSIM Advanced instance with no changes. This is one of the reasons Siemens introduced PLCSIM Advanced specifically to enable OPC UA simulation work for the S7-1500 generation.

Station Configurator: Why "Online" Stays Grey

The user's report that Station Configurator cannot establish an online connection with PLCSIM is expected behaviour. The Station Configurator is designed to walk a real PC Station over a Softnet driver or a CP. PLCSIM V5.4 presents neither. Nettoplcsim fixes the OPC server side, but it does not turn PLCSIM into a discoverable PC Station. Symptoms and resolutions:

Verification Checklist

Confirm the end-to-end path with these checks, in order:

1. From the OPC client PC, run telnet <engineering-pc-ip> 102. A black screen means the Nettoplcsim port is reachable; a "connection refused" means Nettoplcsim is not running or a firewall is blocking.
2. From the OPC client PC, run ping <engineering-pc-ip>. The simulated CPU does not respond to ICMP, so the ping only confirms the host is up; it does not prove the S7 tunnel works.
3. In OPC Scout, browse the server. Tags of the form S7:[<CPU name>]DB<n>,BYTE/INT/WORD/DWORD/REAL/BOOL<offset> must appear.
4. Subscribe to DB1,BYTE0 (clock bit), set the update rate to 100 ms, and confirm the value flips every second in the strip chart.
5. In PLCSIM, open a VAT and force a value. The OPC Scout indicator must update within one scan cycle.
6. From a second engineering PC, run Accessible Nodes in the SIMATIC Manager. The simulated CPU must appear in the list with the engineering PC's real IP.

Troubleshooting Matrix

Field-Proven Caveats

• The S7-400 PLCSIM V5.4 SP5 Update 2 is the last S7-400-compatible PLCSIM. It is end-of-life and is not part of any current STEP 7 V5.6 distribution. Treat it as a frozen tool; the only maintenance is what Siemens ships in the cumulative update packages.
• Do not run Nettoplcsim and the SIMATIC NET PC Station OPC server on the same port. Nettoplcsim must own 102; the OPC server connects as a client to 102, not as a listener.
• Mixing the legacy S7-PLCSIM (V5.4) with a TIA Portal STEP 7 V18+ installation on the same workstation can break the PLCSIM (PROFIBUS) PG/PC interface assignment. The two PKZIP distributions of PLCSIM DLLs collide in %WINDIR%\System32. The cure is to repair-install SIMATIC NET after the TIA Portal install.
• Nettoplcsim forwards TCP/IP, not PROFIBUS or PROFINET. Anything that needs raw PROFINET IO simulation (e.g., testing an I-Device configuration) cannot be exercised this way. Use PLCSIM Advanced with an S7-1500 project for PROFINET IO simulation.
• The CP 443-1 OPC UA firmware is at the time of writing V3.3.x. Earlier V2.x firmware only supports UA 1.02 and rejects modern discovery calls. Update the CP firmware before commissioning OPC UA on a real S7-400.

Related Official Documentation

• SIMATIC S7-400 CPU 416-3 PN/DP manual: Siemens Industry Online Support - S7-400 operator and hardware manuals
• SIMATIC NET PC Software V8.2 system manual: Siemens Industry Online Support - SIMATIC NET manuals
• PLCSIM V5.4 SP5 function description (entry ID 16820709 in the Siemens support database): Siemens - S7-PLCSIM V5.4 SP5
• CP 443-1 OPC UA operating instructions: Siemens - CP 443-1 OPC UA
• STEP 7 V5.5 SP3 release notes: Siemens - STEP 7 V5.5 SP3
• OPC UA specification (port 4840): OPC Foundation - What is OPC UA