Connecting Siemens PLCSIM to Third-Party Software via s7prosim

Overview

Siemens S7-PLCSIM and the newer S7-PLCSIM Advanced are software-based PLC simulators that execute a TIA Portal or STEP 7 V5 project on a virtual CPU. The virtual CPU exposes two primary integration surfaces for external applications such as MATLAB, LabVIEW, custom C/C++ clients, or arbitrary .NET programs:

1. The s7prosim COM automation interface (legacy PLCSIM V5.x and TIA-Portal integrated PLCSIM V13+).
2. The built-in OPC UA server exposed by S7-PLCSIM Advanced (and the symbolic OPC DA server exposed by NetToPLCSIM/PLCSIM V5).

For fault-diagnosis workflows that need to read/write I/O, data blocks, and Merker (M) words in a closed simulation loop, the s7prosim interface is the lowest-latency path. OPC UA is the recommended path when the 3rd-party client already supports OPC (MATLAB OPC Toolbox, Ignition, Kepware, custom UA clients) or when you need cross-platform, language-agnostic access.

This reference covers both surfaces, with working C++, MATLAB, and SCL code, and the exact TCP ports, .NET assemblies, and TIA Portal project settings required for a clean integration.

Prerequisites

Method 1 - s7prosim (COM Automation) for Legacy PLCSIM

s7prosim is a COM in-process server installed automatically with the PLCSIM plug-in inside TIA Portal (V13 SP1 and later) and the standalone PLCSIM V5.4 SP5 used with STEP 7 V5. The registered ProgID is S7ProSim.S7ProSim.1 and the type library is s7prosimoax.tlb. Any language that can call into COM (C++, C#, VB.NET, Python via win32com, MATLAB via actxserver) can read or write PLC tags while the simulation is in RUN.

Connecting s7prosim from MATLAB

MATLAB does not need the OPC Toolbox to use s7prosim; the standard actxserver function opens the COM object directly.

obj = actxserver('S7ProSim.S7ProSim.1');
obj.Connect;
obj.SetState('RUN');

% Read an input bit (I 0.0)
val = obj.GetInput(0, 0, 0);  % byte, bit, return type (0=Bool)

% Write to a marker (M 10.3)
obj.SetOutput(2, 0, 3, 1, 1);  % memory area 2 = M, byte 0, bit 3, val 1

% Read a data block word (DB1.DBD0)
obj.ReadTagValue('DB1.DBD0');

obj.Disconnect;

Connecting s7prosim from C++ (ATL / MFC)

Import the type library once with #import "s7prosimoax.tlb" in a single header. The CLSID resolves to the COM object registered by PLCSIM. Sample minimal C++ console code:

#import "s7prosimoax.tlb" rename_namespace("PS")
#include 
int main() {
    CoInitializeEx(nullptr, COINIT_MULTITHREADED);
    PS::IS7ProSimPtr sim;
    HRESULT hr = sim.CreateInstance(__uuidof(PS::S7ProSim));
    if (FAILED(hr)) { std::cerr << "PLCSIM not running\n"; return 1; }
    sim->Connect();
    sim->SetState(L"RUN");
    sim->SetOutput(2, 0, 4, 1, 1);            // M 0.4 = TRUE
    VARIANT_BOOL b = sim->GetInput(0, 0, 0);  // I 0.0
    std::wcout << L"I0.0 = " << b << std::endl;
    sim->Disconnect();
    CoUninitialize();
    return 0;
}

Build with the PLCSIM installed type library referenced as s7prosimoax.tlb. The binary requires the COM registration from the PLCSIM install (or regsvr32 s7prosimoaxax.dll on developer machines).

Connecting s7prosim from C# (.NET)

C# does not need the TLB import step. Add a reference to Siemens.Simatic.S7ProSim (registered by the PLCSIM add-in) and use the late-bound dynamic type when the assembly is not on the build path:

Type t = Type.GetTypeFromProgID("S7ProSim.S7ProSim.1");
dynamic ps = Activator.CreateInstance(t);
ps.Connect();
ps.SetState("RUN");
ps.SetOutput(2, 0, 4, 1, 1);          // M 0.4 = 1
bool i00 = ps.GetInput(0, 0, 0);      // I 0.0
ps.Disconnect();

s7prosim Method Reference

Method 2 - OPC UA Server Inside PLCSIM Advanced

S7-PLCSIM Advanced (V2.0+, shipped with TIA Portal V15.1 and later, and maintained through V6.0 for TIA V19) embeds an OPC UA server inside the simulated CPU. The default endpoint port is 4840 (changed only in the virtual CPU's hardware configuration). This is the same OPC UA stack exposed by a physical S7-1500/S7-1200 CPU, so any OPC UA client that talks to a real S7-1500 will talk to PLCSIM Advanced with no client-side changes.

Enabling the OPC UA server in the virtual CPU

1. In the TIA Portal project, open Device configuration of the S7-1500 CPU used in PLCSIM.
2. Navigate to Properties > OPC UA > Server.
3. Enable "Activate OPC UA Server".
4. Set the desired port (default 4840).
5. Under "Runtime permissions", grant the client user "Read" and (if required) "Write" on the data blocks or tags you want to exchange.
6. Compile and download the project to PLCSIM Advanced (F5 in TIA, or use the PLCSIM Advanced control panel).

Connecting a UA client

Configure the UA client with the following parameters:

MATLAB UA example (read DB1.DBD0 every 100 ms)

ua = opcua('192.168.0.1', 4840);
connect(ua);
node = opcuanode(ua, 'ns=3;s="DB1"."Static_1"'); % symbolic path
da = opcda(ua, node);
grp = addgroup(da);
additem(grp, node);
grp.UpdateRate = 0.1;            % 100 ms
grp.Subscription = 'on';
start(grp);

Method 3 - NetToPLCSIM (OPC DA for Legacy PLCSIM)

For engineers who need an OPC DA bridge to a TIA-integrated PLCSIM (not Advanced), NetToPLCSIM (originally by nettoplcsim.sourceforge.net) listens on TCP/102 and re-routes S7 comms to the local PLCSIM instance. Combined with the SIMATIC NET OPC server (S7.OPC.DA.1 ProgID) this exposes the same tag namespace as a real S7-1500. NetToPLCSIM is the practical path for LabVIEW DSC, iFIX, WinCC user-defined clients, and any tool that insists on OPC DA rather than OPC UA.

Architecture: PLCSIM in a Closed-Loop Fault-Diagnosis Model

The typical research workflow couples a fault-detection algorithm (Petri-net reachability analysis, parity-check residuals, observer-based FDI) to PLCSIM in a single process. The recommended architecture is:

Data flow per scan:

1. Fault-detection algorithm (MATLAB/VC++) writes a fault-trigger word to DB1.DBW10 via s7prosim/OPC.
2. PLCSIM executes the ladder/SCL logic on the next cycle.
3. Algorithm reads the new DB1.DBW0, DB1.DBW2, and MW100 (residuals) and compares against the Petri-net reachability graph.
4. A pass/fail signal is written back to M 50.0 for the HMI to visualize.

Step-by-Step: Building a PLCSIM <-> MATLAB Closed Loop

Step 1 - Build the TIA project

1. Create a new TIA Portal V17/V18 project and insert an S7-1500 CPU (e.g. CPU 1515-2 PN 6ES7515-2AM02-0AB0).
2. Add OB1 with the SCL snippet in the next section.
3. Compile and select Start simulation (the PLCSIM button). The virtual CPU opens with default IP 192.168.0.1 and starts in STOP.

Step 2 - SCL block to expose test points

// FB1 - FaultDiagnosisTestPoint
// Drops the inputs and the integrator state into a struct that
// MATLAB can read in a single ReadTagValue call.
DATA_BLOCK "DB_Diag" "FB1"
  STRUCT
    InRaw : ARRAY[0..7] OF BOOL;   // mirrors IB0
    OutRaw : ARRAY[0..7] OF BOOL;  // mirrors QB0
    Counter : INT;                  // counts scan cycles
    FaultFlag : BOOL;              // set by MATLAB
    Residual : REAL;               // exposed for verification
  END_STRUCT;
END_DATA_BLOCK

Step 3 - Run the closed loop from MATLAB

sim = actxserver('S7ProSim.S7ProSim.1');
sim.Connect;
sim.SetState('RUN');
for k = 1:1000
    % Inject a fault on M 50.0 at k = 200
    if k == 200, sim.SetOutput(2,50,0,1,1); end
    v = sim.ReadTagValue('"DB_Diag".Counter');
    f = sim.ReadTagValue('"DB_Diag".FaultFlag');
    r = sim.ReadTagValue('"DB_Diag".Residual');
    fprintf('scan=%d counter=%d fault=%d residual=%.3f\n', ...
        k, v.uint16, f.bool, r.single);
    pause(0.1);     % match PLCSIM scan
end
sim.SetState('STOP');
sim.Disconnect;

Verification

After the loop runs, validate that the integration is healthy using the following checks:

Troubleshooting Matrix

Field-Commissioning Notes

Performance Considerations

For high-throughput fault-diagnosis loops (> 1000 I/O points per second), s7prosim tops out around 200-300 single tag reads/s from a single MATLAB session because every call is a COM round-trip. Two optimizations help:

1. Bulk into a single DB and call ReadTagValue('DB_Bulk') for the whole struct, parsing locally.
2. Subscribe via the OPC UA MonitoredItems API with a 50 ms publishing interval. PLCSIM Advanced V4+ can sustain > 5000 monitored items at this rate.

For real-time HIL, keep MATLAB's loop in normal priority; PLCSIM itself is not real-time and a Windows host with power-management throttling can stretch the cycle to 200 ms or more.

FAQ