Connecting WinCC Flexible 2007 RT to PLCSIM V5.3 / V5.4: Field-Tested Setup Guide

Commissioning an HMI on a desk without the real CPU is one of the most productive tasks a Siemens engineer can do, but only if the simulator, the HMI runtime, and the STEP 7 project agree on three things: the bus type, the PLC station address, and the HMI master address. This reference documents the procedure for linking WinCC Flexible 2007 Runtime to S7-PLCSIM V5.3 and S7-PLCSIM V5.4 SP2, and walks through the equivalent workflow in TIA Portal using PLCSIM (RT Unified) with WinCC Unified.

1. Why the I/O Field Shows "######" and "PLC Disconnect"

The classic error pattern is unmistakable: the runtime boots, the I/O fields go immediately to hash marks (######), and the alarm window produces a steady stream of "Connection to PLC failed — PLC disconnect" entries. In the STEP 7 Classic stack this is almost always a bus mismatch, not a WinCC Flexible configuration error:

• WinCC Flexible RT is pointed at PC Adapter (Auto), but the simulated CPU is not exposing the same bus type.
• The STEP 7 hardware configuration assigns a DP port to the S7-300 / S7-400 station. PLCSIM V5.3 only supports MPI; the connection will not negotiate.
• The HMI is configured as a Master but the simulated CPU's MPI address is wrong (PLCSIM defaults to 2, not 1).
• The PLCSIM (MPI) adapter driver is not installed, so "Set PG/PC Interface" has no PLCSIM option to select.

Every one of these faults collapses to the same HMI symptom because WinCC Flexible RT has no concept of a "soft PLC" — it only knows that it sent a frame, got no response, and gave up. The fix is in the wiring, not the screen.

2. Prerequisites

Verify the following before changing any configuration:

3. STEP 7 Classic Hardware Configuration for PLCSIM V5.3

PLCSIM V5.3 is a strict-MPI simulator. PROFIBUS-DP is not supported. The hardware configuration must therefore expose an MPI subnet on the CPU, not a DP master:

1. Open SIMATIC Manager → your S7 project → HW Config.
2. Double-click the CPU 3xx / 4xx slot. The Properties – MPI Interface dialog opens.
3. Confirm Interface type: MPI (not DP, not PN). If your CPU slot only shows DP, you loaded the wrong CPU order number; substitute an MPI-capable variant (e.g., 6ES7 315-2AG10-0AB0 for CPU 315-2 DP, MPI variant 6ES7 315-2AH14-0AB0).
4. Set the Address to 2. PLCSIM V5.3 uses station address 2 as the default; deviating from 2 means you must also override the address inside the running PLCSIM instance (see §4).
5. Set the Highest MPI Address on the subnet to 126 and the Transmission Rate to 187.5 kbps — these are the values PLCSIM V5.3 hardcodes internally.
6. Save and compile (Station → Save and Compile). The HW Config must be downloaded into PLCSIM — not into a physical CPU — once the simulator starts.

3.1 Why a DP CPU Order Number Breaks the Link

If the order number carries a "DP" suffix and the slot properties show Interface: PROFIBUS-DP master, WinCC Flexible RT can be configured perfectly and still fail. The frame that WinCC sends uses FDL services on PROFIBUS; PLCSIM V5.3 only opens an MPI-FDL listener on TCP-loopback. The result is a silent timeout and a "PLC disconnect" alarm every poll cycle.

4. STEP 7 Classic Hardware Configuration for PLCSIM V5.4 SP2

PLCSIM V5.4 SP2 introduced a transport-agnostic connector and a PLCSIM (MPI) virtual adapter. From SP2 onward, you can use either MPI or PROFIBUS as long as the HW Config agrees with the bus type you select in Set PG/PC Interface.

1. Open HW Config and verify the CPU's interface type (MPI or DP, depending on the order number).
2. Set the MPI/DP station address on the CPU to 2.
3. Set the HMI station address on the same subnet to 1 (WinCC Flexible is the master; PLCSIM is the slave).
4. Save and compile the station. The PLCSIM instance will accept the download in §5.

The advantage of V5.4 is that on the PLCSIM side you are prompted for the bus type at startup — the dialog enumerates the interfaces defined in your HW Config, so you simply pick the MPI or DP subnet you created and PLCSIM binds to it.

5. Starting PLCSIM and Loading the Station

Run these in order; reversing the order is a common cause of the "download to target system failed" message.

1. Start S7-PLCSIM V5.x from the Windows Start menu. The PLCSIM control panel appears (RUN/STOP, MRES, input/output LED matrix, scan-clock display).
2. From SIMATIC Manager: PLC → Download. The target system is "PLCSIM" if the driver is installed correctly.
3. Wait for the status bar in SIMATIC Manager to read Download (PLC) OK. PLCSIM should show RUN after a few seconds (if your OB1 is correct).
4. Leave PLCSIM running. Do not close it while WinCC Flexible RT is online.

6. Configuring the PG/PC Interface (PLCSIM Adapter)

This is the step that trips up most engineers. The PLCSIM (MPI) virtual adapter does not appear in the Set PG/PC Interface dialog until the PLCSIM V5.4 SP2 (or later) installation is present on the system. For V5.3 the adapter is a separate installation package.

1. Open the Windows Control Panel → Set PG/PC Interface (32-bit ODBC-style dialog under Siemens Automation).
2. Under Interface Parameter Assignment Used, select:
   • PLCSIM V5.3: PLCSIM (MPI) (only present if the adapter is installed).
   • PLCSIM V5.4 SP2+: PLCSIM (MPI) → MPI or PLCSIM (PROFIBUS) → PROFIBUS, depending on your HW Config bus type.
3. Click Properties on the adapter. Verify:
   • Own station address: 1 (the WinCC PC side).
   • Transmission rate: 187.5 kbps (PLCSIM V5.3) or auto-negotiate (V5.4).
   • Highest station address: 126.
4. Click OK → OK. The dialog confirms the active access point.

7. Configuring the WinCC Flexible 2007 Connection

In the WinCC Flexible 2007 engineering project:

1. Open the Project → Connections editor (or the Connections node in the project tree).
2. Create a new connection with these parameters:

   Parameter	Value (PLCSIM V5.3)	Value (PLCSIM V5.4 SP2)
   Communication driver	SIMATIC S7 300/400	SIMATIC S7 300/400
   HMI device	The PC running WinCC Flexible RT	Same
   Type	MPI	MPI or PROFIBUS (must match HW Config)
   HMI station address	1	1
   PLC station address	2	2
   Slot of MPI/DP port in PLC	2 (S7-300) or 2/3 (S7-400) — must match the CPU rack position in HW Config	Same
   Rack / Slot of CPU	0 / 2 for S7-300, 0 / 3 for S7-400	Same
   Cycle time	1 s (default)	1 s

3. Click Check Consistency. The connection must show a green check; a red X means the bus type, slot, or rack is wrong.
4. Save, compile, and start the runtime with Start → Runtime.

8. Launching WinCC Flexible RT Against PLCSIM

The startup order matters because WinCC Flexible RT tries to connect as soon as it boots, and PLCSIM has to be ready to accept that connection:

1. Start PLCSIM first. Wait for the RUN LED.
2. Verify the station was downloaded (PLC → Online → Monitor/Modify from SIMATIC Manager should show process values).
3. Start WinCC Flexible RT. Within 3–5 s the I/O field should display the live DBW/DBW value, and the alarm line should clear.

After a successful link, the runtime should remain stable for the entire engineering session. The only required re-cycle is when you change the slot, rack, or MPI address of the simulated CPU.

9. Why Online FC/FB Watch from STEP 7 Fails After the Link Is Up

A common second-order symptom: WinCC Flexible RT and PLCSIM are happily exchanging data, but a parallel Monitor/Modify in STEP 7 or a Variable Table watch throws "Online: cannot reach the partner". This is not a STEP 7 fault — it is a single-channel limitation of the PLCSIM virtual adapter.

The PLCSIM (MPI) virtual adapter exposes one logical channel. WinCC Flexible RT claims that channel as a master. STEP 7's online functions (Monitor, Variable Table, FC/FB online view) also need a master slot. The adapter only arbitrates one at a time. Practical remedies:

• Pause or stop WinCC Flexible RT before opening the online watch in STEP 7.
• Use the STEP 7 Monitor with Trigger option (F5 with conditional trigger) instead of an unconstrained Monitor — it returns the channel faster.
• On V5.4 SP2, install both the MPI and the PROFIBUS PLCSIM adapters and assign WinCC to one, STEP 7 to the other.
• Use PLCSIM's built-in Monitor window for quick value checks; it does not require the external channel.

10. Migrating to TIA Portal: PLCSIM (RT Unified) + WinCC Unified

The legacy stack described above is still fully supported on Windows 7 / Server 2008 R2 systems but is end-of-life. New deployments should move to TIA Portal V17+ with the PLCSIM (RT Unified) simulator and the WinCC Unified runtime. The connectivity model is simpler because everything is software-defined inside the TIA Portal project.

According to the official TIA Portal V20 documentation, "With PLCSIM you can test the configuration of your HMI device without the PLC required for it. PLCSIM simulates a PLC to which you connect the HMI device." The full procedure is documented at Using PLCSIM (RT Unified) – WinCC Unified.

10.1 Prerequisites (Modern Stack)

• TIA Portal V17 / V18 / V19 / V20 installed with the WinCC Unified option.
• S7-PLCSIM (RT Unified) — installed automatically with the TIA Portal Setup when you select the corresponding component.
• An HMI Unified device in the project (e.g., Unified Comfort Panel or WinCC Unified PC RT).
• A S7-1500 / ET 200SP CPU in the project. PLCSIM (RT Unified) is built around the S7-1500 instruction set; S7-300/400 CPU simulation in the modern stack requires the legacy S7-PLCSIM V5.x path described above.

10.2 Step-by-Step: Starting the Simulation

1. In the TIA Portal project tree, right-click the HMI device → Start simulation. TIA Portal will start PLCSIM (RT Unified) and the WinCC Unified RT in the same workspace.
2. PLCSIM (RT Unified) automatically picks up the PROFINET subnet defined in Devices & Networks for the simulated S7-1500 — no separate "Set PG/PC Interface" step is required because the connection is internal to the TIA Portal process.
3. Download the S7 program to the simulated instance: select the PLC in the tree → Download to device → Start simulation.
4. Use the PLCSIM (RT Unified) panel to toggle inputs, force values, and inspect the process image. The HMI tags update in real time on the connected WinCC Unified RT.
5. To stop, click Stop simulation on the HMI device node.

10.3 What Changes vs. the Legacy Stack

11. Commissioning Verification Matrix

Use this matrix to validate the link end-to-end. Every row should pass before you call the configuration complete.

12. Troubleshooting Matrix

13. Field-Proven Tips

• Keep the WinCC Flexible RT and the PLCSIM window visible side-by-side during commissioning — most "disconnect" faults are visible in the PLCSIM scan-clock display, which stops incrementing when the bus is idle.
• If you have multiple PLCSIM projects, name each PLCSIM instance differently; the virtual adapter is global to the host, and two PLCSIM instances will fight for it.
• For STEP 7 Classic, the order number 6ES7 315-2EH14-0AB0 is a reliable MPI+DP CPU that exercises both adapters; a safe default for new training rigs.
• When migrating a V5.3 project to V5.4 SP2, recompile the station and re-download; the S7-PLCSIM instance on V5.4 is not backward-compatible with the V5.3 station object.
• For the modern TIA Portal stack, prefer HMI device → Start simulation over PLC → Start simulation — the former guarantees the HMI launches its connection listener before PLCSIM (RT Unified) starts the simulated CPU.