Connecting WinCC Unified HMI Simulation to PLCSIM Configuration

Overview

Engineering a WinCC Unified runtime project against a real SIMATIC S7-1200, S7-1500, or ET 200 CPU is rarely the first step on a new machine. The standard commissioning flow is to bring up the HMI in the TIA Portal simulation, validate screen navigation, tag wiring, and alarm behavior, and only then move to a physical controller. The bottleneck in that flow has always been coupling the HMI simulation to a PLC simulation, because two distinct runtime instances must agree on the same transport, the same access point, and the same S7ONLINE routing path.

Since TIA Portal V17, Siemens formally supports running WinCC Unified Comfort Panel simulation in parallel with S7-PLCSIM (the standard variant) on the same engineering station. Earlier V16 attempts produced the diagnostic "The selected object cannot be downloaded to device" and the connection between the panel simulation and the PLC simulation would not establish because the S7ONLINE access point could not resolve a Unified runtime endpoint. With V17, the unified runtime is registered as a valid S7ONLINE target, and a standard PLCSIM instance is registered as the corresponding partner CPU.

This article walks through the supported configuration paths, the two most common failure modes (PG/PC interface mismatch and the V16 incompatibility), and the verification checks that confirm a working HMI-to-PLC simulation link. Examples are written for TIA Portal V17 and later, including V20, with notes on PLCSIM Advanced for projects that need larger tag counts, distributed I/O, or multi-CPU simulation.

Prerequisites

Before starting, confirm that the engineering station meets the tool-stack requirements. A misaligned TIA Portal / PLCSIM / WinCC Unified version pair is the most common reason the simulation pair refuses to start.

Verify that the TIA Portal installation includes the WinCC Unified option package and the S7-PLCSIM option package. On Siemens downloads, the package is SIMATIC STEP 7 incl. Safety, S7-PLCSIM and WinCC V17 TRIAL for trial users, while production deployments must license the WinCC Unified Comfort add-on separately.

PG/PC Interface and S7ONLINE Access Point

Every WinCC Unified runtime — physical or simulated — communicates with STEP 7 through the S7ONLINE access point. The PG/PC interface assignment is therefore the single most important setting in the entire flow. If the access point does not resolve to the loopback instance that PLCSIM publishes, the Unified runtime will silently fail to establish the S7 connection and the panel will show a connection-loss alarm on every screen.

1. Close all TIA Portal instances.
2. Open the Windows Control Panel → Set PG/PC Interface applet (the classic 32-bit applet, not the modern Windows settings).
3. Under Application Access Point, select S7ONLINE (STEP 7) -> TCP/IP (Auto) when using a hardware Ethernet adapter against PLCSIM Advanced in Ethernet Adapter mode.
4. When running PLCSIM Advanced over its PLCSIM Adapter virtual NIC, select S7ONLINE (STEP 7) -> PLCSIM Adapter (or PLCSIM Virtual Ethernet Adapter depending on driver wording).
5. Click OK and confirm the dialog warning about overwriting the assignment.

Step-by-Step: PLCSIM Standard + WinCC Unified (TIA V17+)

This is the supported, official path for a single-CPU project that targets an S7-1500 (or S7-1200 with V4.4 firmware and later) and a Unified Comfort Panel.

1. In TIA Portal, open the project that contains the PLC and the HMI device.
2. Right-click the PLC in the project tree and choose Start simulation. PLCSIM opens, powers on the instance, and the PLC enters RUN.
3. Right-click the HMI device (Unified Comfort Panel) and choose Start simulation. TIA Portal builds the Unified runtime and starts a local RT process that emulates the panel.
4. Open Online → Simulation → Start from the menu bar if the toolbar icon is hidden. All three paths (context menu, toolbar, menu) are equivalent per the Siemens TIA Portal V20 Unified simulation manual.
5. In the HMI simulation window, navigate to a screen that binds a tag from the PLC. The tag value should update as soon as the PLC is in RUN and the connection is up.
6. To stop: close the PLCSIM window (this drops the connection cleanly) and then stop the Unified simulation from the toolbar.

Step-by-Step: PLCSIM Advanced + WinCC Unified

PLCSIM Advanced is required whenever the standard PLCSIM cannot load the hardware configuration (for example, projects with safety blocks, multi-CPU PN/IO, or projects that need a TCP/IP listen socket from the CPU program). The configuration steps differ because PLCSIM Advanced exposes its own virtual Ethernet adapter and a separate Instance model.

1. Start PLCSIM Advanced and create a new instance. Set Communication Interface to PLCSIM Virtual Ethernet Adapter (or Ethernet Adapter to bind a physical NIC).
2. Set the CPU type to match the project's PLC (for example, CPU 1516-3 PN/DP) and click Start.
3. In TIA Portal, open the project, then go to Online → Accessible Nodes and confirm that the PLCSIM Advanced instance appears with its IP address.
4. Download the hardware configuration and the program to the PLCSIM Advanced instance. Power on the CPU and place it in RUN.
5. Set the PG/PC interface to S7ONLINE (STEP 7) -> PLCSIM Adapter (or the matching virtual adapter entry). This is the entry point that PLCSIM Advanced registers at install time.
6. Start the HMI simulation as in the standard flow. The Unified runtime resolves the S7ONLINE endpoint to the PLCSIM Advanced instance and the connection establishes.
7. To stop, power off the PLCSIM Advanced instance (this triggers a clean connection-loss alarm in the panel) and close the PLCSIM Advanced window.

Connection Configuration in the HMI Project

The HMI connection must be configured as a SIMATIC S7-1500 (or S7-1200) type and pointed at the CPU whose instance is running in PLCSIM. The most common mistake is leaving the connection on the S7-300/400 type inherited from a copied project — PLCSIM Unified will not bring up that connection.

The address parameter in the HMI connection editor should be set to the IP address of the simulated CPU. For PLCSIM standard, the project will normally pre-populate this from the device configuration (typically 192.168.0.1 or whatever was set in the device properties). For PLCSIM Advanced, verify the IP shown in the Accessible Nodes window matches the HMI connection target.

Troubleshooting Matrix

Verification Checks

Once both simulations are running, run a structured verification before declaring the rig ready for screen-level testing. Each check isolates a single layer of the stack so that any future failure points to a specific subsystem.

1. PLC side: In PLCSIM, add a watch table on a tag that the HMI references (for example, "DB_HMI".Speed). Force the value and confirm the HMI screen updates within one poll cycle (default 1 s for cyclic tags).
2. HMI side: Open the Unified simulation, navigate to the screen bound to that tag, and confirm the displayed value matches the watch table.
3. Alarm side: Trigger a discrete alarm in the PLC. The Unified alarm control should show the alarm as active with the configured priority and text.
4. Connection diagnostics: In the HMI simulation, open System diagnostics → Connections. The status of the S7-1500 connection should read Connected and the statistics counters should be incrementing.
5. Download on change: Edit a tag, recompile the HMI, and confirm the change is pushed to the running simulation without the "selected object cannot be downloaded" error. If the error reappears, the PG/PC access point has been redirected to a non-PLCSIM adapter.

Working with S7-1200 in the Simulation Loop

S7-1200 support in the PLCSIM + WinCC Unified pair is also enabled from TIA V17. The CPU must be on firmware V4.4 or later, and the project must use the S7-1200 device variant that is license-compatible with PLCSIM (the standard PLCSIM includes the S7-1200 simulation). The configuration steps are identical to the S7-1500 case; only the device substitution in the project tree changes.

When the target firmware is older than V4.4, the standard PLCSIM refuses to load the configuration with a "Firmware version not supported" error. In that case, switch the engineering target to a newer CPU variant in the project (without changing the physical deployment), simulate against PLCSIM, and then swap back to the original firmware at the time of hardware download.

Why V16 Fails and What Changed in V17

Under TIA V16, the Unified Comfort runtime was not registered as a discoverable S7ONLINE endpoint for the panel simulation. The S7ONLINE stack saw the running PLCSIM instance but had no second S7ONLINE consumer to pair it with, so the connection could not be established and the engineering environment returned the "selected object cannot be downloaded to device" message. Standard Comfort panels (for example, TP700 Comfort) used a different runtime path that was already registered in S7ONLINE, which is why a TP700 panel could be downloaded against PLCSIM V16 even though the Unified Comfort panel could not.

V17 introduced the necessary runtime registration, allowing the Unified simulation to consume the S7ONLINE channel that PLCSIM publishes. The release also added a tight integration in the project tree so that the Start simulation command on a Unified panel and on a PLCSIM instance share lifecycle and resource state. For further reading on the V20 simulation flow, see the Siemens TIA Portal V20 Unified simulation manual and the Siemens KB attachment 109748099 on simulating HMI projects with SIMATIC controllers.

Field-Proven Caveats

• Always start PLCSIM before the HMI simulation. If the HMI sim is already up when the PLC sim starts, the S7ONLINE endpoint negotiation can fail silently and the connection will stay down until both are restarted.
• If you have multiple NICs (for example, a corporate Ethernet and a USB-to-Ethernet adapter for the machine network), bind PG/PC interface to the adapter that physically reaches the simulated CPU. A mismatch is the dominant cause of Accessible Nodes returning an empty list.
• Do not stop PLCSIM while the HMI simulation is still running. Stop the HMI first, then PLCSIM. Stopping PLCSIM first produces a controlled connection-loss alarm that the operator screens must handle, but stopping the HMI first is the cleaner shutdown path.
• Unified simulation caches the last known S7ONLINE endpoint for the duration of the RT process. Changing the PG/PC interface assignment while the HMI sim is running does not redirect the cached connection. Stop and restart the HMI sim after any PG/PC interface change.
• For projects with multiple HMI devices, each HMI must establish its own S7ONLINE connection to the same PLCSIM instance. PLCSIM supports multiple concurrent partner connections on a single simulated CPU.

FAQ