Fix S7-PLCSIM 'Unable to Reach Module CPU' Error in STEP 7 V5.x

Problem Overview

When launching S7-PLCSIM V5.4 in STEP 7 V5.x (V5.4, V5.5, or V5.6) and attempting to download hardware configuration or program blocks to the simulated CPU, the download frequently aborts with the diagnostic:

This error blocks the entire download sequence, leaving the simulated CPU in STOP or unconnected state. The project blocks remain in the offline S7 program directory and never reach the simulated instance, which means VAT tables, force tables, and online monitoring cannot be started. The error is consistently reproducible in fresh projects where PLCSIM is the only programming target and is independent of the offline program logic.

Root Cause Analysis

The error is a routing misconfiguration in the SIMATIC Manager workstation, not a defect in PLCSIM itself. Three independent routing layers must be aligned before any download can succeed:

1. PG/PC interface access point — the symbolic name that SIMATIC Manager uses to look up a transport. The default access point is S7ONLINE, which points to real hardware (e.g., PC Adapter MPI, CP5611, TCP/IP auto).
2. Active network in the project — the subnet declared in the hardware configuration (MPI, PROFIBUS, or Industrial Ethernet) that logically connects the simulated CPU to the programming device.
3. PLCSIM internal coupler — a software-only MPI/PROFIBUS/TCP node inside S7-PLCSIM.exe that the simulator exposes to STEP 7.

When the PG/PC interface is bound to a real adapter such as PC Adapter (MPI), CP5611 (MPI), or TCP/IP > Intel(R) ..., SIMATIC Manager attempts to enumerate a physical node at the configured MPI/PROFIBUS/TCP address. The scanner waits for a frame from the master, never receives one (because the CPU exists only inside PLCSIM), and reports the timeout as Unable to reach the module ... by means of the subnet. The communication server aborted message is the secondary effect — STEP 7's internal route service tears down the pending download after the timeout.

Correctly routing to PLCSIM requires the PLCSIM access point bound to PLCSIM.MPI.1, PLCSIM.PROFIBUS.1, or PLCSIM.TCPIP.1 as the parameter assignment, matching the active subnet of the project.

Affected Versions and Components

The error is independent of the firmware of the simulated CPU — the route is resolved at the workstation before the simulated firmware is contacted. CPU31x firmware versions 2.x, 3.x, and 4.x are equally affected because the misconfiguration is on the host side, not the simulated CPU.

Prerequisites

• STEP 7 V5.x with a Service Pack matching PLCSIM (V5.4 for PLCSIM V5.4, V5.5 for V5.5, V5.6 for V5.6).
• S7-PLCSIM installed under the same Windows user that runs SIMATIC Manager; first launch requires administrator rights to register the virtual MPI/PROFIBUS/TCP couplers.
• A valid STEP 7 project containing a station with an S7-300 CPU (e.g., CPU314) in an MPI, PROFIBUS, or Industrial Ethernet subnet.
• No residual PLCSIM instance from a previous crash. Verify in Windows Task Manager — kill any S7-PLCSIM.exe and S7DOS.exe processes before retrying.
• No active Ethernet firewall rule blocking loopback traffic to S7-PLCSIM.exe on TCP ports 102, 5000, or 49152–65535.

Solution: PG/PC Interface Configuration for PLCSIM V5.4

Three settings are typically required; one of them is the root cause in approximately 95% of installations.

Step 1 — Open the PG/PC Interface

1. In SIMATIC Manager, select Options > Set PG/PC Interface...
2. The application's access point defaults to S7ONLINE (highlighted at the top of the list). This default is the source of the error.

Step 2 — Select the PLCSIM access point

1. Change the Application access point dropdown to PLCSIM (not S7ONLINE).
2. From the Interface Parameter Assignment Used list, select one of the three PLCSIM transports matching the project's active subnet:
   • PLCSIM.MPI.1 — when the CPU is on an MPI subnet (default for CPU31x; 187.5 kbps, address 2).
   • PLCSIM.PROFIBUS.1 — when the CPU is on PROFIBUS DP.
   • PLCSIM.TCPIP.1 — when the CPU is on Industrial Ethernet and the project uses ISO-on-TCP (RFC1006) or TCP native.
3. Click OK and confirm the warning that the assignment will affect the entire workstation. The change is written to HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\Automation\Interfaces\TopFieldbus\PLCSIM.

Step 3 — Add the PLCSIM transport if missing

If the PLCSIM.MPI.1, PLCSIM.PROFIBUS.1, or PLCSIM.TCPIP.1 entries are not listed, the virtual couplers have not been registered. Reinstall PLCSIM in repair mode (Control Panel > Programs > S7-PLCSIM V5.4 > Repair), or re-run SETUP.EXE from the installation media. The installer registers the three transport keys under the path above.

Step 4 — Verify the assignment in SIMATIC Manager

1. Re-open Options > Set PG/PC Interface and confirm the assignment reads PLCSIM > PLCSIM.MPI.1 (or whichever PLCSIM transport was selected).
2. Select PLC > Download to Target System > All or use the toolbar Download button. The download should complete in 1–3 seconds with Download successful appearing in the status bar.

PLCSIM Architecture Deep Dive

Understanding the S7-PLCSIM process model explains why a single PG/PC setting can route an entire download session.

• S7-PLCSIM.exe — the main simulator process. Loads the simulated CPU image (S7-300 CPU314, CPU315, etc.) into a virtual memory space, emulates OB1, OB35, OB100, OB101, OB121, OB122 execution, and exposes the cyclic, time-of-day, and diagnostic interrupt behavior.
• S7DOS.exe — the SIMATIC DOS Helper. Bridges the 16-bit S7DBS routing logic used internally by STEP 7 to the 32-bit PLCSIM process. When the download fails with communication server aborted, S7DOS is usually the component that tore down the connection.
• SIMATIC IEPG Helper — handles the ISO and TCP transport stack for PLCSIM.TCPIP.1. Required even for loopback connections; missing or blocked by antivirus leads to timeout errors.
• PLCSIM.MPI.1 / PLCSIM.PROFIBUS.1 / PLCSIM.TCPIP.1 — virtual adapter names registered as Windows S7 transports. They are not real network adapters; they are pointers inside the registry to the PLCSIM coupler service.

The default S7ONLINE access point does not see PLCSIM transports because S7ONLINE is bound to the active hardware adapter set in Set PG/PC Interface > Standard Bus Profile. The PLCSIM access point is a parallel binding that selects the virtual coupler only.

Step-by-Step Commissioning Procedure

1. Close any running PLCSIM instance. Confirm S7-PLCSIM.exe and S7DOS.exe are not present in Windows Task Manager (Details tab).
2. In SIMATIC Manager, open the project and verify the station contains an S7-300 CPU with a valid MPI/PROFIBUS/Ethernet address (default MPI address 2, baud rate 187.5 kbps).
3. Open Options > Set PG/PC Interface, switch the application access point to PLCSIM, and bind it to PLCSIM.MPI.1 (or the matching PLCSIM transport).
4. Click the Simulate On button in SIMATIC Manager (or press Ctrl+E) to launch PLCSIM. The simulator window opens with an empty S7-300 panel.
5. In the PLCSIM window, select the CPU type (e.g., CPU 314) from the CPU menu. The default MPI address is 2; leave it unchanged unless the project specifies a different address.
6. Use Insert > Input/Output/Flag/Timer/Counter to add monitoring views for any I/O the program will read or write.
7. Press RUN-P in PLCSIM (the green power button + Run toggle) to power the simulated CPU on. The status indicator changes from STOP to RUN; if the CPU remains in STOP, no program has been downloaded yet.
8. In SIMATIC Manager, select the S7 Program(1) node and press Ctrl+L (or right-click > Download to Target System). The blocks transfer to PLCSIM in 1–3 seconds.
9. Open VAT, the program editor, or a force table in online mode. The status bar should display Online: connected to target CPU with a non-grey background.

Verification

Confirm the simulation is live by performing the following checks:

• Online view: Open any OB (typically OB1) in online mode (right-click > Open > Online). The editor must display Online: connected to target CPU in the status bar with the program code visible and not greyed out.
• Diagnostic buffer: In SIMATIC Manager, PLC > Diagnostic/Setting > Diagnostic Buffer. The latest entries should show the boot sequence, project checksum match (Module identification OK), and no Subnet error or Communication fault entries.
• Module status: PLC > Diagnostic/Setting > Module Information. The CPU name, type, MPI/PROFIBUS/IE address, and firmware version must match the hardware configuration in the project.
• VAT test: Force a digital output in VAT, observe the change in the PLCSIM Output view within one OB1 cycle. Force a digital input from PLCSIM and observe the corresponding flag or process value in VAT.
• Cyclic OB test: If OB35 is used, monitor its call interval in the PLCSIM Timer view. The default is 100 ms; deviation indicates the CPU is not in RUN.

Error Code Reference

Connection Troubleshooting Matrix

Testing Safety Programs with PLCSIM

For Safety Integrated programs running on F-CPUs, both S7-PLCSIM (classic, S7-300F) and S7-PLCSIM Advanced (TIA Portal, S7-1500F) can simulate the standard and safety program in parallel without physical hardware. The same PG/PC interface fix described above applies — set the access point to PLCSIM (or to the PLCSIM Advanced instance) before commissioning. Key constraints are documented in the official TIA Portal help:

• The F-CPU type must be available in the PLCSIM catalog. CPU 315F-2 PN/DP, CPU 317F-2 PN/DP, CPU 319F-3 PN/DP, and the F-CPU variants of S7-1500 (CPU 1511F, 1515F, 1516F, 1517F, 1518F) are supported.
• The F-signature must match between the offline project and the simulated runtime; if the safety program is recompiled, re-download the entire safety program to PLCSIM and confirm the signature in the safety summary.
• The PROFIsafe addresses of distributed F-modules must be unique within the configured PROFIsafe subnet and within the supported range (1–1023 for PROFIsafe over PROFINET or PROFIBUS).
• Discrepancy time, watchdog time, and F-source/destination address parameters from the hardware configuration are honored by the simulator; they are read from the F-I/O device description at the time of download.

Migration to S7-PLCSIM Advanced

For TIA Portal projects, PROFINET, S7-1500, ET 200SP CPU, or multi-instance simulation, migrate from S7-PLCSIM V5.x to S7-PLCSIM Advanced. The Advanced variant runs as a Windows service (no UI by default), exposes a .NET API for test automation, and supports multiple virtual controllers per host. It is delivered as a TIA Portal add-on (V15.1+) with a separate floating or single license.

The migration path is: (1) archive the STEP 7 V5.x project using the source archive tool, (2) migrate in TIA Portal using the V5.x migration tool, (3) install S7-PLCSIM Advanced, and (4) re-run the same download sequence — TIA Portal's Online > Accessible Devices view auto-resolves the Advanced instance and the PG/PC interface is configured per project.

Field-Engineer Tips and Common Pitfalls

• Always close PLCSIM via the menu (File > Exit) rather than the window close button. The close button leaves S7DOS.exe and SIMATIC IEPG Helper running, which can cause the next PLCSIM launch to fail with station address in use.
• Do not enable Force with safety programs in PLCSIM. The simulated F-CPU honors the F-runtime group integrity check; forcing inputs across PROFIsafe boundaries triggers an Passivation event and the F-runtime group stops.
• Match the MPI baud rate in HW Config to the PLCSIM default (187.5 kbps). If the project was created for a CPU with MPI 1.5 Mbps (CPU318-2), explicitly set the subnet baud rate before downloading — otherwise the download will fail with interface parameter assignment is not consistent.
• For large projects (more than 4 MB of blocks), increase the PLCSIM working memory in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\Automation\PLCSIM\Memory. The default 8 MB is sufficient for typical S7-300 programs, but large library projects with many FBs can exceed it.
• When running PLCSIM on a virtual machine (e.g., VMware Workstation, Hyper-V), enable Promiscuous Mode = Accept on the virtual switch for the host's network adapter. Without it, the loopback ISO-on-TCP frames between PLCSIM and external OPC servers may be silently dropped.
• Time synchronization between PLCSIM and external clients (HMI, SCADA) requires the workstation clock to be set to local time; PLCSIM does not sync to an NTP source. If the HMI displays a clock drift, verify the workstation time zone is set correctly.
• For team simulation, do not run two workstations with PLCSIM on the same MPI network. PLCSIM uses broadcast frames that collide when more than one instance is reachable on the same subnet. Use S7-PLCSIM Advanced with explicit IP addresses per instance instead.

FAQ