PLCSIM Advanced Distributed Mode: Resolving Flash and Load Failures on VMware ESXi

PLCSIM Advanced V2.0 in distributed mode allows a TIA Portal engineering station on one physical machine to download, flash, and commission a virtual SIMATIC S7-1500 / ET 200SP CPU instance running on a separate Windows host. The architecture is straightforward in concept — a local PLCSIM Virtual Ethernet Adapter bridges the simulator to the physical network — but the implementation depends on a layered set of network features that many virtualization stacks disable by default. When any one of those features is misconfigured, the symptom is consistent: the S7-PLCSIM instance appears in the "Accessible devices" search result list on the remote TIA Portal, but every download or flash operation times out or fails with a generic error.

This reference documents the exact failure mode observed on a Windows 7 x64 host (updates through December 2017, no Meltdown/Spectre patches) running PLCSIM Advanced V2.0 inside an ESXi virtual machine, with TIA Portal V14 SP1 and V15 engineering stations on a separate physical PC. It documents the root cause (Promiscuous Mode on the ESXi vSwitch / Portgroup), the diagnostic path that proves the cause, the fix, and a broader set of related configuration points that produce the same or similar symptoms.

1. Problem Statement

The failure profile is highly specific and easy to misdiagnose as a TIA Portal configuration problem, a firewall issue, or a corrupted PLCSIM installation:

• PLCSIM Advanced V2.0 is installed on the simulation host (VM or physical PC).
• The PLCSIM Virtual Ethernet Adapter is created and bound.
• A S7-1500 / ET 200SP CPU instance is started in PLCSIM Advanced; the instance is reachable on the TCP/IP network (a ping to the instance IP succeeds from the remote engineering station).
• On the engineering station, TIA Portal V14 SP1 or V15 is launched and the user opens "Online → Accessible devices" or uses "Extended download to device".
• The "S7-1500 (PLCSIM)" entry appears in the result list of accessible devices, with its IP address and a correct target identifier.
• Selecting the device and pressing "Flash" or "Load" fails. The download dialog either times out, returns a generic "The device could not be reached" message, or hangs indefinitely.
• The same TIA Portal installation running on the same host as PLCSIM Advanced (i.e., locally attached to the PLCSIM Virtual Ethernet Adapter) successfully flashes and loads the simulated CPU.
• Replacing the simulated target with a real SIMATIC S7-1515 (or equivalent) connected to the same physical network segment succeeds without modification — download and flash complete normally.
• Windows Firewall is fully disabled on both hosts. UAC is fully disabled. The PLCSIM Virtual Ethernet Adapter is visible in the network connections list and shows link state up.

The combination of "visible in accessible devices, but cannot flash or load" is the diagnostic fingerprint of the distributed-mode Promiscuous Mode issue. A firewall would prevent visibility entirely. A misconfigured IP subnet would also prevent visibility. A real-hardware-OK / simulated-fail pattern rules out the physical network, the engineering station, and the TIA Portal installation as the source of the problem.

2. Why the PLCSIM Instance Is Visible but Not Loadable

PLCSIM Advanced uses a virtual Ethernet adapter that is implemented as a Windows network interface. When the simulator is started in distributed mode (TCP/IP broadcast mode), it transmits S7 discovery frames that mimic a Siemens CPU. The engineering station answers with a directed request, the simulator responds, and the CPU appears in the "Accessible devices" list. All of these transactions are normal unicast TCP/IP packets routed through the physical network.

The flash and load operations, however, use a different mechanism. PLCSIM Advanced relies on the host OS accepting and processing frames whose destination MAC address is not the host's own NIC MAC — the simulator's Virtual Ethernet Adapter uses one MAC address while the underlying physical NIC presents another. When TIA Portal sends a flash/load request to the simulator IP, the destination MAC in the frame may be resolved by ARP to the simulator's virtual MAC rather than the host's physical NIC MAC. A standard vSwitch in default configuration rejects frames whose destination MAC does not match any active uplink port, which causes the load/flash packet to be dropped silently.

This is precisely the case where VMware ESXi's Promiscuous Mode on the relevant Portgroup is required: it instructs the vSwitch to forward all frames observed on the port — including frames whose destination MAC is unknown to the switch — to the connected VM, allowing the PLCSIM Virtual Ethernet Adapter to receive and process them.

3. Root Cause Analysis

Three independent network layers must each permit the PLCSIM traffic to flow in distributed mode. If any one of them blocks the traffic, the visible-but-unloadable symptom appears:

In the reported incident, the host ESXi Portgroup was configured with Promiscuous Mode = Reject. PLCSIM Advanced discovery frames were forwarded (because they used the host's own physical MAC during the ARP exchange), so the engineering station could see the simulated CPU. Flash/load frames used the simulator's virtual MAC and were dropped at the vSwitch.

4. Solution: Enable Promiscuous Mode on the ESXi Portgroup

4.1 Prerequisites

• vSphere Client or ESXi web client access with permission to edit the host networking configuration.
• The name of the vSwitch and the specific Portgroup that the PLCSIM Advanced VM is connected to. In the vSphere UI this is under Host → Configure → Networking → Virtual Switches or Host → Networking → Port groups.
• Confirm that the PLCSIM Virtual Ethernet Adapter on the guest is up and has an IP address on the engineering subnet.

4.2 Step-by-Step Procedure

1. Open the vSphere Client and connect to the ESXi host or to the vCenter managing the host.
2. Select the host. Navigate to Configure → Networking → Virtual Switches.
3. Identify the Portgroup used by the PLCSIM Advanced VM. The Portgroup name typically matches the VM network label, e.g. "VM Network", "PLCSIM_Network", or a custom label.
4. Click Edit settings on the Portgroup (pencil icon).
5. Switch to the Security tab.
6. Set Promiscuous Mode from "Reject" to "Accept". (In some vSphere builds the option is labeled "Allow".)
7. Set MAC Address Changes to "Accept".
8. Set Forged Transmits to "Accept".
9. Click OK to apply.
10. No VM reboot is required. The new settings take effect immediately for the Portgroup.
11. From the engineering station, retry the download/flash in TIA Portal. The operation should complete in seconds.

5. Verifying the Fix

After enabling Promiscuous Mode, validate the configuration in three ways before considering the issue closed:

1. TCP connectivity test. From the engineering station, run ping <PLCSIM_instance_IP>. The reply should arrive in < 1 ms on a local segment. A failed ping points to a remaining L3 issue (subnet, route, or firewall) rather than Promiscuous Mode.
2. TIA Portal flash test. Open the project, right-click the target device, select "Online → Extended download to device", select "S7-1500 (PLCSIM)" from the list, confirm "Flash" is selected, and press "Flash". The flash should complete in seconds and report success. A repeated failure with the same fingerprint indicates a residual configuration problem at a different layer.
3. Wireshark confirmation. On the engineering station, run Wireshark on the interface facing the PLCSIM network. Filter on the PLCSIM instance MAC address (eth.addr == <PLCSIM_MAC>). During a download attempt, you should see the TIA Portal → PLCSIM TCP three-way handshake and the S7 download PDUs. If Wireshark shows the engineering station transmitting but no responses, the problem is downstream — typically Promiscuous Mode is still not applied to the correct Portgroup.

6. Related Configuration Points

6.1 PLCSIM Virtual Ethernet Adapter Selection

PLCSIM Advanced binds the simulated CPU to a single Windows network interface. The instance dialog presents the list of available interfaces, including physical adapters and the PLCSIM Virtual Ethernet Adapter. The selection is per-instance and persistent across reboots of the simulator service.

A common mistake is to bind PLCSIM to the Local Area Connection when the host's intended distributed network is actually a different physical interface (e.g. a separate NIC for the engineering VLAN). When binding to a wrong interface, the simulator responds only on that interface, and the remote engineering station will not see the CPU at all — different symptom from the Promiscuous Mode issue, but worth verifying with ipconfig /all and the instance IP.

6.2 Windows Network Stack Considerations

The PLCSIM Virtual Ethernet Adapter is a kernel-mode NDIS driver. The following host-side conditions interfere with distributed-mode operation:

• Windows Firewall: Must allow inbound traffic on the simulator's TCP ports (typically TCP/102 for S7-communication). Even with Firewall reported as off, verify with netsh advfirewall show allprofiles.
• Third-party endpoint protection: Some enterprise security suites inject a filtering driver above NDIS and silently drop frames whose source/destination MAC does not match a known binding. Disable or whitelist PLCSIM in such suites before testing.
• Hyper-V vSwitch (nested virtualization): If the PLCSIM host is itself a Hyper-V VM with the "Virtual Switch Manager" in default mode, frame handling mirrors the ESXi problem. Use an External switch bound to a Promiscuous-Mode-enabled physical NIC.

6.3 TIA Portal Compatibility Matrix

The PLCSIM Advanced V2.0 release was shipped alongside TIA Portal V15 and updated for V15.1, V16, V17, and V18 in subsequent updates. TIA Portal V14 SP1 is technically compatible with PLCSIM Advanced V2.0 but has known limitations with newer CPU firmware versions:

Mismatched versions — for instance, TIA V16 trying to load a project targeting CPU firmware V2.9 into a PLCSIM V2.0 instance that only supports up to V2.6 — produce a download-time error rather than the visible-but-unloadable fingerprint. The fingerprint remains characteristic of the network-layer issue.

7. Status Indicators and Other Non-Simulated Behaviors

A separate but commonly confused limitation applies when using "Extended download to device" in TIA Portal: the CPU status-indicator LEDs are not simulated by PLCSIM Advanced. This is documented in the PLCSIM Advanced user manual and applies regardless of network configuration. The behavior affects:

• RUN/STOP/ERROR LED transitions during download
• MAINT (maintenance) LED state changes
• Link/Activity LEDs on the PROFINET ports of the simulated CPU

If a user observes that download completes successfully but no LED change is visible on the PLCSIM instance window, this is expected behavior, not a network problem. PLCSIM Advanced V2.0 and later simulate the operational state of the CPU internally (the instance dialog reports the current state) but the visual LED indicators are reserved for hardware targets.

8. PLCSIM Advanced and Safety Programs

PLCSIM Advanced supports testing of fail-safe (F-CPU) programs. The F-program runs in the same simulated CPU instance as the standard program and shares the same network identity. No additional Portgroup configuration is required beyond what is needed for the standard program.

Per the TIA Portal safety programming documentation (linked in the references at the bottom of this article), the F-CPU is simulated when:

1. The TIA Portal project has a Safety Administration Editor configured.
2. The F-CPU in the project is an S7-1500F / ET 200SPF variant (or S7-1500 with F-capability activated).
3. PLCSIM Advanced instance is started with the matching CPU type.
4. The download target includes both the standard and safety programs.

If distributed mode download is configured correctly (Promiscuous Mode enabled), safety program download follows the same path and completes with the standard program.

9. PLCSIM Advanced Versions and the Fix

The Promiscuous Mode requirement is not specific to PLCSIM Advanced V2.0. It applies to all PLCSIM Advanced versions from the initial V1.0 release through V7.0 (current at the time of writing) when used in distributed mode inside a virtualized host. Newer versions add CPU firmware coverage and additional features but do not change the underlying network model. The same vSwitch setting applies.

Recommended reference for the architecture overview: S7-PLCSIM Advanced - Getting Started (PDF). The "Getting Started" document includes a network-architecture diagram that confirms the Virtual Ethernet Adapter model and the broadcast/unicast handling described above.

10. Diagnostic Decision Matrix

Use the following matrix to localize the failure mode before applying any change:

11. Field-Engineering Notes

• Apply Promiscuous Mode to the smallest possible scope. Create a dedicated Portgroup (or VLAN-backed Portgroup) for the PLCSIM host VM, attach only that VM, and enable Promiscuous Mode on the Portgroup rather than on the entire vSwitch. This keeps the L2 exception isolated to the engineering test network.
• Document the deviation. Promiscuous Mode triggers audit findings in many OT environments. Document the change, the justification, the affected VM, and the rollback procedure in the site's network exception register.
• Test the rollback. Before applying the fix, verify that disabling Promiscuous Mode immediately stops distributed-mode downloads — this confirms the setting is the actual cause and not coincidentally enabled.
• Check for nested virtualization. If the PLCSIM host VM is itself hosted on an ESXi host that is itself a VM (nested ESXi), Promiscuous Mode must be enabled at every layer of vSwitch in the chain, including the outer physical ESXi.
• Confirm firmware of the S7-1500 CPU in the TIA project matches what PLCSIM Advanced can simulate. The flash operation may succeed even when the load fails because of a firmware mismatch — but a fingerprint of "visible + flash fails" still points to the network issue, not firmware.

12. FAQ