Resolving PLCSIM Advanced V3.0 Symbolic Addressing Failures

1. Problem Overview

Symbolic addressing is the TIA Portal mechanism that exposes DB offsets, I/O channels, and tag structures by their engineering names ("Motor_Start_Cmd", "Conveyor_Speed") instead of their absolute byte/bit addresses (DB100.DBX0.0, IW64). On a physical S7-1500 CPU, symbolic names are resolved through the optimized block access metadata that the compiler writes into the download blocks. When a third-party OPC server or native S7 driver queries the controller for the symbol table, it reads that metadata and binds human-readable names to runtime values.

PLCSIM Advanced V3.0 simulates the S7-1500 runtime, but it does not fully replicate the symbol-resolution handshake that the S7Comm Plus protocol uses for symbolic read/write. The result is that any client that negotiates symbolic access (InduSoft SITIA, Siemens S7-OPC, NetToPLCSim when used with symbolic clients, and most Kepware Siemens TCP/IP Ethernet drivers in symbolic mode) returns quality BAD for every tag, hangs the subscription, or fails the initial S7_GET_SYMB_BLOCK request with a 0x0A (object does not exist) fault.

The legacy workaround—switching the driver profile from symbolic to absolute addressing and re-binding tags to DBx.DBBi/DBx.DBWj references—restores communication immediately. This is the same protocol channel the physical S7-300 / S7-400 CPU has always used, and PLCSIM Advanced emulates it cleanly.

2. PLCSIM Advanced Communication Architecture

PLCSIM Advanced runs as a Windows service that hosts one or more virtual S7-1500 instances. Each instance binds a TCP/IP socket on the local machine and advertises itself as a fully-fledged S7-1500 CPU to the network. According to the SIMATIC S7-PLCSIM Advanced Function Manual, the simulator supports:

• S7Comm and S7Comm Plus on TCP/102
• OPC UA Server on TCP/4840 (read/write of runtime tags only)
• Transport layer API for soft-PLC integration
• Web API of the S7-1500 CPU (limited subset)

Three architectural constraints directly affect third-party driver behavior:

1. No PC station configuration. PLCSIM Advanced does not use a SIMATIC NET PC station. The virtual PLC is a stand-alone CPU on the network. There is no Softbus, no S7DOS help, and no PC-internal S7 routing through a CP. Drivers that require a configured OPC Scout or PC station entry will fail during channel initialization.
2. Static IP matching required. The IP address that PLCSIM Advanced binds must match the IP address configured on the PLC node in the STEP 7 / TIA Portal project. If the Windows network adapter is on 192.168.0.10 but the project assigns 192.168.0.20, the virtual PLC will respond to 192.168.0.20 only if that address is also routed to the host. Using an APIPA address 169.254.x.y is the typical workaround when no fixed IP is available.
3. Single instance per virtual PLC. Each PLCSIM Advanced instance can simulate exactly one CPU. Running multiple virtual PLCs requires multiple instances and multiple IP addresses on the host network interface (or multiple virtual NICs).

3. Why Symbolic Addressing Fails with Third-Party HMI/SCADA Drivers

The S7-1500 protocol negotiates symbolic access through a three-step handshake:

1. The client requests the symbol list via the S7_GET_SYMB_TABLE request group.
2. The CPU returns the compressed symbol table from the loaded blocks.
3. The client binds tags by symbolic name and issues S7_READ_SYM / S7_WRITE_SYM requests that carry the symbolic handle, not the absolute address.

PLCSIM Advanced answers step 1 with an empty or partial symbol table because the simulator does not load the full block compilation metadata that TIA Portal generates for a real CPU. Specifically, the SDB (System Data Block) container that holds symbol-to-address mapping is built when the project is downloaded to a physical CPU; the PLCSIM Advanced download path populates only the runtime code and the absolute-address interface.

Drivers that attempt step 3 with the handle returned from a partial table receive the S7Comm Plus error 0x0A (object does not exist) for every tag. Drivers that attempt step 1 and receive an empty table either fall back to absolute addressing (some Kepware profiles) or fail outright (InduSoft SITIA symbolic profile, Wonderware DAServer with symbolic binding enabled).

The OPC UA server embedded in PLCSIM Advanced, in contrast, exposes only the runtime namespace at opc.tcp://<PLCSIM-IP>:4840 with nodes whose NodeId matches the symbolic tag name. This is the path that works when symbolic access is required; the S7Comm symbolic path does not.

4. Documented Failure Cases

The following table summarizes the observed behavior across the most common third-party drivers used against PLCSIM Advanced V3.0 with an S7-1500 emulation profile.

5. Root Cause: SDB Container and Optimized Block Access

Two design choices in PLCSIM Advanced explain the failure:

1. Optimized block access only. S7-1500 DBs created in TIA Portal default to "Optimized block access". With optimization on, the symbol table is the only way to address the data; absolute addresses change between compilations. PLCSIM Advanced stores optimized blocks but does not expose the symbol metadata to S7Comm clients. The TIA Portal HMI connection is exempt because it reads the symbol table directly from the project XML, not from the runtime.
2. SDB write-back is suppressed. When TIA Portal downloads to PLCSIM Advanced, the Download to device dialog warns that system data blocks are not written. The runtime code is loaded, but the S7-1500 system blocks that hold routing tables, symbol tables, and module parameters remain at their initial state.

The combined effect is that the simulated CPU behaves as a physical CPU whose symbol database has been wiped. The OPC UA server, however, builds its address space at runtime from the loaded blocks and is unaffected.

6. Diagnostic Procedure

Follow this sequence to confirm that a third-party driver failure is caused by the symbolic-address limitation rather than network reachability, firewall, or licensing problems.

1. Confirm the virtual PLC is reachable. Open a command prompt and run ping <PLCSIM-IP>. A reply confirms L3 connectivity; absence of reply points to a network binding issue (wrong IP, multiple NICs, APIPA routing).
2. Confirm S7Comm responds. Use a tool such as s7client, Wireshark with the s7comm dissector, or the PLCSIM Advanced Virtual Ethernet Adapter trace. Issue a S7_CONNECTION_REQUEST to TCP/102. A successful S7_CONNECTION_RESPONSE confirms the CPU is alive on S7Comm. An immediate RST points to firewall blocking or to PLCSIM Advanced not yet started.
3. Issue an absolute read. From the same tool, read DB 1, DBW 0 using the S7_READ_REQ function group. A successful response with the configured value confirms the absolute channel works.
4. Issue a symbol table request. Send S7_GET_SYMB_TABLE with request type = 0x12. Expected response is an empty or short payload that omits most symbols. This is the PLCSIM Advanced signature.
5. Issue a symbolic read. From the same tool, attempt to read a known symbolic tag. Expect an error 0x0A (object not exist) or 0x06 (invalid parameter).
6. Compare with the OPC UA endpoint. Connect a generic OPC UA client (UaExpert is free for evaluation) to opc.tcp://<PLCSIM-IP>:4840. Browse the namespace. If the symbols appear under Objects/<PLC>/<Tags>, the runtime data is correct; only the S7Comm symbolic channel is broken.

If steps 1-3 succeed and step 4 returns an empty table, the issue is the PLCSIM Advanced symbolic limitation described in this article. If step 2 fails, fix the network binding first. If step 3 fails, the absolute channel is also broken—verify the DB is not optimized for non-symbolic access or that the DB number exists in the project.

7. Workaround: Configure Absolute Addressing in TIA Portal

For projects that must run against PLCSIM Advanced V3.0, the recommended path is to keep the S7-1500 program in TIA Portal but expose all HMI/SCADA tags as absolute DB addresses and rebind the third-party driver profile.

7.1 Disable optimized block access on tag DBs

1. Open the project in TIA Portal V17 or later.
2. In the project tree, right-click the tag DB (for example, DB_HMI_Tags) and select Properties.
3. Open Attributes and uncheck Optimized block access.
4. Repeat for every DB that HMI/SCADA clients must read or write.
5. Recompile the project. TIA Portal will assign fixed offsets; document the offsets in the HMI tag list.

7.2 Assign symbolic alias for engineering reference

Keep the symbolic names in the tag DB so the PLC program remains readable. The DB will have both names (for the PLC programmer) and fixed offsets (for the SCADA driver). This is the typical pattern:

DATA_BLOCK "DB_HMI_Tags"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
NON_RETAIN
  STRUCT
    Motor_Start_Cmd : BOOL;       // DB1.DBX0.0
    Motor_Stop_Cmd  : BOOL;       // DB1.DBX0.1
    Conveyor_Speed  : INT;        // DB1.DBW2
    Tank_Level_PCT  : REAL;       // DB1.DBD4
  END_STRUCT;
END_DATA_BLOCK

7.3 Configure the third-party driver for absolute addressing

The exact dialog labels vary by driver; the pattern is the same:

1. Open the driver configuration in InduSoft Web Studio, Kepware, or Wonderware IDE.
2. Create a new channel. For Siemens Ethernet, select SIETH (InduSoft), Siemens TCP/IP Ethernet (Kepware), or DASSIDirect (Wonderware).
3. Set the device IP to the PLCSIM Advanced virtual CPU address (for example, 192.168.0.20).
4. Set rack/slot to 0 / 1 for an S7-1500 emulation profile.
5. In the tag database, enter the tag names using absolute addresses: DB1.DBX0.0, DB1.DBW2, DB1.DBD4. Do not enter symbolic names.
6. Set the appropriate data type (BOOL, INT, REAL) for each tag.
7. Save and activate the channel. Quality should immediately transition from BAD to GOOD.

8. Network Configuration Constraints for PLCSIM Advanced

The following constraints are documented in the SIMATIC S7-PLCSIM Advanced Function Manual and have direct impact on driver connectivity:

• No PC station. Drivers that require a SIMATIC NET PC station (configured with STEP 7 "Configure PC Station") will fail. Use a raw TCP/IP Ethernet driver instead.
• IP address binding. Set the IP address on the network interface card of the Windows host to match the STEP 7 project, or assign the PLCSIM Advanced virtual Ethernet adapter the address configured in TIA Portal. Mismatched addresses result in silent driver failures.
• Multiple instances. Each PLCSIM Advanced instance requires a unique IP. Use multiple host NICs or virtual NICs if more than one virtual CPU is needed for parallel HMI tests.
• Firewall. Allow inbound TCP/102 (S7Comm) and TCP/4840 (OPC UA) on the Windows firewall rule set. Both ports must be open on the profile used by the host network adapter.
• Time synchronization. If the HMI uses time-of-day tags (timestamps, shift counters), ensure the PLCSIM Advanced virtual CPU clock is set correctly. The clock starts at the host system time of the Windows machine when the instance is started.

9. Alternative Approaches

Three engineered paths exist for teams that need symbolic tags but cannot use the absolute-address workaround.

9.1 OPC UA client channel

Configure the HMI/SCADA client to connect to the OPC UA server embedded in PLCSIM Advanced at opc.tcp://<IP>:4840. The OPC UA address space mirrors the symbolic tag structure exactly because OPC UA nodes are built from the loaded block metadata. Most modern HMI platforms (InduSoft via OPC DA/UA bridge, Ignition, WinCC Unified, AVEVA System Platform with OPC UA I/O) support this path. This is the recommended path when the customer cannot refactor the TIA Portal project to non-optimized DBs.

9.2 NetToPLCSim tunnel with absolute driver

NetToPLCSim is an open-source TCP tunnel that allows older clients (e.g., legacy WinCC flexible, third-party S7-200 drivers, certain OPC servers) to reach a PLCSIM or PLCSIM Advanced instance. The tunnel translates plain S7Comm between client and simulator. Run the tunnel, point the client at the tunnel's local port, and bind the client to absolute addressing. Symbolic access over NetToPLCSim fails for the same reason it fails on PLCSIM Advanced directly: the simulator does not serve the symbol table.

9.3 Hybrid: physical or software controller for FAT

For Factory Acceptance Tests where the HMI/SCADA must use symbolic addressing, run the test against a physical S7-1500 CPU (or an S7-1500 Software Controller on an IPC). PLCSIM Advanced is suitable for PLC code development and for absolute-address HMI testing; it is not a drop-in replacement for symbolic HMI acceptance testing.

10. Verification Procedure

After applying the absolute-addressing workaround or OPC UA reconfiguration, confirm connectivity with the following checks:

1. Open the driver diagnostics view (InduSoft Main Driver Sheet, Kepware Quick Client, Wonderware DAServer Manager).
2. Verify the channel status shows Communicating or Active.
3. Read a known tag (for example, a heartbeat in DB1.DBW0 that the PLC program toggles every second). Confirm the value changes.
4. Write a test value to a writable tag (for example, DB1.DBW100). Read it back from the driver and from the PLC program via a watch table in TIA Portal. Confirm both show the same value.
5. Subscribe to the tag and confirm the subscription updates at the configured poll rate without quality transitions.
6. If using OPC UA, browse the server namespace and confirm the node count matches the expected number of tags. Use the OPC UA client's Read and Write dialogs to confirm round-trip integrity.
7. Reboot the PLCSIM Advanced instance and confirm the driver auto-reconnects within the configured retry timeout (typically 5-15 s).

11. Limitations and Field-Proven Caveats

12. Frequently Asked Questions