Resolving PLCSIM and SIMATIC NET OPC Server Communication Issues

Overview

Engineers developing S7-300, S7-400, and WinAC-based control programs frequently need a complete offline simulation environment that exposes process data to OPC DA and OPC UA clients (HMIs, SCADA, MES, historians, custom .NET applications). The native S7-PLCSIM simulator from Siemens executes the STEP 7 user program, but it does not natively publish tags through the SIMATIC NET OPC Server because the OPC server binds to the S7 communication API rather than to the simulated backplane that PLCSIM uses for PG/OP routing. This technical reference explains the architectural reason for that mismatch, enumerates the workarounds (WinLC, PLCSIM OPC Server, NetToPLCSIM with SIMATIC NET, and Softnet-DP/IE routing), and documents the verification steps required to confirm tag quality before a customer-facing demonstration, factory acceptance test, or training session.

Architectural Background: How SIMATIC NET OPC Reaches a CPU

SIMATIC NET OPC DA server (programmatic identifier OPC.SimaticNET.1) and the newer SIMATIC NET OPC UA server do not communicate with the S7 CPU through the same internal channel that STEP 7, WinCC, ProTool/Pro, and the S7BlockServer (PG Layer 4) use. The OPC stack is built on the S7-API and the SCP s7onlinx transport. When an OPC tag is configured with the syntax

the SIMATIC NET OPC server opens the physical Communication Processor (CP) adapter that has been assigned to the configured access point (for example S7ONLINE). That adapter is typically a CP 5611, CP 5613, CP 5614, CP 1623, or a standard Ethernet NIC bound to the S7ONLINE access point through the SIMATIC NET Configuration Console. As long as the OPC server is calling that physical adapter, it cannot see the simulated backplane that PLCSIM injects at the PG/OP layer.

Why PLCSIM Detours Only PG/OP Traffic

PLCSIM installs a virtual interface that intercepts the S7ONLINE access point for PG Layer 4 calls. Any client that uses the S7BlockServer (STEP 7 online, WinCC flexible, ProTool/Pro, older WinCC projects) is automatically redirected to the simulated CPU when PLCSIM is running. The OPC server, however, uses the S7-API directly and is not redirected. The result is:

• Tags come up with OPC QUALITY_BAD (status code 0xC0040007, OPC_QUALITY_COMMUNICATION_FAILURE in DA 2.05a / 3.0).
• Item handle is created, but Read and Subscribe calls return E_FAIL or S_FALSE.
• No connection entry appears in the SIMATIC NET Configuration Console's connection diagnostics, because the call never reached the configured partner CPU.

Workaround Matrix

Workaround 1: NetToPLCSIM Routing the SIMATIC NET OPC Server

The free NetToPLCSIM utility (open-source, maintained on SourceForge and mirrored by several Siemens Solution Partners) provides a virtual Ethernet interface that bridges the SIMATIC NET OPC server's S7-API calls back into a running PLCSIM instance. The mechanism is a TCP/102 listener that impersonates a Siemens S7 CPU and forwards fetched/transmitted PDUs to the local PLCSIM instance over the loopback path.

Prerequisites

• STEP 7 V5.5 SPx with PLCSIM V5.4 SP5 or newer.
• SIMATIC NET V8.x or V14+ with OPC server installed (license key "SIMATIC NET PC SW V14" or earlier).
• Windows user account with administrator privileges for the loopback driver install.
• An unused IP address on the local loopback (commonly 192.168.0.100 / 24) or on a secondary NIC that is not bound to S7ONLINE.

Step-by-Step Configuration

1. Disable the SIMATIC NET OPC server's default S7ONLINE access point for the target connection so it does not try to bind the physical adapter. Open SIMATIC NET Configuration Console > SIMATIC NET PC Software > S7ONLINE > Access Points, set Interface Parameter Assignment Used to None, and create a new access point (e.g., S7ONLINE_NetTo) bound to the loopback NIC.
2. Start PLCSIM and power on the simulated CPU (S7-300 with MLFB 312, 314, 315-2 DP, or 317-2 PN/DP; S7-400 with 412, 414, 416 supported).
3. Launch NetToPLCSIM. Click Start, then Add. In the dialog enter: IP = the loopback IP (e.g., 192.168.0.100); Port = 102; Rack = 0; Slot = 2 (default for S7-300 CPU in PLCSIM); Connection type = S7-300/400 TCP/IP single channel. Click Add then Start Server.
4. Configure the SIMATIC NET OPC connection in SIMATIC NET Configuration Console > OPC > Connections. Use the new access point S7ONLINE_NetTo. The partner IP is the loopback address of NetToPLCSIM. Rack/slot must match the PLCSIM CPU.
5. Browse the OPC DA namespace from a test client (OPC Scout V10, Matrikon Explorer, or a custom .NET 4.8 client using OpcRcw.Da) and confirm tags return OPC QUALITY_GOOD (0xC0000000) with timestamp values that update during scan.

Known Issue: Same-IP Loopback

If the SIMATIC NET OPC server's IP address and the OPC connection's partner IP are identical (both pointing to 127.0.0.1 or to the same NIC), the SIMATIC NET server can refuse to bind the connection. The diagnostic log shows event ID 0x0001 from source "SIMATIC NET OPC" with text "Cannot assign the requested address". Mitigation: assign NetToPLCSIM a routable address that is different from the host's primary IP, or use a secondary loopback adapter with 192.168.0.0/24 addressing.

Workaround 2: WinLC Soft-PLC as an OPC Source

WinLC (Windows Logic Controller) is the WinAC family soft-PLC that executes STEP 7 user programs directly on a Windows host. Unlike PLCSIM, WinLC implements a real S7 communication stack and is fully reachable by the SIMATIC NET OPC server over MPI, Profibus (via CP 5611), or Industrial Ethernet (TCP/102). WinLC is shipped with STEP 7 Professional and is runnable in demo mode for 14 days without a license key.

Configuration Procedure

1. Install WinLC RTX (Windows XP embedded SP3 / Win 7 / Win 10 LTSC supported) or the slot PLC variant for an S7-300 slot.
2. Open STEP 7 / SIMATIC Manager and download the project to WinLC exactly as you would to a hardware CPU. WinLC appears as a target under Accessible Nodes > TCP/IP with default IP 192.168.0.1.
3. Switch the CPU to RUN-P. The status LED on the WinLC front panel is implemented as a tray icon (green = RUN, yellow = STOP-request, red = fault).
4. In SIMATIC NET Configuration Console create an S7 connection with type S7 connection, partner IP = WinLC's IP, rack 0, slot 1 (WinLC slot). Bind the connection to an access point that the OPC server will use.
5. Test with OPC Scout V10: drag a tag from the symbol table, confirm QUALITY_GOOD and subscription callbacks at the configured update rate (typical 500 ms, 1000 ms, or 2000 ms).

Limits of WinLC

• User program must compile for the WinLC's supported instruction set. WinLC RTX supports the full S7-300 instruction set plus a subset of S7-400 (SCL is supported, GRAPH up to STEP 7 V5.5 SP4).
• Cycle time floor of ~10 ms on a modern x86 host; OB35/OB1 jitter is ~1 ms typical.
• Hardware interrupts (OB40) from real I/O are not simulated; use a hardware CP and an external I/O simulator if process I/O is required.

Workaround 3: PLCSIM OPC Server (Siemens add-on)

From PLCSIM V5.4 SP5 onward, Siemens bundles a thin PLCSIM OPC DA Server (programmatic ID OPC.PLCSIM.1) that reads/writes directly into PLCSIM's memory map. It only supports the OPC DA 2.05a interface, not OPC UA. The server is enabled by selecting Tools > PLCSIM OPC Server in PLCSIM and choosing a port (default 3000). Clients connect to that port and see a flat namespace of inputs (I), outputs (Q), memory (M), timers (T), counters (C), and data blocks (DB).

When to Use

• OPC DA only is acceptable.
• Project is a single S7-300 program without complex multi-CPU or H-station topology.
• Target client is a custom .NET or C++ DA client that can be pointed at the alternate CLSID.

Workaround 4: Direct WinCC Path (No OPC Required)

If the consumer is WinCC flexible 2008 SP5 / WinCC RT Advanced V13+ / WinCC Professional V14+, the HMI tag server uses the S7BlockServer (PG Layer 4) path. PLCSIM transparently redirects that path, so the HMI can communicate with the simulated CPU without any OPC configuration at all. This is the simplest solution for in-house demos and training, but it does not satisfy the requirement when an external third-party OPC client must read process data.

Verification Procedure for Any Workaround

1. Tag quality probe – Subscribe to a known boolean (e.g., DB1.DBX0.0) and a known float (e.g., MD10). Both must report OPC_QUALITY_GOOD with monotonic timestamps.
2. Round-trip latency – Toggle a tag from the OPC client and measure the time until the simulated program observes the change. With NetToPLCSIM and a 1 ms PLCSIM scan, expect 5–15 ms end-to-end.
3. Subscription storm test – Subscribe to 1000+ tags at 100 ms update rate. CPU usage on the host should remain < 30 % for NetToPLCSIM and < 10 % for WinLC RTX.
4. Failover – Stop PLCSIM or NetToPLCSIM mid-run and confirm the OPC client receives OPC_QUALITY_BAD with error code 0x80000000 rather than hanging.

Diagnostic Event IDs

Recommended Stack by Use Case

Capacity and Timing Specifications

• NetToPLCSIM: ~120 PDUs/s sustained per connection, max 8 concurrent S7 connections, max 512 tags per connection.
• PLCSIM OPC Server: max 2048 items per server instance, update rate floor 50 ms.
• SIMATIC NET OPC DA Server: max 32 000 tags per server, min browse interval 10 ms, max subscription rate 100 ms recommended to avoid CPU saturation.
• SIMATIC NET OPC UA Server: max 50 000 nodes, min publishing interval 100 ms, max monitored items per subscription 2000 (default 500).
• WinLC RTX: OB1 cycle 5–10 ms typical, OB35 jitter < 0.5 ms, max 8 connection resources.

Safety and Licensing Notes

• WinLC demo mode times out after 14 days; an automation license manager (ALM) license is required for continuous operation.
• SIMATIC NET OPC Server requires a valid license key tagged to the host's Microsoft HostID or to a parallel USB dongle.
• NetToPLCSIM is free for non-commercial use; verify license terms with the distributor before commercial deployment.

Closing Recommendations

For a single S7-300 program that must expose tags to an OPC DA client, the most reproducible path is PLCSIM + NetToPLCSIM + SIMATIC NET OPC DA. For OPC UA exposure or multi-CPU simulation, use WinLC RTX + SIMATIC NET OPC UA. Reserve the bundled PLCSIM OPC Server for lightweight CI/CD automation. Always validate tag quality, latency, and failover behavior before locking the stack into a customer-facing demo.