Resolving PLCSIM S7-1200 TCP Communication with HyperTerminal

Problem Overview

Engineers frequently attempt to validate S7-1200 TCP communication by pairing the PLCSIM simulator with a standard terminal emulator such as HyperTerminal, PuTTY, or Tera Term. The expected workflow is straightforward: instantiate a simulated CPU in TIA Portal, drop a TSEND_C / TRCV_C pair onto an OB1 network, start PLCSIM, then open a TCP socket from the host PC and exchange ASCII characters. In practice, the connection either never establishes or is dropped immediately after the first frame.

This is not a programming error in the user program, a firewall misconfiguration, or an IP/subnet mismatch. The root cause is an architectural constraint in the PLCSIM runtime that prevents external applications from binding to the simulated CPU's TCP endpoints. The behavior applies to PLCSIM (TIA-integrated) and to PLCSIM Advanced for the S7-1200 and S7-1500 firmware families.

PLCSIM Runtime Architecture and External TCP

PLCSIM (the simulator embedded in TIA Portal) implements the S7 communication stack as a virtual interface that is reachable only by other Siemens applications running on the same Windows host — specifically the TIA Portal engineering environment and the WinCC RT / HMI simulator. The virtual Ethernet adapter that PLCSIM presents is bound to a localhost-only loopback channel; it is not bridged to the physical NIC, nor is it exposed to a routable IP space for arbitrary TCP clients.

For the S7-300/400 firmware families, the open-source tool NetToPLCSIM can be inserted between the Windows TCP/IP stack and the PLCSIM instance to translate external TCP frames on port 102 (ISO-on-TCP / RFC1006) into the internal PLCSIM API. NetToPLCSIM is, in effect, a man-in-the-middle that proxies S7 communication to a simulated S7-300 or S7-400.

For the S7-1200 and S7-1500 firmware families, this proxy path is not implemented. The reason is that S7-1200/1500 use a different connection establishment handshake (optimized block communication, integrated security slots, and a different TSEND_C opcode map) that NetToPLCSIM does not implement for those CPU types. Attempting to point NetToPLCSIM at an S7-1200/1500 instance produces either a silent drop or an "unsupported CPU type" message in the NetToPLCSIM log.

Why HyperTerminal Cannot Reach a Simulated S7-1200

HyperTerminal — and any equivalent terminal emulator that uses Winsock to open a raw TCP socket — sends its initial SYN to the IP address of the simulated CPU. In a typical test setup the engineer assigns the simulated CPU the address 192.168.0.1, the host PC 192.168.0.250, and the PC station running HyperTerminal 192.168.0.3. PLCSIM is not bound to 192.168.0.1 on the physical or virtual NIC stack; that address lives only inside the TIA Portal topology view and is used by PLCSIM for its internal address book. The Windows kernel therefore responds with "no route to host" or "connection refused" depending on local routing table entries.

TSEND_C / TRCV_C Configuration Reference

Before changing the test environment, confirm the user program itself is correct. The following parameterization is the canonical S7-1200 TCP send/receive pair. Both blocks are documented in the S7-1200 Programmable Controller System Manual and the TIA Portal online help.

TSEND_C parameters (send direction):

• REQ — Trigger to send (e.g., a positive edge from a clock bit)
• CONT — TRUE to keep the connection open after the send completes
• LEN — Length of data to send; 0 means use DATA length
• CONNECT — Pointer to the connection description DB (TCON_IP_V4 type)
• DATA — Source tag, e.g. P#DB1.DBX0.0 BYTE 200
• COM_RST — Optional reconnect trigger
• DONE, BUSY, ERROR, STATUS — Standard output bits

TRCV_C parameters (receive direction):

• EN_R — TRUE to enable reception
• LEN — Max receive length; set to 0 for length-prefixed mode
• CONNECT — Same TCON_IP_V4 DB
• DATA — Destination tag
• COM_RST — Optional reconnect trigger
• NR_DT — New data flag (rising edge indicates fresh frame)

TCON_IP_V4 connection description (data block, simplified):

DATA_BLOCK "ConnDB"
  STRUCT
    InterfaceId    : HW_ANY  := 64;          // 64 = local PROFINET interface X1
    ID             : CONN_OUC := 1;          // Connection ID (must be unique)
    ConnectionType : BYTE    := 16#0B;       // 0x0B = TCP/IP (RFC 793)
    ActiveEstablishment : BOOL := TRUE;      // TRUE = PLC acts as active partner
    RemoteAddress   : IP_V4 := 192.168.0.250;// Peer IP (HyperTerminal host)
    RemotePort      : UINT  := 2000;         // Peer port
    LocalPort       : UINT  := 0;            // 0 = any local port
  END_STRUCT;
END_DATA_BLOCK

If the user program uses ActiveEstablishment := TRUE with the peer IP set to the HyperTerminal host, the CPU attempts an outgoing connect — but with a simulated CPU that outgoing connect still has nowhere to go because no IP stack is bound to 192.168.0.1 at the OS level.

Status Codes You Will See

For PLCSIM with an S7-1200/1500 and a HyperTerminal partner, 16#80C4 or "stuck in 16#7001" is the most common failure signature.

Workaround 1 — Use a Real S7-1200 CPU

The most reliable path for a terminal-emulator test is a real S7-1200 CPU on the bench. This is also the configuration used in the official Siemens sample program that demonstrates HyperTerminal ↔ S7-1200 ASCII exchange over TCP. The sample is hosted on the Siemens Industry Online Support forum as reference entry 49723 and is the recommended starting point for engineers who need to prove the protocol stack end-to-end.

Required hardware:

• S7-1200 CPU with PROFINET interface, e.g. CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0) or CPU 1215C DC/DC/DC (6ES7215-1AG40-0XB0)
• 24 V DC power supply (PS 305 / SITOP)
• Ethernet cable (Cat 5e or better) between CPU and PC

Procedure:

1. Assign the CPU the IP address 192.168.0.1 / mask 255.255.255.0 in the CPU's online & diagnostic view or directly on the display (CPU 1214C/1215C with firmware V4.x and later).
2. Assign the host PC 192.168.0.250 / 255.255.255.0.
3. Confirm reachability: ping 192.168.0.1 from the Windows command prompt must succeed.
4. Build a TIA Portal project with TSEND_C and TRCV_C as above. Download to the CPU and place it in RUN.
5. Launch HyperTerminal (or Tera Term, or PuTTY in raw TCP mode). Connect to 192.168.0.1 on TCP port 2000.
6. Trigger a send from the user program. ASCII characters appear in the terminal window. Characters typed in the terminal land in the PLC's receive buffer on the rising edge of NR_DT.

Workaround 2 — Use PLCSIM Advanced for S7-1500

If a real PLC is not available, PLCSIM Advanced is the only simulation path that exposes a routable TCP/IP interface to external applications. PLCSIM Advanced supports the S7-1500 and ET 200SP CPU families (and the S7-1200 with limitations; see notes below). It installs a virtual Ethernet adapter ("Siemens PLCSIM Virtual Ethernet Adapter") on the host Windows system. The simulated CPU is bound to that adapter, and any Windows process — including HyperTerminal, PuTTY, Tera Term, or a custom .NET / Python TCP client — can open a socket to the virtual CPU's IP.

PLCSIM Advanced versions and CPU support:

PLCSIM Advanced setup for HyperTerminal:

1. Install PLCSIM Advanced V3 or later. The installer registers the "Siemens PLCSIM Virtual Ethernet Adapter" in Windows Device Manager.
2. In TIA Portal, configure the CPU's PROFINET interface with IP 192.168.0.1 / 255.255.255.0 as in a real CPU. Compile and download the project to the PLCSIM Advanced instance (right-click the device → "Download to → PLCSIM Advanced").
3. Start the PLCSIM Advanced instance and bring the simulated CPU to RUN.
4. From the Windows host, open a command prompt and confirm the virtual NIC is bound: ipconfig /all should show an adapter with the subnet 192.168.0.x.
5. Confirm reachability: ping 192.168.0.1 from the host command prompt must succeed.
6. Launch HyperTerminal and connect to 192.168.0.1 on TCP port 2000 (or whatever port is configured in the TCON_IP_V4 structure).
7. Trigger a send from TSEND_C in the simulated CPU. ASCII characters appear in the terminal.

The OPC UA server of the simulated CPU listens on port 4840 by default; that port can be changed in the CPU hardware configuration under "OPC UA Server." Note that OPC UA is a different protocol from the raw TCP used by TSEND_C / TRCV_C and is not what HyperTerminal will speak.

Workaround 3 — Re-Architect the Test

If neither a real CPU nor PLCSIM Advanced is available, the HyperTerminal test can be replaced with a TIA-internal alternative that exercises the same TSEND_C / TRCV_C logic without external socket plumbing:

• PLCSIM + WinCC RT on the same host. Run an HMI tag trace inside the TIA engineering station. WinCC RT can poll TSEND_C.STATUS and TRCV_C.NR_DT and display the data in a text field. The HMI runtime is a sanctioned external consumer of the PLCSIM instance, so no bridge tool is required.
• Loopback test inside the CPU. Wire TSEND_C.DATA to TRCV_C.DATA on a single simulated CPU using the internal connection mode (a TCON_IP_V4 with the local IP and an ActiveEstablishment := FALSE configuration that listens on a local port). This proves the user program end-to-end without any external partner.
• Python TCP client on the same host. A small Python script that opens a raw socket to the PLCSIM Advanced virtual IP is a lighter-weight replacement for HyperTerminal and gives full control over framing.

Diagnostic Checklist

Frequently Asked Questions