Resolving PLCSIM V15.1 Input Tag Byte-Offset Bug on S7-1200

Problem Overview

When commissioning an S7-1200 program in S7-PLCSIM V15.1 under TIA Portal V15.1, engineers who force or modify 16-bit integer input tags through the SIM table monitor may observe the simulator writing the forced value to the wrong byte boundary. Entering a value of 1 into the Monitor/Modify dialog for a tag declared as %IW0:P results in the simulator reporting a value of 256 internally and setting bit %I0.0 instead of the expected %I1.0. The result is a one-byte offset error in the process image of the inputs (PII).

This defect is reproducible with the standard PLCSIM distribution that ships with the TIA Portal V15.1 media package and with V15 base installations. Single-byte data types (Bool, Byte) and memory tags (%MW0, %MD0, %DB...) are not affected. The bug is restricted to the input process image area and, more precisely, to 16-bit input words located on the CPU's onboard (base) digital input module. Signal modules (SMs) that present a 16-bit or wider input image do not exhibit the symptom.

Affected Versions and Products

Siemens Online Support has classified the behavior as a software defect in the PLCSIM internal address translation when a forced value is written back to the process image of the inputs through the SIM table dialog. The official support entry that documents the resolution is Siemens Support Entry 109764220.

Root Cause Analysis

Inside PLCSIM, the input process image is a mirror of the I/O area that the simulated S7-1200 CPU reads at the start of the OB1 cycle. The Monitor/Modify dialog uses an absolute byte index to inject a forced value. In the affected build, the byte index calculation for 16-bit input tags originating on the base CPU strips the most-significant byte of the addressing math, which shifts the write target by one byte lower in the PII. The displacement is observed only when the input is on the onboard digital input channel group of the simulated CPU, because the base input area is the first 16-bit input word (%IW0) in the I-address space and is the only location where the miscalculation lands inside a valid, observable PII byte.

Engineers using signal modules see the symptom only when the module is configured as a 16-bit input that overlaps the affected base-CPU address. Because the SM input area is logically distinct, the simulator's address translator applies a different code path and the offset is corrected automatically.

Reproducing the Defect

1. Open TIA Portal V15.1 and load or create an S7-1200 project. The CPU type is not material; any S7-1200 CPU with onboard digital inputs (e.g., CPU 1214C DC/DC/DC) reproduces the issue.
2. Open the PLCSIM instance and start the simulation. Wait for the CPU to reach RUN.
3. Add a new SIM table (right-click the PLC → Start > Simulation, then Project > SIM tables).
4. Insert a tag of data type Int or Word with the address %IW0:P (process image of the inputs). Set the Modify value column to 1.
5. Click Modify now (force with care: enable the "Modify with trigger" or "Modify once" mode as appropriate).
6. Observe the Monitor/Modify result. With the defect present, the simulator reports 256 (decimal) and the bit %I0.0 is set, not %I1.0.
7. Repeat the test with a single-byte tag such as %IB0:P or with a memory tag such as %MW0. These tags behave correctly.

Resolution: Install PLCSIM V15.1 Update 1

Siemens released Update 1 for S7-PLCSIM V15.1 to correct the byte-offset translation. The fix is delivered as a hotfix installer that can be applied on top of an existing TIA Portal V15.1 installation. The official Siemens entry that lists the download is Entry ID 109764220. If the direct link is unreachable from the engineer's network (e.g., behind a corporate proxy that strips Siemens support attachments), use the TIA Software Updater, which carries the same update package.

Prerequisites

• TIA Portal V15.1 installed and licensed.
• Local administrator rights on the engineering workstation.
• All PLCSIM instances and TIA Portal closed during the update.
• Approximately 600 MB of free disk space for the unpacked update.
• Internet access to the Siemens Industry Online Support or the TIA Software Updater service.

Step-by-Step Update via TIA Software Updater

1. Open the TIA Administrator (Start → Siemens Automation → TIA Administrator) or, on systems where TIA Administrator is not installed, launch the TIA Software Updater directly from C:\Program Files\Siemens\Automation\TIA Software Updater.
2. Click Check for updates. The tool queries the Siemens update server and lists every installed TIA Portal component that has a newer revision.
3. Locate S7-PLCSIM V15.1 Update 1 in the result list. Confirm the version string in the Description column reads Update 1 or the build number printed on the Siemens support page for entry 109764220.
4. Select the package and click Download and install.
5. Accept the license agreement. The installer copies the updated PLCSIM.dll and the SIM table components into the TIA Portal installation tree.
6. Restart the workstation. PLCSIM Update 1 is only loaded by the TIA Portal launcher when the path cache is refreshed.

Step-by-Step Update via Direct Download

1. Navigate to Siemens Support Entry 109764220.
2. Sign in with a Siemens Industry Online Support account that has a valid Support Request or a current TIA Portal maintenance contract.
3. Download the self-extracting archive for SIMATIC S7-PLCSIM V15.1 Update 1.
4. Right-click the archive and run as administrator. The installer detects the existing TIA Portal V15.1 path automatically.
5. Follow the prompts. Reboot when requested.

Verifying the Fix

1. Open TIA Portal V15.1 and start a new PLCSIM instance.
2. Load the same project that reproduced the issue.
3. Open the SIM table and force the tag %IW0:P with the value 1.
4. Confirm that the monitor returns 1 and that bit %I1.0 is set in the PII (use the "Monitor/Modify" view on a Bool tag bound to %I1.0 or inspect the program online).
5. Repeat the test for a negative value, e.g. -1. The simulator should report 65535 in unsigned terms and set all 16 bits of %IW0 without crossing into %IB0.
6. Test a 32-bit tag such as %ID0:P with the value 1. The result must be 1 (i.e., bit %I2.0 set) and not 65536 or any other displaced value.
7. Force a memory tag (%MW0) and a single-byte input (%IB1:P) to confirm no regression was introduced by the update.

Workarounds When Update 1 Cannot Be Installed

If the workstation is locked to a specific TIA Portal revision and the update cannot be deployed immediately, the following workarounds preserve simulation fidelity while avoiding the buggy code path:

1. Add a 16-bit signal module in the device configuration. Place a digital input SM (for example, SM 1221 DI 16 x 24 V DC) in slot 1 of the S7-1200 rack. Move the test tags to the SM's I-address range. The byte-offset bug does not affect 16-bit SM input words.
2. Force the lower byte directly. Modify %IB0:P and %IB1:P independently. Because the bug is specific to 16-bit modify operations on the base CPU, byte-level forces work correctly.
3. Use a memory tag as a staging area. Force %MW0 with the desired value, then move the word into %IW0:P in a program block. PLCSIM evaluates standard program instructions correctly; the bug is limited to the SIM table modify path.
4. Use the "Force " column instead of "Modify". A force is applied by the simulated CPU during the cycle and bypasses the modify dialog. In PLCSIM V15.1, the force path uses a different code branch that is not affected by the byte-offset defect. Toggle the "Force " symbol in the SIM table and verify the PII bit in the online view.
5. Compile and run on a real S7-1200 for final sign-off. The defect is purely a PLCSIM simulation artifact. Real CPU behavior is unaffected, so the project must be validated on hardware before release.

Process Image and Addressing Reference

The S7-1200 family uses an automatic update of the process image. Inputs are copied from the physical modules into the PII at the start of OB1. The CPU reserves 32 bytes of input process image by default, expandable up to 1024 bytes through the device configuration. The Monitor/Modify SIM table writes to the PII directly, so engineers who need a deterministic test environment should understand the byte ordering used by the simulator:

The S7 family stores multi-byte values in little-endian order: the least-significant byte occupies the lowest address. Forcing the decimal value 1 into %IW0:P should always set %I1.0 because that is bit 0 of the least-significant byte of the word at byte offset 0. The PLCSIM V15.1 defect misroutes the write to %I0.0 (bit 0 of the high byte of the previous word, or bit 8 in linear numbering).

Interaction with External OPC Servers and S7 Drivers

Engineers who connect PLCSIM to OPC UA servers, S7 communication drivers, or third-party tools (e.g., node-RED S7 nodes, Python snap7-based HMI prototypes) sometimes observe a complementary symptom: the tag reports a bad quality code, a stale value, or a non-deterministic reply. The cause is usually that the OPC server or driver is configured to read the peripheral I/O address (%IW0:PE for "peripheral input") rather than the process image, or to issue a write to a process image word that the simulator has not yet allocated. The fix is to:

1. Verify that the S7 connection's PDU size is 240 bytes (PLCSIM default) and the TSAP is correctly paired (e.g., 01.01 on the SIM side).
2. Use %IW0:P in the client rather than the peripheral area, because PLCSIM maintains a coherent process image even when the underlying module is simulated.
3. Confirm that the PLC is in RUN with the project loaded. PLCSIM rejects most read/write operations when the simulated CPU is in STOP.

Diagnosing Other PLCSIM Anomalies

Engineers who encounter additional PLCSIM V15.1 quirks should follow a structured isolation flow:

1. Open the TIA Portal Diagnostics view and confirm that PLCSIM reports no internal error codes. The error counter for the SIM table is found in Online > Diagnostics > SIM table.
2. Compare the result with a real S7-1200 CPU. If the symptom appears on the real CPU, the project configuration is at fault; if it appears only in PLCSIM, suspect a simulator defect.
3. Capture the PLCSIM log file at %LOCALAPPDATA%\Siemens\Automation\PLCSIM\Logs. Forward the log to Siemens Support with the project archive (TIA Portal → Project > Archive) when opening a Support Request.
4. Search the Siemens Knowledge Base at support.industry.siemens.com for the symptom string. Entry 109764220 is the canonical reference for the byte-offset issue.
5. Verify that the operating system is on the TIA Portal V15.1 compatibility list. Windows 7 SP1, Windows 10 (build 1709 or later), and Windows Server 2016 are supported; older builds can mask bugs in the simulation layer.

Best Practices for S7-1200 Simulation

• Always keep PLCSIM and TIA Portal on the same major.minor version. Mismatched revisions (e.g., PLCSIM V15 with TIA Portal V15.1) are not supported and can reintroduce issues that were fixed in a paired update.
• Subscribe to Siemens Product Notifications for "6ES7 24x-..." and "6ES7 291-..." (PLCSIM article numbers) to receive update notifications automatically.
• Maintain a project-level "golden" SIM table that exercises each input byte. The table should include at least one Bool, one Int, and one Real tag from the base CPU and from a signal module. Run the table after every PLCSIM update to confirm the byte offsets remain correct.
• For safety-related or regulated projects, validate the program on the real S7-1200 hardware. PLCSIM is not certified for SIL verification, and the V15.1 byte-offset bug is a textbook example of a simulation-only defect.
• Document the PLCSIM build number in the project quality folder. The build number is visible in the Help > About dialog of TIA Portal and in the registry key HKLM\SOFTWARE\Siemens\Automation\PLCSIM\15.1.

Rollback Procedure

If the Update 1 installer must be reversed (for example, when a regression is suspected), use the Windows Apps & Features control panel to remove the patch, then restore the original PLCSIM V15.1 binaries from the TIA Portal installation media. Siemens does not publish a dedicated rollback tool for PLCSIM updates, so the recovery path is a clean re-install of the TIA Portal V15.1 base image plus any previously installed HSPs.

Summary of Required Actions

1. Confirm the symptom against the bug pattern: %IW0:P modify returns 256 for an input of 1, with bit %I0.0 incorrectly set.
2. Apply PLCSIM V15.1 Update 1 from Siemens Support Entry 109764220 or the TIA Software Updater.
3. Reboot the engineering workstation.
4. Re-run the SIM table to verify that %IW0:P = 1 sets %I1.0.
5. If the update cannot be deployed, apply one of the workarounds: shift test tags to a signal module, force byte-by-byte, or use a memory staging tag.
6. Record the PLCSIM build number in the project quality folder for traceability.