Resolving S7-1200 PLCSIM Compatibility Issues in TIA Portal

Problem Overview

Engineers migrating STEP 7 projects from S7-300 to S7-1200 frequently hit a blocking problem: PLCSIM, the bundled offline simulator in STEP 7 / TIA Portal, does not transparently accept S7-1200 program code. The "Start Simulation" toolbar button is greyed out, the project refuses to launch a simulator instance, or the online connection to PLCSIM drops immediately against an S7-1200 CPU target. This guide covers the architectural reasons, the version-dependent PLCSIM behavior, the instruction-level portability exceptions, and the field-proven workarounds that allow offline simulation of S7-1200 logic without rewriting the entire program.

The root cause is architectural: the S7-1200 uses a different firmware-boot contract, a different execution model, and a different instruction set profile than S7-300. The original PLCSIM (STEP 7 V5.x and early TIA Portal) was written to emulate the S7-300 / S7-400 instruction-execution engine. Native S7-1200 simulation arrived later in the TIA Portal product line (commonly referenced in field reports as released roughly in the 2013 timeframe). Before that release, no native S7-1200 PLCSIM target existed.

Three failure modes present themselves repeatedly in field support logs:

\n
1. Symptom A — Inactive simulation control. The "Simulation" toolbar icon in TIA Portal is disabled when the active project target is an S7-1200 CPU and the installed TIA Portal / PLCSIM predates the S7-1200 simulation release.
\n
2. Symptom B — Compile-time rejection. PLCSIM launches, but the project compilation against the S7-300 target profile flags CALCULATE, multi-input math, and variant-aware MOVE blocks as unsupported instructions.
\n
3. Symptom C — Online-bind failure. PLCSIM loads, but the engineering station cannot establish an online connection to the simulated CPU. Diagnostic buffer shows "Connection aborted (code 0x80C)".
\n

Resolution depends on identifying which symptom applies and matching the TIA Portal, PLCSIM, and CPU firmware versions correctly. The matrix and procedure below cover each path.

S7-300 vs S7-1200 Execution Architecture

The S7-300 family derives from a 1990s instruction set tightly integrated with the SIMATIC S7-300 firmware (CPU 312 through CPU 319). The S7-1200 family is a separate, post-2009 controller family with a different firmware image, work-memory layout, and operand addressing for some instruction types. The PLCSIM runtime was developed against the older execution contract; emulating the newer family requires a separate runtime engine.

Engineers working in mixed-vintage systems routinely develop and commission S7-300 logic on PLCSIM and then attempt a direct project conversion to S7-1200. That pathway is precisely where the simulator mismatch surfaces: PLCSIM for S7-300 cannot load the converted S7-1200 blocks, and PLCSIM for S7-1200 did not exist in pre-V13 TIA Portal installations.

PLCSIM Version Compatibility Matrix

Native S7-1200 simulation requires both the TIA Portal programming environment and the PLCSIM runtime to come from the same V13 SP1 (or later) generation. Mismatched versions display the "Simulation button is not active" symptom and refuse to bind to the PLC.

The V13 SP1 line is widely cited as the inflection point; field reports place "S7-1200 Simulation" capability at "2013 I think", consistent with the TIA Portal V13 SP1 release cycle. Versions older than V13 SP1 are functionally incapable of native S7-1200 simulation regardless of CPU firmware installed on the target hardware. The Siemens Industry Online Support entry for S7-PLCSIM V13 SP1 release notes is the canonical reference for upgrading from earlier TIA Portal installations.

Catalog Installation Order

When upgrading a multi-engineer workstation, install TIA Portal first, then the matching PLCSIM DVD / image, in that order. Installing PLCSIM before TIA Portal leaves PLCSIM looking for an engineering environment it cannot find; installing them out of order (e.g., V14 SP1 PLCSIM with V13 SP1 TIA Portal) is a common source of "internal library version mismatch" startup errors.

Identifying Non-Portable S7-1200 Instructions

Even with TIA Portal V13 SP1+ installed, certain S7-1200 instructions do not exist in the S7-300 instruction database. Cross-compilation yields unsupported references that PLCSIM cannot resolve. The most common offenders are documented below.

When converted to a STEP 7 V5.x / S7-300 PLCSIM target, the project compiles only if the converter resolves every S7-1200-only block to its closest S7-300 equivalent or rejects it explicitly. Where the converter silently leaves a CALCULATE box in place, the loaded PLC program fails to scan and the OB1 error flag is raised. Where the converter rejects the instruction, the engineer is left with empty placeholders to fill manually.

Locating the Offenders via Project Tree

To find non-portable instructions in a converted or mixed project, right-click the project root in TIA Portal → <References> → search for the keywords "CALCULATE" and "MOVE_VARIANT" in the <Cross-references> view. The result tree lists every block that contains the suspect instruction. Sorting by symbol name (right-click <Symbolic address>) reveals the OB / FB / FC scope quickly.

Prerequisites for S7-1200 PLCSIM

Before launching S7-PLCSIM against an S7-1200 target, verify the following constraints. Each item is a documented failure mode when absent.

\n
1. TIA Portal V13 SP1 or later installed (engineering license: Standard or higher; PLCSIM is included in the engineering framework on the same authorization USB stick).
\n
2. S7-PLCSIM installed with the matching TIA Portal version (V13 SP1 PLCSIM for V13 SP1 TIA Portal, V14 SP1 PLCSIM for V14 SP1 TIA Portal, etc.). Mismatched PLCSIM versions refuse to bind and throw error code 0x8004xxx on startup.
\n
3. Project hardware target: S7-1200 CPU inserted under <Device configuration> → <PLC_1>. Mixed targets (S7-300 and S7-1200 in the same project) cannot be online-against-simulator simultaneously — each simulation run targets one CPU only.
\n
4. CPU firmware version compatible with the installed PLCSIM. For TIA Portal V13 SP1, supported firmware is V4.0.x or later of the S7-1200 G2 (second-generation) family. Older V1.x / V2.x / V3.x firmware on the CPU is acceptable as long as the PLCSIM catalog entry matches; mismatched order numbers (e.g., CPU 1211C V4.2 with PLCSIM V13 SP1 expecting V4.0 only) produce "Configuration not supported" downloads.
\n
5. Windows local administrator rights on the engineering station. PLCSIM installs a virtual Ethernet adapter (Siemens PLCSIM VEth) and a Siemens PLCSIM Windows service that requires elevation to start.
\n
6. Firewall rule allowing PLC-to-PLC communication via TCP/UDP on local subnet (default auto-negotiated by PLCSIM). On Windows Defender, PLCSIM is granted status during install; on third-party firewalls (Symantec, McAfee, Kaspersky), add an inbound allow rule for "Siemens PLCSIM" manually.
\n
7. License authorization: PLCSIM is licensed under the Engineering / Advanced Engineering license tier. A standalone runtime license is not required when the engineer holds an active TIA Portal license on the same machine. Floating licenses via the Automation License Manager network server support multi-engineer PLCSIM sessions.
\n

Migration Workaround: S7-300 PLCSIM Harness

When only a STEP 7 V5.x environment or pre-V13 SP1 TIA Portal is available, and a true S7-1200 PLCSIM is unavailable, the standard workaround is to develop and test the control logic in an S7-300 simulation harness, then transplant the verified blocks back into the S7-1200 target project. The procedure is field-tested and reproducible.

Workaround Procedure

\n
1. Create a parallel S7-300 station in the same TIA Portal installation (or STEP 7 V5.x if that is the only tool available). Match the program structure (OB1 cycle, FB/FC data blocks) as closely as possible.
\n
2. Replace every non-portable S7-1200 instruction with its S7-300 equivalent. CALCULATE → manual arithmetic expression using ADD/MUL/SUB/DIV and IF/WHEN blocks. Multi-input ADD → cascaded ADD pairs. Multi-output MOVE → individual MOVE blocks per destination.
\n
3. Confirm that no S5-format timer or counter blocks remain in the S7-1200 source. If present, convert each to IEC timer (TON / TOF / TP) or IEC counter (CTU / CTD / CTUD).
\n
4. Compile, download to PLCSIM (S7-300 target), exercise the input table against the mapped I/O (force the input byte that the logic expects from the real field wiring).
\n
5. Capture the functional response, signal sequences, and timing. Resolve any missed I/O mapping or interfacing block before transplant.
\n
6. Copy the validated FB/FC/DB containers into the S7-1200 project. Replace the S7-300-equivalent arithmetic with the original CALCULATE / multi-input ADD instructions, taking advantage of the S7-1200 native instruction set.
\n
7. Recompile, re-run functional verification on the real S7-1200 hardware or, if available, on PLCSIM V13 SP1+ targeted to an S7-1200 CPU.
\n
8. Maintain two parallel source corpora until the final validation pass. Consolidate only after the S7-1200 simulation harness is accepted.
\n

This approach has the obvious cost of maintaining two parallel program corpora during development. It is, however, the only available simulation path on older STEP 7 installations and is widely used to validate S7-1200 logic when a hardware target is unavailable.

LAD and SCL Examples: Replacing CALCULATE

Consider an S7-1200 CALCULATE box that evaluates the expression (IN1 + IN2) * IN3 - IN4. In an S7-300 simulation harness, that becomes a three-step FBD cascade or SCL cascade.

FBD Cascade:

SCL Equivalent (S7-300):

The same SCL transplant, returned to the S7-1200 project as a single CALCULATE box with expression text (IN1 + IN2) * IN3 - IN4, recovers the original compact S7-1200 representation.

Migrating IEC Timer Semantics

An S5-style block "SE_T4_1" (extended-pulse timer) on a 1-second resolution base is not the same as an IEC TP timer. SE stays high while the input is continuously asserted; TP emits one fixed-duration pulse per rising edge. Review the original S5 timer mode before converting:

Configuring Native S7-1200 PLCSIM in TIA Portal

Once the prerequisites above are satisfied, native S7-1200 simulation is straightforward. The full configuration sequence is enumerated below.

\n
1. Open the S7-1200 project in TIA Portal V13 SP1 or later.
\n
2. Ensure the project target is set to <PLC_1> → <S7-1200 CPU>. Open the device configuration and confirm the CPU order number and firmware version. Right-click the PLC → <Properties> → <General> → <Catalog information> to verify the HW catalog entry matches the PLCSIM-compatible profile.
\n
3. From the <Online> menu, select <Simulation> → <Start>. Alternatively, click the toolbar icon (<Start simulation>). PLCSIM launches with a virtual instance of the configured CPU.
\n
4. The PLCSIM compact view opens showing the CPU status indicators (RUN / STOP / ERROR), the project tree, and the I/O simulation panel. The CPU remains in STOP until you click <RUN>.
\n
5. From the PLCSIM instance, click <Project tree> → <PLC_1> → <Download to device>. The compiled program is transferred to the simulated PLC.
\n
6. Toggle the CPU to <RUN>. Use the <Input> panel to force inputs and observe outputs in real time. Monitor tags through the <Watch table> or <Force table>.
\n
7. Step the cycle through breakpoints using <Online> → <Monitor/Modify>. Trigger OB1 entry and exit events as needed.
\n
8. Stop the simulation via <Online> → <Simulation> → <Stop>. The PLCSIM service stays resident until the engineering session ends or is explicitly unloaded via <Task Manager> → <Services> → <Siemens PLCSIM>.
\n

Extended PLCSIM Functions

Modern PLCSIM V14 SP1+ ships with extended features worth leveraging for S7-1200 testing:

\n
• Multi-instance simulation: PLCSIM can host two or more simulated CPUs in one window. Useful for testing S7-1200-to-S7-1200 or S7-1200-controller-to-S7-1500-I/O PROFINET pairs.
\n
• Trace function: Live capture of tag values into a time-series view. Requires TIA Portal Professional edition with the Trace viewer option.
\n
• Software controller: The PLCSIM Virtual Controller option (introduced in V17) runs the full CPU firmware in a Docker-style container. Closer parity with real hardware, slower startup.
\n
• API: PLCSIM exposes a .NET API (PLCSIM V14+) that allows scripts (C# / PowerShell) to drive inputs, read outputs, and trigger events programmatically. Useful for automated regression testing.
\n

Verification and Validation

After each simulation run, verify the following before signing off the simulated application:

\n
• OB1 cycle time reaches the expected scan window (typically 1–100 ms for S7-1200). Anything above the configured maximum cycle time raises OB80 (timing error) and trips the CPU to STOP.
\n
• All PLC tags in the <Watch table> resolve to expected values; no undefined (--/--) entries remain.
\n
• Force table entries applied to simulated inputs produce expected transitions in the affected FBs/FCs within one cycle.
\n
• No diagnostic buffer entries with class Error appear after a full functional pass. Diagnostic buffer is accessible via <PLC diagnostics> in PLCSIM or via <Online> → <Diagnostics> in TIA Portal.
\n
• Persistent storage: save the project offline and reopen it to confirm persistent storage of any simulation-specific settings (force values, watch tables).
\n
• Full I/O exerciser pass: every input bit toggled, every output bit asserted, every connected HMI tag updated.
\n
• PROFINET I/O scan: if PROFINET I/O is configured, run a full scan and confirm device-level readiness (no "PROFINET interface error" entries in the diagnostic buffer).
\n
• Safety-integrated scope: if a safety-integrated (F-CPU) S7-1200 is being simulated, expect partial coverage. PLCSIM runs safety code in passivated mode and cannot reproduce real safety I/O behavior. Final validation must occur on hardware.
\n

Troubleshooting Matrix

Best Practices and Safety Notes

The following practices minimize the chance of a PLCSIM-related blocker when the project touches both platforms.

\n
• Maintain S7-1200 firmware-version-specific program branches. Each firmware generation (V4.0, V4.1, V4.2, V4.3, V4.4, V4.5) has slightly different instruction availability. Pin the project to one firmware per development phase.
\n
• Where possible, write core algorithms in SCL inside reusable FBs. SCL transplants cleanly between S7-300 and S7-1200 once instruction portability issues are resolved. STL, by contrast, is unsupported on S7-1200 and forces rewriting in LAD or FBD.
\n
• Document every CALCULATE or multi-input math block with a comment naming its expansion. This makes the S7-300 simulation harness trivial to rebuild when needed.
\n
• Keep the PLCSIM version locked to the TIA Portal version on each engineer's machine. A mixed V13/V14 PLCSIM environment produces inconsistent simulation behavior and hard-to-reproduce bugs.
\n
• Where hardware-in-the-loop is available (PROFINET with ET200 or SINAMICS drives), prefer a hardware emulator over PLCSIM for full-stack validation. PLCSIM simulates the CPU but not the I/O backplane or remote I/O behavior in the S7-300 line; the S7-1200 PLCSIM V14 SP1+ has improved PROFINET I/O emulation but is still not a 1:1 substitute for the field device.
\n
• Schedule a yearly review of TIA Portal / PLCSIM version alignment. New firmware features often require newer PLCSIM versions to simulate correctly (e.g., OPC UA Server function blocks introduced in S7-1200 firmware V4.4 require PLCSIM V14 SP1 or later).
\n
• Avoid putting real-world IP addresses into the PLCSIM VEth configuration if the engineering station is also used for HMI or production network traffic. PLCSIM DHCP-hands out local addresses but routing logic can interfere with live network connections.
\n
• Build the S7-300 PLCSIM harness early in the project even if S7-1200 PLCSIM is the long-term goal. The harness becomes the safety-net environment if license or version issues force PLCSIM downgrades mid-project.
\n

Standards and Compatibility References

For cross-verification of PLCSIM behavior, parameter limits, and CPU-family instruction sets, consult:

\n
• S7-1200 Programmable Controller System Manual (Siemens Industry Online Support, manual entry under the S7-1200 support page).
\n
• S7-PLCSIM V13 SP1 / V14 SP1 release notes and online support notes on the Siemens Industry Online Support portal.
\n
• S7-1200 CPU firmware release notes (firmware V4.x) for CPU-specific instruction availability and deprecations.
\n
• TIA Portal release notes for the installed engineering version.
\n

Frequently Asked Questions