Resolving S7-PLCSim Project Download Failures in STEP 7

S7-PLCSim is the standard offline simulation environment for STEP 7 V5.x projects targeting S7-300, S7-400, and C7 controllers. Engineers routinely hit a "no target found", "online: cannot reach station", or "node not reachable" error when attempting to download a hardware configuration or user program to the simulated CPU. The most common root cause is a mismatch between the MPI or PROFIBUS node address configured for the CPU in the STEP 7 hardware configuration and the address the running PLCSim instance is presenting on its virtual backplane. This reference details the exact diagnostic path, the configuration of PG/PC interface assignments, the MPI address change procedure inside PLCSim, the supportability of distributed I/O over PROFIBUS-DP and PROFINET, password-protected block handling, ProTool runtime integration, the differences in TIA Portal PLCSIM V13 and later, and a verification matrix for each failure mode.

Problem Summary

When S7-PLCSim is started from the SIMATIC Manager (or stand-alone) and a "Download to Target System" is triggered against the project, STEP 7 raises one of the following alarms before any block is written to the simulated CPU:

• "No target system found" / "No node reachable"
• "The online interface cannot establish a connection to the station at address X"
• "Online: cannot reach station" with a diagnostic buffer entry of "connection aborted"
• "The online interface is currently being used by a different application"
• "Download to target system was aborted" after a 10 second timeout

The same hardware configuration downloads successfully to a physical CPU on the same PG/PC interface. The problem is therefore isolated to the simulated target, not to the project compilation, the network adapter drivers, or the project source. The S7DOS helper service and the PC Internal loopback may be functional, but STEP 7 cannot bind to a target that advertises a node address other than the one the project is searching for.

Root Cause: MPI Address Mismatch

S7-PLCSim emulates a CPU by binding to a virtual MPI or PROFIBUS node address on the host PC's internal S7 communication layer. The simulator's default MPI address is 2, matching the STEP 7 default for an unconfigured CPU. When the engineer renumbers the CPU in the hardware configuration (for example, to address 26 to align with a slot or rack numbering scheme, or to address 3 because address 2 is reserved for a programming device), the project expects to find a node at address 26, but PLCSim continues to advertise itself at address 2. The PG cannot bind to a non-existent target, so the download dialog either fails immediately or hangs until the S7 timeout (default 10 s, configurable in Set PG/PC Interface → Properties → Timeout) expires.

Verification of the active PLCSim address can be done in two ways:

1. Open the PLCSim window and read the status bar - the active MPI or PROFIBUS address is displayed next to the CPU symbol and the SF / BF LEDs.
2. From SIMATIC Manager, click PLC → Accessible Nodes (Alt + F9) while PLCSim is running. The Accessible Nodes scan returns every node that responds on the selected PG/PC interface, including the simulated CPU with its currently active address.

If the scan returns an empty result, the problem is not the address - the loopback itself is broken. Skip to the PG/PC interface diagnostics section. If the scan returns a node at a different address than the one in HW Config, the address mismatch is confirmed.

PLCSim Communication Architecture

PLCSim V5.x uses a software-only communication channel that is independent of any physical fieldbus hardware. When the PLCSim service is started, it registers a virtual S7 communication endpoint on the host. STEP 7 reaches this endpoint through a dedicated PG/PC interface assignment, not through a real MPI cable, CP, or PROFINET interface.

Procedure to verify the PG/PC interface assignment in STEP 7 V5.x:

1. Open the Windows control panel entry Set PG/PC Interface (Start → SIMATIC → STEP 7 → Set PG/PC Interface).
2. Set the access point of the application "S7ONLINE" to PC Internal (local).
3. Click Diagnostics. Confirm that the interface reports "OK" and that the loopback is bound to a free local S7DOS handle.
4. Click Properties and verify that the timeout for online operations is set to 10 s (default) or higher if the host is slow.

MPI Address Configuration Procedure

There are two addresses to align: the address the project expects (defined in the hardware configuration) and the address the PLCSim instance is presenting. The download will succeed only when both values are equal. PLCSim's PLC → MPI Address... dialog does not synchronize with the offline project; the engineer must set both values explicitly.

Confirming the Project-Defined CPU Address

1. Open the SIMATIC Manager project and double-click Hardware to open HW Config.
2. Double-click the CPU object in the rack. The CPU Properties dialog opens.
3. Select the Interface tab (for MPI/PROFIBUS-integrated CPUs) or the PROFIBUS sub-tab (for PROFIBUS-CPU variants).
4. Read the value in the Address field. The default is 2.
5. For CPUs that have both MPI and PROFIBUS interfaces (e.g., CPU 315-2 DP, CPU 317-2 DP, CPU 416-3 DP), read both addresses and note which subnet the project uses for PG communication.

Aligning the PLCSim Address

1. Start PLCSim (either from the SIMATIC Manager toolbar button "Simulate On/Off" or from Start → SIMATIC → S7-PLCSim → S7-PLCSim).
2. Open the menu PLC → MPI Address... in the PLCSim window.
3. Enter the same MPI address that the hardware configuration has assigned to the CPU and click OK.
4. Cycle the simulated CPU to RUN-P or STOP-RUN once to commit the change to the simulated firmware image. PLCSim V5.4 SP5 and later persist the address across a STOP-RUN transition; earlier versions require a full PLCSim restart after the address change.

After the alignment, run Accessible Nodes (PLC → Accessible Nodes). The PLCSim instance should appear in the result list with the address you just entered. The download then proceeds normally. If the address still shows the old value, a second PLCSim instance is likely still running from a previous session - check the Windows taskbar and terminate any background PLCSim processes before retrying.

Persisting the Address Across Sessions

PLCSim V5.4 SP5 and later store the last-used MPI and PROFIBUS addresses in the registry under HKLM\SOFTWARE\Siemens\S7-PLCSIM\Settings. To preconfigure the address for a project that uses a non-default value, set the keys MPIDefault and DPDefault to the desired decimal values before launching PLCSim. This is useful in CI / automated test environments where PLCSim is started by a script and the address must be deterministic.

PG/PC Interface Diagnostics

When the MPI address is correct but the download still fails, the next layer to inspect is the PG/PC interface. Use the diagnostic procedure in Set PG/PC Interface → Diagnostics to validate the loopback state:

If the PC Internal loopback test fails, the S7DOS service may not be running or the S7DOS handle may be locked by a zombie process. Repair sequence:

1. Open services.msc and locate the service "s7DOS" or "S7-DOS Service". If present and stopped, set its startup type to "Automatic" and start it.
2. If the service is not present, the STEP 7 PC Interface component was not installed or was corrupted. Repair via Control Panel → Programs and Features → Siemens SIMATIC STEP 7 → Repair.
3. If the service starts but the test still fails, check the loopback adapter driver. Windows 10 and later disable the loopback adapter by default; enable it via Device Manager → Network Adapters → Microsoft KM-TEST Loopback Adapter → Enable.
4. Reboot the host and re-run the diagnostic. PLCSim requires a clean session to bind to the S7DOS handle.

PROFIBUS-DP Support in PLCSim

PLCSim V5.x supports PROFIBUS-DP slave simulation, with two important caveats:

1. DP master and DP slave are both emulated in software. No physical DP segment is involved.
2. Slave diagnostics, I/O data exchange, and acyclic DP-V1 read/write services are reproduced by the simulator, but bus timing (token rotation, slot time, repeat count) is not real-time accurate. Do not use PLCSim to validate PROFIBUS bus parameter tuning, repeater placement, or fiber-optic segment length.

The procedure to enable DP simulation:

1. Configure the DP master and DP slaves in HW Config against the simulated CPU. Install the matching GSD files via Options → Install GSD File... before placing the slave in the rack.
2. Set the DP master and slave PROFIBUS addresses to the same values used on the real plant. The master PROFIBUS address is the CPU's PROFIBUS address; the slave addresses are the values configured on the physical DP devices.
3. Set the CPU's MPI address in PLCSim as described in the MPI Address Configuration Procedure section.
4. Download the hardware configuration. PLCSim will report the DP slave status in its View → Distributed I/O panel.
5. Open the PLCSim View → Peripheral I/O panel and toggle the simulated inputs to verify the cyclic exchange is live.

Common DP-specific failure modes in PLCSim:

• Slave shows "Not Found". The GSD file version in the offline project does not match the slave firmware. Reinstall the matching GSD file and recompile HW Config.
• Slave shows "Diagnostics Error". The configuration bytes (Cfg) in the offline project do not match the slave's expected module arrangement. Open the slave properties in HW Config and verify the slot assignment.
• Inputs are always 0. PLCSim does not generate live process values; the simulated input panel must be toggled manually. Use the View → Peripheral I/O → Inputs panel to set values.
• DP-V1 acyclic reads return error code 0x80B1 (length error). The slot/index mapping in the offline project does not match the slave's actual data layout. Re-check the slot assignment in the slave documentation.

Password-Protected Block Handling

S7-PLCSim supports download of password-protected FBs, FCs, DBs, and UDTs from STEP 7 V5.4 SP5 onward. The classic failure mode is "Download to target system was aborted" with the diagnostic buffer entry "Block decryption failed" when the password for a know-how-protected block has not been entered into PLCSim before the download is attempted.

Procedure to prepare PLCSim for password-protected blocks:

1. Start PLCSim and load the project as normal.
2. Open the menu PLC → Authorizations / Passwords....
3. For each know-how-protected block in the offline project, enter the corresponding password and click OK. The password list in PLCSim is cleared on every PLCSim restart, so this step must be repeated for each session.
4. Trigger the download from SIMATIC Manager. The blocks are now decrypted in the offline container and transferred to the simulated CPU without further prompts.

For projects that contain F-block passwords stored in the CPU's password list (used by S7 Distributed Safety and S7 F Systems), use PLC → Access Protection → Set Password for F-Blocks... instead. The F-runtime group will not start in the simulated CPU if the password list is not synchronized. F-block passwords are separate from know-how-protection passwords and must be entered independently.

For projects that contain blocks with a "sermon-proof" or "s7-block-encrypt" key (delivered with a license key on a parallel USB stick), the block cannot be decrypted by PLCSim at all. PLCSim does not communicate with the parallel USB stick. The download aborts with "License key not present". In this case the project must be tested against a physical CPU or against TIA Portal PLCSIM with the dongle attached to the host.

ProTool and HMI Runtime Integration

PLCSim is frequently paired with ProTool (legacy) or WinCC flexible (current at the time of STEP 7 V5.x) to validate HMI screens against a simulated CPU. The HMI runtime connects to PLCSim over the same PC Internal loopback, but with a separate access point ("ProTool" or "WinCC flexible"). When the HMI runtime is configured for MPI at the CPU's address, it connects to PLCSim automatically once the simulated CPU is in RUN-P.

Common ProTool / WinCC flexible integration issues:

• HMI shows "Connection to PLC interrupted". The HMI connection is configured for a different MPI address than the simulated CPU. Open the WinCC flexible project, double-click the connection, and set the MPI address to match HW Config.
• HMI tags do not update. The PLCSim update cycle is too slow. Reduce the HMI tag acquisition cycle to 500 ms or raise the PLCSim Update Cycle to 100 ms (default).
• Array variables in ProTool appear as zeros. The array index in the ProTool tag pointer is out of range, or the array DB has not been downloaded to PLCSim. Verify the array DB is in the offline project and that the download was successful.

The array variable problem reported in the original incident is a pointer / index mismatch between ProTool and the array DB in PLCSim. The fix is to verify the DB number, the array start offset, and the array element type in the ProTool tag definition. PLCSim handles arrays identically to a physical CPU once the DB is loaded, so the resolution path is the same as for a real PLC.

PLCSim Version Compatibility

Mixing PLCSim versions across a team is a common source of "works on my machine" problems. Establish a single PLCSim version in the project's installation guide and document the minimum STEP 7 service pack in the project header.

Performance Considerations on Constrained Hosts

S7-PLCSim is single-threaded for the simulated scan cycle and uses cooperative multitasking for the communication layer. On a host with the minimum recommended CPU and RAM (per the PLCSim V5.4 SP8 readme: 1.6 GHz, 2 GB RAM, Windows 7 SP1 x64 or Windows 10 x64), OB1 cycle time emulation is within 10 percent of the configured OB1 cycle. On under-spec hosts - particularly laptops running development tools (Visual Studio, Eclipse, multiple browsers, ProTool / ProSave runtime, antivirus real-time scan) - the simulated scan can drift by 100 percent or more. The symptom appears as "download seems to hang" even when the address and PG/PC interface are correct.

Performance tuning checklist:

• Close non-essential applications, especially those that pin the disk (Windows Search indexer, OneDrive sync, antivirus real-time scan of the project directory).
• Exclude the STEP 7 project directory and the S7-PLCSim working folder (C:\Program Files (x86)\Siemens\Automation\S7-PLCSIM\ by default) from real-time antivirus.
• Disable the PLCSim option View → Update Cycle from 100 ms to 500 ms if the scan drift is the only issue.
• Use the Single Scan mode (Execute → Single Scan) when testing time-critical OBs to remove the OS scheduler from the loop.
• Disable the PLCSim View → Stack Pointer and View → Accumulator panels when not in active use; these panels redraw on every cycle and add CPU overhead.
• Set the Windows power plan to "High Performance" to prevent the CPU from throttling during long simulation runs.

Quantitative impact of the tuning on a representative laptop (Intel i5-8250U, 8 GB RAM, Windows 10 21H2):

CPU-Specific Behaviors

Different S7-300 / S7-400 CPU families interact with PLCSim in slightly different ways. The following table summarizes the most common variants encountered in field projects:

TIA Portal PLCSIM (V13 and Later)

With TIA Portal, PLCSIM was rewritten as a true virtual PLC. The classic "MPI address mismatch" failure mode still exists in TIA Portal but presents slightly differently:

• In TIA Portal PLCSIM V13, the simulated CPU is started from the project tree by selecting the device and clicking Start Simulation. There is no manual MPI address dialog - the address is read from the device configuration at the moment the simulation is started.
• If the device configuration has the CPU set to a non-default address and the PC's S7ONLINE access point is set to anything other than PLCSIM or PN/IE, the download aborts with "No device found on the selected network".
• TIA Portal PLCSIM V14 SP1 and later support PROFINET IO simulation through a virtual Ethernet switch. The simulated CPU advertises a virtual PROFINET interface, and PROFINET devices can be attached through the host's network interface or the internal Npcap loopback.

Procedure to set the correct PG/PC interface in TIA Portal:

1. Open the project and select the PLC device in the project tree.
2. From the menu Online → Accessible Devices..., set the interface to PLCSIM for the local virtual PLC or PN/IE for a real PROFINET-attached CPU.
3. Click Start Search. The simulated CPU should appear with its configured IP/MPI address.
4. Proceed with Download to Device.

PLCSIM V13 and later also introduces the concept of a "virtual SIMATIC Automation Tool" and a separate PLCSIM Advanced runtime (V16+) that supports multi-instance simulation and Softnet-based Ethernet routing. For an S7-300/400 in TIA Portal, use PLCSIM V13-V16 depending on the TIA Portal version; for S7-1500 use PLCSIM V14 SP1 or later, or PLCSIM Advanced for headless / CI integration.

The classic TIA Portal PLCSIM failure modes parallel the STEP 7 V5.x failure modes:

• "No device found on the selected network". PG/PC interface set to the wrong access point, or the simulated CPU is not running. Start the simulation first, then attempt the download.
• "Download to device was aborted". TIA Portal version mismatch with the PLCSIM version. Verify that the TIA Portal installation includes the matching PLCSIM component.
• "PROFINET device not reachable". The host's firewall is blocking the PROFINET discovery packets. Disable the Windows firewall or add a rule for the PLCSIM service on UDP 34964 / TCP 102.

Diagnostic and Verification Matrix

Verification Procedure After the Fix

1. Confirm the PLCSim window shows the same MPI / PROFIBUS address as the CPU object in HW Config.
2. Run PLC → Accessible Nodes from SIMATIC Manager. The PLCSim node must be listed.
3. Open PLC → Download to Target System → Hardware Configuration to push the rack and DP layout. The download should complete within 5 s on a healthy host.
4. Trigger Download to Target System → User Program for the blocks. Block transfer should complete within 10 s for a project of 200 blocks.
5. Switch the simulated CPU to RUN-P. The status indicator in the PLCSim window should transition from STOP to RUN within one OB1 cycle.
6. Open the diagnostic buffer of the simulated CPU (PLC → Diagnostic Buffer) and confirm the most recent entry is "Startup completed without errors".
7. Toggle an input in the PLCSim Peripheral I/O panel and verify that the corresponding bit in the input process image is set. Toggle a corresponding output from the user program and verify the PLCSim output panel updates.

If the diagnostic buffer shows "Parameter assignment error" or "I/O access error" immediately after startup, the distributed I/O is not fully aligned - return to the PROFIBUS-DP section of this document and revalidate the slave addresses and GSD versions. If the diagnostic buffer shows "Startup completed with errors", open the cause of the last error to identify the offending block and re-check the block version compatibility.

Frequently Asked Questions

For additional support, refer to the official S7-PLCSim V5.4 manual and the STEP 7 V5.x programming and operating manual on the Siemens SiePortal knowledge base. For TIA Portal projects, consult the PLCSIM V13 / V14 user guide for the specific download procedure under the unified TIA Portal access point.