Resolving S7-PLCSIM V15.1 Missing IP Address on S7-1500 Simulator

Problem Summary

When launching S7-PLCSIM V15.1 Update 1 from TIA Portal V15.1 Update 4 with an S7-1500 CPU selected, the Compact view of the simulator opens, loads the project, but displays the header Unconfigured PLC [SIM-1500] with no IPv4 address visible on the X1 PROFINET port panel. By contrast, simulating an S7-1200 CPU on the same workstation populates the X1 IP field immediately after project load.

Secondary symptoms reported on the affected configuration:

• The dialog Extended download to devices does not always open when PLCSIM starts; only the Compact view appears.
• Intermittent error dialog PLCSIM project could not be started appears on certain firmware versions of the simulated 1500 CPU.
• Clicking the Go online button after closing the Compact view opens the device search dialog, but the Start Search operation finds no reachable target.
• Behavior is independent of the simulated 1500 CPU type (CPU 1511, CPU 1515, CPU 1518, ET 200SP CPU, etc.) and independent of the firmware version selected (V2.5 through V2.9).

The mismatch is purely an S7-1500-family issue within the S7-1500 simulator instance. The S7-1200 simulation path on the same TIA Portal/PLCSIM install functions normally, which rules out host OS, .NET runtime, and TIA Portal licensing faults.

Environment & Affected Versions

Refer to the official SIMATIC S7-PLCSIM V15.1 manual (entry ID 109755202) for the complete feature matrix and supported CPU list. The 1500/1200 behavioral split is documented in section 4.3 of that manual under Start of the S7-PLCSIM.

Root Cause Analysis

S7-PLCSIM V15.1 simulates the PROFINET interface of an S7-1500 as a virtual network adapter inside the PLCSIM runtime. Unlike the S7-1200 instance — which auto-assigns a default IP (typically 192.168.0.1) to its X1 port the moment the simulated CPU is created — the S7-1500 instance remains in an unconfigured state until TIA Portal completes a full project download. The Compact view header is therefore by design Unconfigured PLC [SIM-1500], and the X1 IP field is intentionally blank until the project hardware configuration is written to the simulator.

The reason Extended download to devices does not appear automatically when the project is small or has been compiled in a previous session is a state caching bug in TIA Portal V15.1 Update 4's PLCSIM launcher (PLCSIMLauncher.dll). The launcher omits the auto-redirect when the active session is resumed from a cached compiler snapshot. TIA Portal V16 and later re-implemented the launcher to always force the download dialog on PLCSIM start.

The PLCSIM project could not be started dialog appears when:

1. Another PLCSIM V15.x instance already holds a license token on TCP port 49152 (Siemens PLCSIM internal socket).
2. The Windows Firewall blocks S7-PLCSIM.exe from binding to 0.0.0.0:49152.
3. Antivirus software intercepts the PLCSIM process tree and tears down child instances.
4. VMware virtual network adapter is set to Host-only and the Microsoft Loopback Adapter is missing or disabled.

For Kepware connectivity specifically, the KEPServerEX Siemens S7 TCP/IP driver attempts reconnect after every drop with a default retry interval of 1 s. When PLCSIM rejects the very first session before TIA Portal has finished downloading the hardware configuration, the driver accumulates connection-denied errors faster than PLCSIM's internal bring-up completes (typically 4-7 s on V15.1). Symptoms appear identical to an IP-address issue because the driver reports Device is not responding against a target whose socket is bound but whose PLC firmware has not yet accepted PUT/GET.

Diagnostic Steps

Run the following checks in order before applying the fix. Each step isolates one of the four root causes above.

1. Verify PLCSIM license token. Open TIA Portal > Options > License Manager and confirm an active PLCSIM V15.1 license. Close any TIA Portal or PLCSIM window before re-launching. A stranded process holding the token shows up as S7-PLCSIM.exe in Task Manager with PID under the TIA Portal parent — kill it.
2. Confirm the simulated PN interface exists. In PLCSIM Compact view, click Project tree > PLC_1 > PROFINET interface [X1]. The MAC address must be present even if the IPv4 field is empty. If the MAC is also blank, the project has not been compiled — return to TIA Portal and run Compile > Hardware (rebuild all).
3. Check Windows Firewall inbound rules. Run in an elevated command prompt:
   netsh advfirewall firewall show rule name="S7-PLCSIM"
   If the rule is missing, recreate it:
   netsh advfirewall firewall add rule name="S7-PLCSIM" dir=in action=allow program="C:\Program Files\Siemens\Automation\PLCSIM\V15.1\bin\S7-PLCSIM.exe" enable=yes
4. Check VMware virtual NIC. In VMware Workstation, edit the VM settings > Network Adapter > ensure the connection is either Bridged (Replicate physical network connection state) or NAT. Set Promiscuous Mode = Allow All under Advanced. Bridged mode is required if PLCSIM must talk to a real PROFINET device on the host LAN.
5. Confirm the Microsoft KM-TEST Loopback Adapter is installed and enabled when running on bridged networking without a physical uplink. Open Device Manager > Show hidden devices > Network Adapters. If absent, install via hdwwiz.exe > Install the hardware that I manually select > Network adapters > Microsoft > Microsoft KM-TEST Loopback Adapter.
6. Inspect PLCSIM startup log. Enable verbose logging by setting the environment variable S7PLCSIM_TRACE=0xFFFF before launching TIA Portal. The trace file is written to %LOCALAPPDATA%\Siemens\PLCSIM\plcsim.log. Look for E0x021A (port bind failure) and E0x021F (license token denied).

Solution: Force the Download to Populate the IP

The correct workflow for S7-1500 simulation is to manually drive the download after PLCSIM opens. The Compact view is intentionally blank until the hardware configuration is written.

1. In TIA Portal, select the S7-1500 station in the project tree, right-click > Download to device > Hardware and software (only changes).
2. If TIA Portal prompts with Select target device, click Start Search. The PLCSIM instance will appear after 5-10 s as [SIM-1500] <CPU order number> with a placeholder IP 0.0.0.0.
3. Select the SIM entry and click Load. Confirm the Load preview dialog by clicking Load again.
4. When the Load results dialog appears, tick Start all in the Start module column and click Finish.
5. Return to the PLCSIM Compact view. The header changes from Unconfigured PLC [SIM-1500] to the configured station name, and the X1 port IP field now shows the IPv4 address from the TIA Portal device configuration (for example 192.168.0.10, mask 255.255.255.0).

If TIA Portal returns Device could not be found, force the route manually:

1. Open Online > Accessible devices.
2. Set Type of the PG/PC interface to PN/IE.
3. Set PG/PC interface to the VMware virtual NIC or to Realtek PCIe GBE / Intel I219-V <...> depending on host binding.
4. Click Start search. PLCSIM publishes via the Siemens S7 discovery protocol (UDP port 34964 / 49153) once the project is loaded; the entry will appear within 10 s.

Alternative: Pre-Assign IP in the Device Configuration

When the same S7-1500 project is downloaded repeatedly (regression testing, classroom use), pre-assign the IP in the hardware configuration to avoid the blank-state step:

1. Open Devices & networks > select the CPU > PROFINET interface [X1] > Properties > Ethernet addresses.
2. Set IP address = 192.168.0.10, Subnet mask =

   255.255.255.0.

3. Uncheck Set IP address using a different method to prevent DHCP overwrite during download.
4. Compile hardware and download. PLCSIM adopts the address during download rather than after.

VMware Network Configuration Reference

Siemens recommendation 109483336 documents the network adapter settings required for PLCSIM inside VMware. The minimum set:

If only the host-to-guest loopback is needed (no external device), use Host-only with the VMware Network Adapter VMnet1 present on the host. The PLCSIM instance binds to VMnet1 and is reachable only from inside the guest and from the host's VMnet1 address.

Kepware Compatibility Considerations

When the simulated S7-1500 is the target of a KEPServerEX S7 TCP/IP driver, the driver must be configured to match PLCSIM's bring-up behavior:

1. In KEPServerEX Configuration, set Scan Mode = Respect Tag Scan Rate.
2. Increase Connection Timeout from default 1 s to 5 s.
3. Set Connect Retry Count to 10 (driver attempts ~50 s of retries, covering PLCSIM's worst-case 7 s startup).
4. Disable Optimizes reads/writes for unsolicited messages for the S7-1500 device; PLCSIM V15.1 does not fully implement the unsolicited PDU for S7-1500 firmware V2.9.

After these adjustments, the Device is not responding event clears within 30 s of PLCSIM completing the download.

Error Code Reference

Verification

After applying the fix, confirm the simulator is fully online:

1. PLCSIM Compact view header reads <Configured station name> [SIM-1500] — no "Unconfigured" prefix.
2. X1 port panel shows the IPv4 address, subnet mask, and router address matching the TIA Portal device configuration.
3. The RUN/STOP LED in the Compact view is solid green.
4. In TIA Portal, Online > Online & diagnostics shows Connection established with cycle time displayed.
5. Ping from a Windows command prompt:
   ping 192.168.0.10 — round-trip < 1 ms confirms the loopback.
6. From KEPServerEX, the channel/device status reads OK within 30 s of starting the runtime.

Upgrade Path Recommendation

If the workaround must remain in place long-term, evaluate migrating the development environment to TIA Portal V16 Update 7 (or later) with the matching S7-PLCSIM V16 add-on. The V16 PLCSIMLauncher.dll fixes the cached-snapshot bug that suppresses the Extended download to devices dialog, and S7-PLCSIM V16 pre-populates the X1 IP from the active session on resume. See the official TIA Portal V16 release notes (entry ID 109772684) for the migration checklist and the SIMATIC S7-PLCSIM V16 manual (entry ID 109769914) for the new S7-1500 bring-up sequence.

FAQ