Resolving Siemens PLCSIM V15 VplcHost.exe Crash on TIA Portal

1. Problem Description

When starting a simulation session from TIA Portal V15 (with Update 3 installed) and PLCSIM V15 against an S7-1200 project, the host process terminates immediately and Windows displays an Application Error dialog with the message:

Siemens.Simatic.PlcSim.VplcHost.exe has stopped working

The Windows Problem Reports applet records a CLR20r3 event, which indicates a managed (.NET) runtime fault inside the PLCSIM host rather than a native access violation. A representative signature captured in the field is reproduced below:

Signature Slot	Value	Meaning
Problem Event Name	CLR20r3	Common Language Runtime unhandled exception (.NET 2.0/4.0 family)
01 – Application	Siemens.Simatic.PlcSim.VplcHost	Failing executable (PLCSIM virtual PLC host)
02 – Framework Version	1500.0.2000.201	PLCSIM V15.0 build 2000, hotfix 201
03 – Timestamp	59f1efd9	PE timestamp of the assembly (HEX date-stamp)
04 – Module	Siemens.Simatic.PlcSim.VplcApi	Failing .NET assembly
05 – Assembly Version	1500.0.2000.201	VplcApi DLL version
06 – Assembly Timestamp	59f1efd4	PE timestamp of VplcApi
07 – Method	aa	Method token (hex)
08 – IL Offset	7	MSIL instruction offset within the method
09 – Exception Type	System.Runtime.CallbackException	Exception propagated through a delegate / callback path
OS Version	6.1.7601.2.1.0.256.48	Windows 7 SP1 build 7601, 32/64 bit reported by Locale ID 1033

The crucial signature is slot 9: System.Runtime.CallbackException. This exception is raised when an asynchronous or delegate-based callback inside the PLCSIM host surfaces an error that cannot be marshaled back to the caller. The fault is not in user ladder code, and re-compiling the S7-1200 program does not eliminate it.

2. Affected Software and Platform Matrix

The crash pattern is reported on the following combinations. Mark items "Confirmed" only if reproducible in the field; "Probable" indicates the same code path is exercised.

TIA Portal	PLCSIM	Target CPU	Windows	Status
V15.0 + Update 3	V15.0 (2000.201)	S7-1200 / S7-1500	Windows 7 SP1 x64	Confirmed
V15.0 + Update 3	V15.0 (2000.201)	S7-1200 / S7-1500	Windows 10 1709/1803	Probable
V15.0 base	V15.0	S7-1200	Windows 7 SP1	Probable
V15.1	V15.1	S7-1200 / S7-1500	Windows 10 1809+	Not affected (recommended upgrade)

3. Root Cause Analysis

The System.Runtime.CallbackException indicates that PLCSIM's host bootstrap runs an asynchronous initialization sequence (registry probe, licensing callback, Network Discovery, BITS job submission) and one of those callbacks throws. The most frequent contributors, in descending order of field incidence, are:

3.1 Background Intelligent Transfer Service (BITS) Disabled

PLCSIM V15 uses BITS to pull configuration data and to coordinate the virtual PLC's online connection handshake. When BITS is set to Disabled or stopped with a pending error, the callback chain that BITS belongs to throws and the host process is torn down by the CLR's unhandled-exception policy.

3.2 Corrupt Network Downloader Cache

The folder %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader stores BITS transfer jobs and metadata. If jobs left over from a previous TIA Portal install are in an inconsistent state, the new PLCSIM instance reads them, fails to parse, and the callback throws. This is a known trigger for CallbackException at PLCSIM startup.

3.3 Operating-System Incompatibility

PLCSIM V15 was developed against a specific Windows servicing baseline. On Windows 7 SP1 without the right rollup updates, or on early Windows 10 builds (1703/1709/1803), the WinHTTP and COM apartment initializations that PLCSIM relies on are not at the expected service level. The .NET 4.x callback thread then fails to marshal correctly.

3.4 .NET Framework or Visual C++ Runtime Mismatch

A side-by-side install that brought a different .NET Framework servicing version (for example, by installing a third-party tool) can cause the VplcApi assembly to load against a CLR that does not match the build the assembly was compiled against. The result is the same CallbackException with a different method token.

3.5 Anti-Virus or Application Control Interception

Some endpoint-protection suites hook into the PLCSIM host's network and process-creation callbacks. The intercepted callback is not in the same apartment as the original call site, so any exception thrown after the proxy returns surfaces as CallbackException.

4. Pre-Flight Diagnostics

Run the following checks before touching the install, and record the results. This makes escalation to Siemens Support straightforward if the standard fix does not apply.

4.1 Capture the Windows Application Event Log

1. Open eventvwr.msc.
2. Navigate to Windows Logs → Application.
3. Filter the current log for Source = .NET Runtime and Source = Application Error.
4. Save the filtered view: Action → Save Filtered Log File As… → plcsim-evt.evtx.

Look for an entry of the form:

Application: Siemens.Simatic.PlcSim.VplcHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Runtime.CallbackException

4.2 Verify BITS Service State

sc query BITS
bfsvc.exe /query

The expected state is RUNNING with START_TYPE = AUTO (DELAYED). If the state is STOPPED and the start type is DISABLED, the crash root cause is almost certainly BITS.

4.3 Verify the Network Downloader Folder

echo %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader
dir "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader"

If *.job files dated prior to the most recent TIA Portal install are present, treat them as suspect.

4.4 Verify TIA Portal / PLCSIM Versions

reg query "HKLM\SOFTWARE\Siemens\Automation\InstalledSoftware\TIA Portal" /s
reg query "HKLM\SOFTWARE\Siemens\Automation\InstalledSoftware\PLCSIM" /s

Cross-check the version strings against the TIA Portal V15 Update 3 release notes. The PLCSIM V15 hotfix build reported in the signature is 1500.0.2000.201.

4.5 Capture a Process Dump

If the crash is intermittent, configure Windows Error Reporting to keep a mini-dump:

1. Open sysdm.cpl → Advanced → Startup and Recovery → Settings.
2. Set Write debugging information to Small memory dump.
3. Set the dump folder to %SystemRoot%\Minidump and confirm Overwrite any existing file is unchecked.
4. Reproduce the crash and copy the resulting *.dmp to a known location.

Load the dump in WinDbg with the .NET SOS extension for symbolicated analysis:

.loadby sos clr
!analyze -v
!dumpheap -stat
!threads
~* e !clrstack

5. Solution Tier 1 — Service and Cache Reset (Non-Destructive)

This is the fastest path to recovery and preserves all TIA Portal projects and licenses.

5.1 Reset BITS

1. Close TIA Portal and any open PLCSIM windows.
2. Open an elevated PowerShell or cmd.exe:

net stop BITS
sc config BITS start= delayed-auto
net start BITS

3. Confirm the service is RUNNING:

sc query BITS | findstr STATE

5.2 Clear the Network Downloader Cache

1. Stop BITS (see above).
2. Delete the contents of the folder (do not delete the folder itself):

del /q "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\*.*"

3. Restart BITS.

5.3 Re-test the Simulation

1. Start TIA Portal V15.0 Update 3.
2. Open the S7-1200 project.
3. Select the PLC → Start Simulation.
4. Confirm Siemens.Simatic.PlcSim.VplcHost.exe starts and the PLCSIM window appears.

If the crash is gone, stop here and skip to Section 10 — Verification.

6. Solution Tier 2 — Windows and Runtime Repair

If Tier 1 does not resolve the fault, the next layer targets the OS and the .NET runtime.

6.1 Apply Required Windows Updates

On Windows 7 SP1, install the latest servicing stack update and the SHA-2 code-signing support update, then run sfc /scannow to validate protected binaries. On Windows 10, ensure the build is at the servicing level required by TIA Portal V15 Update 3.

6.2 Repair the .NET Framework

1. Download the current .NET Framework Repair Tool from Microsoft.
2. Run with elevated rights and accept the recommended repairs.
3. Reboot.

6.3 Re-register the Visual C++ 2015–2019 Redistributable

cd /d "%ProgramFiles%\Siemens\Automation\PLCSIM\V15\Bin"
for %x in (msvcp140.dll vcruntime140.dll vcruntime140_1.dll) do regsvr32 /s %x

6.4 Anti-Virus Exclusion

Add the following paths to your anti-virus exclusion list and re-test:

C:\Program Files\Siemens\Automation\PLCSIM\V15\
C:\Program Files (x86)\Siemens\Automation\PLCSIM\V15\
%LOCALAPPDATA%\Siemens\
%PROGRAMDATA%\Siemens\

7. Solution Tier 3 — Upgrade to TIA Portal V15.1

When the Tier 1 / Tier 2 fixes do not eliminate the crash, the most reliable remedy is a side-by-side install of TIA Portal V15.1 with the matching PLCSIM V15.1. The V15 license is honored by V15.1, existing projects import directly, and PLCSIM V15.1 targets a newer Windows servicing baseline.

7.1 Pre-Requisites

• Valid TIA Portal V15 license (any flavor — the V15.1 installer accepts it).
• Administrator account on the engineering station.
• At least 30 GB free disk space (V15 and V15.1 co-exist; they share the automation license manager but install into separate program directories).
• All TIA Portal and PLCSIM instances closed.

7.2 Install TIA Portal V15.1

1. Insert the TIA Portal V15.1 DVD or mount the ISO.
2. Run Setup.exe as administrator.
3. Select Side-by-side installation. Do not choose Update/Upgrade.
4. Select the same product packages (STEP 7 Professional, WinCC Professional, PLCSIM) that are licensed on V15.
5. Accept the license transfer dialog so the existing V15 license is detected.
6. Complete the install and reboot.

7.3 Install PLCSIM V15.1

1. From the same V15.1 media, run the PLCSIM installer.
2. Confirm that the Automation License Manager recognizes the existing PLCSIM V15 license; PLCSIM V15.1 uses the same license key.
3. Reboot when prompted.

7.4 Migrate and Validate the Project

1. Launch the V15.1 instance of TIA Portal (the start menu groups are distinct).
2. Open the V15 S7-1200 project — TIA Portal offers to upgrade the project schema. Confirm.
3. Compile the S7-1200 program. Resolve any warnings introduced by the schema upgrade.
4. Click Start Simulation. The PLCSIM V15.1 host should start without the CLR20r3 fault.

8. Solution Tier 4 — Clean Reinstall of TIA Portal V15

Use this tier only if V15.1 is not an option. Capture an image of the working station first; this path is destructive.

1. Open Control Panel → Programs and Features.
2. Uninstall in this order: PLCSIM V15, TIA Portal V15, SIMATIC Automation License Manager, then any residual WinCC components.
3. Delete residual folders:

rd /s /q "%ProgramFiles%\Siemens\Automation\PLCSIM\V15"
rd /s /q "%ProgramData%\Siemens\Automation\PLCSIM\V15"
rd /s /q "%ProgramData%\Siemens\Automation\TIA Portal\V15"

4. Clean the registry (export first as a safety net):

reg delete "HKLM\SOFTWARE\Siemens\Automation\InstalledSoftware\PLCSIM\V15" /f
reg delete "HKLM\SOFTWARE\Siemens\Automation\InstalledSoftware\TIA Portal\V15" /f

5. Reboot. Re-install TIA Portal V15 + Update 3 + PLCSIM V15 from the original media.
6. Apply the Tier 1 BITS / Network Downloader fix before the first simulation.

9. Edge Cases and Related Symptoms

9.1 PLCSIM Window Opens but Hangs at “Connecting…”

The host process does not crash, but the online connection never completes. This is a separate code path: check the Softnet interface (S7DOS / S7-Ethernet-Adapter) and ensure no other STEP 7 instance is bound to the same interface index. TIA Portal V15 PG/PC interface selection should be set to PLCSIM for the V15 instance.

9.2 Only S7-1500 Targets Crash, S7-1200 Works

Symptom contradicts the S7-1200 stack trace in the source signature, but it is reported in mixed labs. Cause is typically a stale S7-1500 firmware image under %ProgramData%\Siemens\Automation\PLCSIM\V15\Firmware. Delete the cache folder and re-import the firmware via TIA Portal.

9.3 Crash Only on First Start of the Day

Almost always a BITS cold-start timing issue. Increase the BITS Startup delay from 0 to 60 seconds via:

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS" /v StartupDelay /t REG_DWORD /d 60 /f

9.4 PLCSIM Fails Inside a Virtual Machine

PLCSIM V15 requires CPU virtualization extensions to be exposed to the guest. In Hyper-V, set ExposeVirtualizationExtensions = True on the VM processor. In VMware Workstation, enable Virtualize Intel VT-x / AMD-V in the VM settings. Without these, the simulation service may exit with a non-CLR fault, but the failure mode can look similar at the Windows event layer.

9.5 Two TIA Portal Versions Co-Exist but Only V15 Crashes

The V15 installation is referencing V15.1 redistributables due to a Windows side-by-side assembly resolution order change. Force the V15 host to use its own binaries by setting:

setx SxS_TRACE_REFERENCES 1 /m

then trace with SxSTrace. The standard fix is to upgrade to V15.1 entirely.

10. Verification

After applying a fix, perform the following verification before returning the station to service.

Step	Expected Result	Pass Criterion
Start TIA Portal V15 (or V15.1) with the S7-1200 project	TIA Portal loads the project without schema errors	No yellow banner, no “Project cannot be opened” dialog
Click Start Simulation	PLCSIM window appears within 5 seconds	VplcHost.exe visible in Task Manager
Click Download to Device	Download completes; PLC goes to RUN	Green RUN/STOP LED in PLCSIM
Toggle an input in the PLCSIM watch table	Output updates in the S7-1200 program	Online value matches logic
Re-launch after a full reboot	Simulation starts cleanly on cold boot	No CLR20r3 in event log
Run the TIA Portal self-test (Help → Self-Test)	All checks green	PLCSIM entry shows “OK”

11. Field-Ready Summary

1. Capture the exact signature (especially the assembly version 1500.0.2000.201 and the exception type System.Runtime.CallbackException).
2. Tier 1: enable BITS and clear the Network Downloader cache. Re-test.
3. Tier 2: repair the OS / .NET / VC++ runtime, add anti-virus exclusions. Re-test.
4. Tier 3: side-by-side install of TIA Portal V15.1 with PLCSIM V15.1. Migrate the project.
5. Tier 4: clean reinstall of V15. Use only when V15.1 is contractually blocked.

The Tier 3 path is the recommended remedy for production engineering workstations: it removes the crash code path, preserves the V15 license investment, and brings the station onto a Windows servicing baseline that is still under mainstream support.

FAQ