Resolving TIA Portal V15 PLCSIM HMI Connection Failures on S7-1500F CPUs

Engineers commissioning fail-safe (F) SIMATIC S7-1500 systems with a Comfort Panel HMI in TIA Portal V15 frequently encounter a situation where the PLC project compiles, downloads to PLCSIM, and executes the safety program without error, yet the HMI runtime shows a connection loss indicator, the HMI tags remain #-stamped, and the integrated HMI simulation never starts. The phenomenon is reproducible across S7-1511F, S7-1513F, S7-1515F, S7-1516F, S7-1517F, and S7-1518F controllers, and it is documented to occur with both the WinCC Comfort and WinCC Advanced panels in the V15 toolset. Standard S7-1500 and S7-1200 controllers do not exhibit the fault, which initially misleads engineers toward safety licensing or F-runtime errors. The root cause is a mismatch between the panel firmware version configured in the TIA Portal device configuration and the firmware actually loaded into the Comfort Panel image, compounded by the way TIA Portal V15 manages the PLCSIM PG/PC interface for F-capable controllers.

This article provides a step-by-step engineering procedure to identify and resolve the failure, plus the firmware compatibility matrix, diagnostic register values, and verification tests that allow the engineer to confirm the HMI tag exchange end-to-end without leaving the PLCSIM runtime.

1. Problem Definition and Failure Symptoms

The fault is identifiable by the following set of symptoms in the engineering environment:

• The S7-1500F user program downloads to PLCSIM without compile error and the RUN LED on the simulated CPU is green.
• The fail-safe program executes; SAFE_DB tags update and the F-runtime group signature remains valid (no F-peripheral fault, no F-I/O access error of type 1..4).
• The WinCC Comfort project compiles without warnings and the HMI simulation launches from Online → Simulation → Start.
• The HMI runtime shows the configured start screen, but tag values are not refreshed. Status line reads Connection to PLC interrupted or No connection.
• In the PLCSIM instance the Online & diagnostics view shows the panel's HMI connection is not in ESTABLISHED state.
• Substituting the F-CPU with a non-F S7-1500 or S7-1200 in the same project makes the connection succeed, confirming the F-CPU is the trigger.

The same project compiled with TIA Portal V14 SP1 or earlier against the same panel image does not reproduce the failure. This is the strongest single evidence that the cause is tool-version dependent rather than hardware dependent.

2. Affected Components and Software Versions

The following component matrix is the field-validated scope of the problem. Firmware numbers and catalog numbers are taken from the official Siemens product lists and not inferred.

The PLCSIM safety runtime support is included with the S7-PLCSIM V15 option since V15.1; the V15.0 base does not provide F-CPU emulation, which forces many engineers to upgrade the package. Confirm the installed version under Help → Installed software → SIMATIC S7-PLCSIM.

3. Root Cause Analysis

Three independent causes have been isolated in the field. They frequently co-exist on the same engineering workstation, which is why a partial fix sometimes appears to work for one project and fail for another.

3.1 Panel Firmware Mismatch

TIA Portal V15 ships with a default panel firmware for TP1500 Comfort of V15.0. When the TIA project is opened in V15.1 or later the panel device configuration is automatically upgraded, but the firmware selector in the panel Device view → Properties → General → Catalog → Firmware field is sometimes left at V15.0. The Comfort Panel runtime, when launched against a PLCSIM instance of an S7-1500F CPU whose firmware is >= V2.5, expects to negotiate the connection using the extended PN stack of the F-CPU. If the panel firmware cannot decode the connection handshake, the TCP socket closes immediately and the connection status reverts to Interrupted within 1000 ms. The fix is to raise the panel firmware to a release equal to or greater than the F-CPU firmware.

3.2 PLCSIM PG/PC Interface Locked

When PLCSIM launches a simulated instance, it binds the local PN/IE interface to the PLCSIM virtual adapter and forces the PG/PC interface in the Online → Accessible nodes dialog. The interface selection dropdown is therefore grayed out, and only the Connection subnet list remains editable. If the HMI connection in the project is bound to a different subnet (for example PN/IE_2 when the PLC's PN interface is PN/IE_1), the routing fails and the HMI never sees the controller.

3.3 S7-PLCSIM F-Runtime License

PLCSIM V15.0 refuses to download an F-CPU configuration. The download is silently rejected with diagnostic buffer entry 0xE0FE ("Safety program cannot be simulated") and the F-runtime group is disabled. The HMI connection then terminates because the configured F-tag ranges are not updated. The license must be upgraded to S7-PLCSIM V15.1 or later, or the safety program must be replaced with a non-F block library for the duration of the test.

4. Pre-Diagnostic Procedure

Capture the following data points before changing any settings. The diagnostic buffer of the simulated CPU and the trace buffer of the Comfort Panel simulation are volatile once the PLCSIM instance is closed.

1. Open the project, right-click the PLC_1 [CPU 1511F-1 PN] → Online & diagnostics → Diagnostics buffer. Export the last 200 entries to a CSV using the toolbar button.
2. Read the CPU Online → Accessible nodes → Flash LED to confirm PLCSIM is responding on the bound interface.
3. Open the HMI project and select Online → Simulation → Start. Note the connection status in the status line of the runtime.
4. Capture the HMI runtime log via Start → Control Panel → WinCC Runtime → Trace and export to C:\Temp\HmiTrace.log.
5. Open Project tree → Devices & networks → Networks view. Note the IP address, subnet mask, and router address of every node. The simulation path must use the PLCSIM virtual adapter, not the physical NIC.

5. Step-by-Step Solution

5.1 Resolve the Panel Firmware Mismatch

1. In the TIA Portal project tree expand HMI_1 [TP1500 Comfort] and double-click Device configuration.
2. Select the TP1500 in the device view. Open Properties → General → Catalog → Firmware.
3. Click the firmware dropdown and select the highest available firmware that is supported by the installed TIA Portal HSP. For TIA V15 the maximum is V16.0; for V15.1 it is V17.0; for V16 it is V18.0.
4. Click Apply and recompile the HMI project with Compile → Software (rebuild all).
5. Recompile the PLC project so that the HMI connection is regenerated with the new panel firmware identifier. Use Compile → Hardware (rebuild all).

5.2 Configure the PLCSIM Virtual Interface

1. Close any open PLCSIM instance.
2. Open Start → Control Panel → Set PG/PC interface.
3. Select S7PLCSIM (TCP/IP) → TCP/IP → <PLCSIM virtual adapter> as the access point for S7ONLINE. The PLCSIM virtual adapter appears only when the S7-PLCSIM package is installed.
4. Click OK and close the dialog. The setting is stored in the registry under HKLM\SOFTWARE\Siemens\Automation\Interfaces\S7ONLINE.
5. Re-launch PLCSIM and the HMI simulation. The interface selector remains grayed out (this is expected) but the connection now resolves.

5.3 Bind the HMI Connection to the Correct Subnet

1. Open Devices & networks → Networks view.
2. Click the HMI connection line between the TP1500 and the S7-1511F. The Properties → General → Interface tab opens.
3. Set Endpoint 1 (HMI) to the same subnet as the PLC's PN interface, by default PN/IE_1.
4. Set Endpoint 2 (PLC) to the same subnet, ensuring both endpoints are members of the same Subnet object.
5. Verify the IP of the HMI endpoint is in the same /24 range as the PLC endpoint. PLCSIM assigns the PLC an address in 192.168.0.x by default; the HMI must be in 192.168.0.0/24 unless the project explicitly changes it.

5.4 Ensure the S7-PLCSIM F-Runtime is Available

1. From the TIA Portal menu Options → Support packages → Installed support packages verify that S7-PLCSIM Safety is listed.
2. If not, install the F-support package from the product DVD or the Siemens Online Software Delivery portal.
3. Re-compile the PLC project. The F-runtime group should now download without diagnostic buffer entry 0xE0FE.

5.5 Rebuild the HMI Tags

After raising the panel firmware, the HMI tag references are regenerated. The procedure below avoids the orphaned-tag class of error (diagnostic buffer 0x001F on the HMI side, runtime log entry Tag not connected):

1. Select HMI_1 → HMI tags → Show all tags.
2. Right-click the tag table and choose Update → Update from PLC.
3. Compile the HMI project with Compile → Software (rebuild all). The warnings Tag not connected should disappear.

5.6 Recompile and Reload the Complete Project

1. Select the PLC project folder and press F5 to download to PLCSIM.
2. Once the PLC reports RUN, launch the HMI simulation with Online → Simulation → Start with compiler output.
3. Verify the status line in the HMI runtime reads Connection established within 5 seconds of launch.

6. Verification Procedure

The fix is considered complete when the following three independent checks succeed. Each is taken from the official Siemens PLCSIM and WinCC Comfort documentation.

Additionally, a programmatic verification can be added to the user program: an AlwaysTrue contact in the OB1 writes a counter value into DB1.HMI_Heartbeat. The HMI side creates an animation that toggles a circle between green and red based on the heartbeat increment. The visual cycle confirms the cyclic polling of the F-CPU and a real tag exchange over the PLCSIM virtual network.

7. Compatibility and Edge Cases

7.1 S7-1500F with TIA Portal V15 and Older WinCC Comfort

Engineers who must stay on TIA Portal V15 because of an installed S7-1500F V1.x CPU in another cell can still simulate a V2.5 F-CPU provided the WinCC Comfort panel firmware is at V16.0 or higher. The combination of TIA V15 (tool) and panel V16 (runtime) is the minimum supported pairing. Any attempt to use a panel V15.0 against a CPU V2.5 fails with the symptom described in section 1.

7.2 S7-1500F with PC Runtime (WinCC Runtime Advanced)

The same root cause applies to a PC-based HMI. The PC station must have the matching WinCC Runtime Advanced installation package with the corresponding firmware; the firmware mismatch is reported in the PC station's local trace under %ProgramData%\Siemens\Automation\WinCC RT Advanced\Logs. Raise the PC runtime firmware in PC station → Properties → General → Catalog → Firmware in the same way as the Comfort Panel.

7.3 S7-1200F and ET 200SP F-CPU

S7-1200F (article number 6ES7214-1AF40-0XB0 and later) and ET 200SP F-CPU (6ES7510-1SJ01-0AB0) follow the same rule. The panel firmware must be at or above the F-CPU firmware. The default panel firmware in TIA V15 is V15.0; S7-1200F V4.4 or later requires at least V15.1 on the panel.

7.4 Mixed F and Non-F in the Same Project

If a project contains both an S7-1511F and an S7-1511 (non-F), PLCSIM emulates both instances. The highest panel firmware wins, and a single HMI panel can communicate with both controllers provided two HMI connections are configured. The TIA Portal compiler will issue an information I:19045 - Multiple PLCs detected in project, which is expected and not an error.

8. Advanced Diagnostics: Reading the HMI Trace

The HMI runtime writes a structured trace when a connection attempt fails. The relevant entries are listed below with the corresponding corrective action.

9. Field-Proven Configuration Snapshot

The configuration below is a reproducible working baseline for the V15 toolset on Windows 10 1909. It is included so that the engineer can confirm a known-good state before re-introducing project-specific changes.

• TIA Portal: V15.1 update 5 (HSP 0158)
• PLCSIM: V15.1 update 4 with S7-PLCSIM Safety support package
• CPU 1511F-1 PN firmware: V2.6 (6ES7511-1FK02-0AB0)
• TP1500 Comfort firmware: V16.0 (6AV2124-1QC02-0AX1)
• PLC IP: 192.168.0.1, mask 255.255.255.0
• HMI IP: 192.168.0.2, mask 255.255.255.0
• PG/PC interface: S7PLCSIM (TCP/IP) → PLCSIM virtual adapter
• HMI connection name: HMI_Connection_1, partner: PLC_1, type: S7 connection
• F-runtime group: F_RTG_1, signature: F-CPU auto-generated, passivation active

With the configuration above, the HMI connection is established within 1.5 s of launching the HMI simulation, and the F-tags become visible without operator intervention.

10. References Within the Article

For a complete visual guide to setting up PLCSIM with WinCC Comfort in TIA Portal, refer to the Siemens application example Simulation of WinCC TIA Portal and PLCs. The document covers both single-PLC and multi-PLC HMI simulation scenarios, including the supported subnets and the PG/PC interface assignment required for the PLCSIM virtual adapter.

11. FAQ