Resolving TIA Portal V19 PLCSIM to WinCC V8.0 Communication Failures

When a TIA Portal V19 project running on an engineering station must exchange live tag data with a stand-alone WinCC Explorer V8.0 SCADA on a separate Industrial PC (IPC), the most common failure mode is a transport mismatch between the Siemens PLCSIM instance and the WinCC runtime. PLCSIM Standard is a local virtual controller only — it does not accept incoming TCP connections from another machine. WinCC V8.0 on a remote IPC therefore cannot read or write tags, the connection shows a red broken icon, and the operator gets no data. This article walks through the diagnosis, the PLCSIM Standard vs. PLCSIM Advanced decision, the PG/PC interface assignment, NetToPLCSim bridging, WinCC channel configuration, and the verification sequence that proves end-to-end tag traffic.

1. Problem Definition

Observed behavior. A TIA Portal V19 engineering station hosts an S7-1500 program and starts Start simulation (PLCSIM). A separate physical IPC runs WinCC Explorer V8.0 with a configured S7-1500 channel pointing to the engineering station's IP. After WinCC runtime start, the channel diagnostics show:

• Connection status icon remains red / broken.
• System log reports 700002 (connection establishment failure) or 700001 (connection aborted).
• Tag quality is bad / communication failure; no process values update.
• Power tags from S7-1500 program remain at initial value 0.

Scope. The failure is reproducible only when WinCC and PLCSIM run on different Windows machines. If WinCC Runtime and PLCSIM are co-located in the same TIA Portal project (Start WinCC Runtime from TIA), communication succeeds because the S7 channel uses an internal loopback. The moment WinCC is on a stand-alone IPC, the loopback no longer applies.

2. Root Cause Analysis

PLCSIM exists in two distinct product variants in the Siemens TIA V19 portfolio, and they have fundamentally different network capabilities:

Because PLCSIM Standard does not advertise itself on the network, WinCC V8.0 S7 channel attempts to open a TCP socket to the engineering station's IP on port 102 and the connection is refused (RST) by the Windows TCP stack — there is no PLCSIM listening there. The WinCC channel reports a connection establishment failure within the configured reconnect time (default 30 s).

Bridge alternative. If a full PLCSIM Advanced license is not available, the open-source NetToPLCSim utility (Siemens-SPS-Forum / GitHub community) can act as a TCP proxy that forwards WinCC frames on port 102 to the local PLCSIM Standard instance. This is suitable for engineering and FAT, not for production.

3. Required Architecture

The engineering station and the SCADA IPC must share an L2/L3 reachable subnet, and the route from the IPC must reach the engineering station's NIC that PLCSIM/NetToPLCSim is bound to. Industrial site installations frequently use a dedicated simulation VLAN — that is acceptable, but make sure the IPC is on it too.

4. Prerequisites

1. TIA Portal V19 (Update 2 or later recommended) installed on the engineering station.
2. Either S7-PLCSIM Advanced V6.0 (article number 6AV2102-0AA06-0AA0) or PLCSIM Standard V19 with NetToPLCSim v1.2.x.
3. WinCC V8.0 Update 4 or later installed on the SCADA IPC, with the appropriate AS-OS Engineering license.
4. Windows user accounts with administrator privileges on both machines (required for firewall changes and PG/PC interface assignment).
5. Static IP addresses on both stations. DHCP leases must be reserved; do not rely on mDNS or NetBIOS for the S7 channel.

5. Path A — Use PLCSIM Advanced (Recommended for Virtual Commissioning)

5.1 Install and license

1. Install S7-PLCSIM Advanced V6.0 from the Siemens online support portal.
2. Activate the license via the Automation License Manager. Confirm "PLCSIM Advanced" appears under Active licenses.

5.2 Configure the virtual PLC

1. Open the TIA Portal project, project tree → Devices & networks.
2. Right-click the S7-1500 CPU → Start simulation. TIA Portal launches the PLCSIM Advanced control panel.
3. In the PLCSIM Advanced UI, click Add instance, select S7-1500, and choose a virtual Ethernet interface (default PLCSIM virtual adapter).
4. Set the instance IP to 192.168.0.10 (or your engineering station's LAN IP). Enable External access — this is the switch that allows remote WinCC clients.
5. Download the hardware configuration to the virtual PLC.

5.3 Verify port 102 is listening

From the engineering station PowerShell:

Expected output: a row with LocalAddress 0.0.0.0 or the assigned IP. If no row appears, external access is disabled or the instance is not running.

5.4 Configure WinCC V8.0 channel

1. Open WinCC Explorer on the SCADA IPC.
2. Right-click Tag Management → SIMATIC S7-1500 Channel → New Connection.
3. Set Connection parameters:
   • IP address: 192.168.0.10 (PLCSIM Advanced host)
   • Access point: S7ONLINE
   • Rack / Slot: 0 / 1 for S7-1500
4. Set Connection name to something meaningful (e.g. PLCSIM_Adv_CPU1).
5. Save the project and start WinCC Runtime.

6. Path B — Use PLCSIM Standard with NetToPLCSim

This path is appropriate when PLCSIM Advanced is unavailable and only a small FAT (Factory Acceptance Test) loop is needed. It is not supported by Siemens and should not be used for customer acceptance unless the user has been informed and accepted the limitations.

6.1 Install NetToPLCSim

1. Download NetToPLCSim from the public GitHub repository (community project, current release 1.2.5). Verify the SHA-256 of the binary.
2. Extract to C:\Tools\NetToPLCSim on the engineering station.
3. Run as administrator.

6.2 Configure the proxy

1. In NetToPLCSim, click Add.
2. Network IP: the engineering station's LAN address (192.168.0.10). This is the address the SCADA IPC will target.
3. Plcsim IP / Port: 127.0.0.1 / 102 (the local PLCSIM instance).
4. Click Start Server. The status indicator should turn green.

6.3 Open the firewall

On the engineering station, allow inbound TCP port 102 for NetToPLCSim.exe:

New-NetFirewallRule -DisplayName "NetToPLCSim TCP 102" `
  -Direction Inbound -Protocol TCP -LocalPort 102 `
  -Program "C:\Tools\NetToPLCSim\NetToPLCSim.exe" -Action Allow -Profile Any

6.4 Configure WinCC V8.0 to point at the proxy

1. In WinCC Explorer → Tag Management → SIMATIC S7-1500 Channel add a new connection.
2. IP address: the engineering station LAN address 192.168.0.10 (NOT 127.0.0.1).
3. Save and start runtime.

7. PG/PC Interface Assignment

The PG/PC interface is the Windows layer that routes S7 protocol traffic. Misassignment is the second most common cause of failure.

1. Open Control Panel → Set PG/PC Interface on the engineering station.
2. For PLCSIM Advanced, select S7ONLINE (STEP7) → TCP/IP (Auto) → <your LAN adapter>.
3. For NetToPLCSim, the same entry is correct — NetToPLCSim binds the LAN adapter, not PLCSIM.
4. Apply. Restart TIA Portal so the change is picked up.

8. Firewall and Windows Defender Hardening

On hardened Windows Server 2019/2022 IPCs, Windows Defender Firewall with Advanced Security blocks all inbound traffic by default. Create explicit inbound allow rules for ports 102 and (optionally) 4840. Disable any third-party host intrusion prevention (HIPS) profile that performs application-aware filtering, as it can misinterpret the ISO-on-TCP connection attempts as port scans.

9. Verification Sequence

1. L3 reachability. From the SCADA IPC: ping 192.168.0.10. Must reply.
2. TCP/102 open. From the SCADA IPC PowerShell: Test-NetConnection -ComputerName 192.168.0.10 -Port 102. Expected TcpTestSucceeded: True.
3. WinCC connection status. In WinCC Explorer → Tools → Channel Diagnostics, the connection icon turns green within 30 s.
4. Tag force test. In WinCC Graphics Designer, insert an I/O field bound to a known tag (e.g. DB1.DBX0.0). Toggle the bit in PLCSIM. The I/O field updates within one WinCC acquisition cycle (default 1 s).
5. Alarm test. Force a bit mapped to a WinCC message. The alarm appears in the Alarm Control within 2 s.
6. WinCC syslog. Open C:\Program Files (x86)\Siemens\WinCC\Diagnose\WinCC_SysLog.log. Confirm no 700xxx errors within the last 5 min.

10. Common Error Codes and Remediation

11. Troubleshooting Matrix

12. Security and Licensing Caveats

• PLCSIM Advanced exposes a real S7-1500 endpoint. Treat the engineering station as if it were a live controller on the plant network — segment it via VLAN and disable any HMI/Web server features in the simulated CPU configuration.
• Disable the integrated Web server of the simulated S7-1500 unless explicitly required. The default user page can leak diagnostic data.
• Use a separate Windows user for the WinCC runtime service; do not run it as Administrator on the production HMI image.
• Licensing: PLCSIM Advanced requires a valid license. Without it, the simulated instance still starts but external access is disabled at the application layer. WinCC channel will behave identically to PLCSIM Standard.

13. Migration to WinCC Unified (Optional)

If the project will eventually be ported to WinCC Unified V19, configure the PLCSIM Advanced OPC UA server now. The Unified channel "SIMATIC Unified PC" connects to opc.tcp://192.168.0.10:4840 directly, with no S7 channel involved. This gives a cleaner separation between simulation and SCADA layers and is the supported path going forward.