Resolving WinCC RT Professional V15.1 S7-1200 PLCSIM Failure

Problem Overview

WinCC Runtime Professional V15.1 is the HMI runtime that ships with TIA Portal V15.1. When the S7-1200 PLCSIM instance is started and WinCC RT Professional is launched in simulation mode, the runtime cannot reach the PLC even though the HMI connection is configured correctly in the project. The same WinCC RT Professional V15.1 project and runtime connect without issue to a simulated S7-1500 CPU. The regression is fixed in WinCC RT Professional V15 Update 4, where communication to both the S7-1200 and the S7-1500 PLCSIM targets is restored.

The mismatch is not in the S7-1200 firmware, nor in the WinCC project, but in the way the V15.1 runtime resolves the S7 communication access point when the target CPU is a simulated S7-1200. The same V15.1 runtime resolves the S7-1500 access point correctly, which is why the failure is only visible on the S7-1200 target. The behavior is consistent with the configuration guidance published in the Siemens support entry 88193789, which documents the access-point and PG/PC interface settings required to reach a simulated S7 CPU from WinCC Runtime Professional or Advanced.

Affected Products and Versions

Symptom Matrix

Root Cause Analysis

Three failure paths surface when WinCC RT Professional V15.1 is used against an S7-1200 PLCSIM. Each path is independent and must be ruled out in order before the V15.1 regression can be confirmed as the root cause.

1. PLCSIM Support Gap in the V15.1 Runtime

WinCC RT Professional V15.1 was released alongside TIA Portal V15.1. The runtime's connection manager was updated to support the S7-1500 PLCSIM interface (PLCSIM V15.1) but the S7-1200 PLCSIM path was not finalized in the same release. The runtime therefore returns a negative acknowledgment to the S7-1200 PLCSIM but completes the handshake with the S7-1500 PLCSIM. V15 Update 4 closes the gap and the connection succeeds for both targets. The corresponding Siemens support note is entry ID 88193789 on the Siemens Industry Online Support portal.

2. Access Point Misrouting

Every HMI connection in a WinCC RT Professional project carries an access point attribute. When the target is a PLCSIM instance, the access point must be set to PLCSIM. If the access point is left at S7ONLINE or at a physical Ethernet adapter, the runtime will not route the request to the simulator even when PLCSIM is running. The S7-1500 target is more tolerant because its PLCSIM exposes the same step adapter the S7-1500 hardware uses; the S7-1200 PLCSIM uses a separate, PLCSIM-specific access point and the V15.1 runtime will not fall back automatically. This is the failure mode referenced in the discussion thread and confirmed by Siemens support entry 88193789.

3. PG/PC Interface Configuration

The PG/PC interface is a Windows-level setting that determines which physical or virtual adapter the S7 communication driver uses. The setting is independent of the HMI project's access point, and the runtime reads it at startup. For PLCSIM targets, the interface must be set to PLCSIM.TCPIP.1 (or PLCSIM.MPI.1 when MPI is used in the project). A wrong assignment here is the most common reason the S7-1200 connection fails while the S7-1500 connection succeeds: the S7-1500 PLCSIM binds to the same virtual adapter as the S7-1500 hardware, so even an S7ONLINE assignment can reach it, but the S7-1200 PLCSIM does not.

Solution Paths

Three remediation paths are available. Pick the one that matches your release strategy.

Path A — Upgrade to V15 Update 4 (Recommended)

The cleanest fix is to install WinCC Runtime Professional V15 Update 4 on the runtime station. The update is a drop-in replacement for V15.1 and does not require re-compiling the TIA Portal project. Once installed, both the S7-1200 PLCSIM and the S7-1500 PLCSIM targets connect without further configuration changes.

1. On the engineering station, open TIA Portal and run "Support Packages → Read from Product DVD" for V15 Update 4.
2. Install the WinCC RT Professional V15 Update 4 setup on every runtime station.
3. Reboot the runtime station. The S7ONLINE helper service used by the runtime is replaced during the install and must be restarted.
4. Re-launch PLCSIM and WinCC RT Professional. Verify the connection state on the HMI screen.

Path B — Configure Access Point and PG/PC Interface in V15.1

If you must stay on V15.1, the runtime can still reach the S7-1200 PLCSIM if both the project's HMI connection and the Windows PG/PC interface are aligned to the PLCSIM adapter. The procedure is documented in the TIA Portal help under "Basics of communication — Runtime Advanced / Runtime Professional" and reinforced in Siemens FAQ 88193789.

1. Open the WinCC project in TIA Portal V15.1.
2. Select the HMI device in the project tree and open "Connections".
3. Select the S7-1200 connection and change the access point to PLCSIM. Apply the change.
4. Open "Control Panel → Set PG/PC Interface" on the runtime station.
5. Set the application access point PLCSIM to the interface PLCSIM.TCPIP.1. Click OK.
6. Restart the WinCC RT Professional service so the new assignment is picked up.

Path C — Verify Secure Communication Parameters

From TIA Portal V16 onwards, secure communication between WinCC Runtime (Advanced or Professional) and the S7-1200/1500 CPUs is enabled by default. If the project was upgraded from V15.1 to a newer release, the V15.1 runtime will not honor the secure channel, but the upgraded runtime will. The secure-communication document in the TIA Portal V20 help describes the prerequisites: Secure communication (RT Advanced, RT Professional). When troubleshooting an S7-1200 connection that was created in V15.1 and is now run on a newer runtime, verify the following items before assuming a runtime regression:

• The PLC's protection level allows PUT/GET communication from the HMI.
• The certificate assigned to the HMI connection is present in the runtime's certificate store.
• The "Use secure communication" checkbox in the HMI connection matches between the engineering project and the runtime configuration.

Step-by-Step Configuration Reference

The following procedure applies when WinCC RT Professional V15.1 is run against S7-1200 PLCSIM and the engineer must isolate the regression from a configuration error.

1. Start PLCSIM with the S7-1200 CPU. Confirm in the PLCSIM status bar that the simulated CPU is in RUN.
2. Confirm the S7-1200 IP address in PLCSIM (default is the address from the TIA Portal project, e.g., 192.168.0.1).
3. Open the WinCC project and select the HMI device.
4. Open the HMI connections editor. The connection to the S7-1200 should show the correct IP, rack 0, slot 1.
5. Set the access point of the S7-1200 connection to PLCSIM.
6. Compile the HMI project (full rebuild, not incremental).
7. On the runtime station, open Control Panel → Set PG/PC Interface. Set the PLCSIM access point to PLCSIM.TCPIP.1.
8. Restart the WinCC RT Professional service from the Windows Services console or the WinCC RT Professional tray icon.
9. Start WinCC RT Professional in simulation mode. The connection should establish within 5 seconds.

Verification Procedure

Use the following checks to confirm the connection is healthy. Each check is independent; do not stop at the first pass.

1. Runtime status icon — The system tray icon for WinCC RT Professional turns green when the connection is established and amber/red on failure.
2. Tag diagnostics — Open the WinCC tag simulator (or a screen with a diagnostic tag). The "PLC" column must show the runtime, not "internal".
3. PLCSIM monitor — The S7-1200 PLCSIM shows a connection count greater than zero in the "Online" tab.
4. WinCC channel diagnostics — In the runtime's CCDataBridge log, look for the SIMATIC S7-1200 channel and confirm the status code is 0x0000 (success).
5. Wireshark / s7cap trace (optional) — Filter on the S7 communication port (ISO-on-TCP port 102). The runtime must send a CR TPDU and receive a CC TPDU with the simulated CPU.

Commissioning Checklist

Troubleshooting Matrix

Diagnostic Codes

When WinCC RT Professional cannot reach an S7-1200 PLCSIM, the channel diagnostic often carries one of the following status codes. Use the table to map the code to a remedy; for codes outside this list, consult the WinCC Runtime Professional diagnostic manual in the TIA Portal help.

Differences Between S7-1200 and S7-1500 PLCSIM Targets

The reason the failure is target-specific is rooted in the way the two PLCSIM variants expose themselves to the runtime. The S7-1500 PLCSIM publishes a step adapter that is compatible with the S7-1500 hardware stack; WinCC RT Professional V15.1 can reach it via the default S7ONLINE access point. The S7-1200 PLCSIM uses a separate, PLCSIM-specific adapter that the V15.1 runtime does not probe unless the project's HMI connection explicitly selects the PLCSIM access point and the Windows PG/PC interface is mapped to PLCSIM.TCPIP.1. Once both assignments are correct, the runtime negotiates the S7-1200 PLCSIM handshake the same way it negotiates the S7-1500 PLCSIM handshake. The V15 Update 4 runtime hardens this negotiation so the default S7ONLINE access point also works for the S7-1200 PLCSIM target, removing the manual configuration step.

Project Migration Considerations

When migrating a V15.1 project to V15 Update 4 or a later release, the HMI connection attributes and the PG/PC interface assignment are preserved by the TIA Portal migration wizard. The following points apply:

• HMI connection access point: remains at PLCSIM; no change required.
• PG/PC interface mapping: remains at PLCSIM.TCPIP.1; no change required.
• Secure communication: introduced in V16. The V15.x project opens in V16 with secure communication disabled, which preserves the V15.1 behavior. Enable secure communication only after verifying the certificate path described in Secure communication (RT Advanced, RT Professional).
• Runtime version on the target station: must match or exceed the engineering version. A V15.1 runtime cannot load a V16-compiled project, but a V15 Update 4 runtime can load a V15.1-compiled project.

FAQ