Resolving WinCC Runtime Advanced S7-PLCSIM Connection Failures

Resolving WinCC Runtime Advanced S7-PLCSIM Connection Failures

Engineers running WinCC Runtime Advanced (WinCC RT Adv) on a Windows host or virtual machine frequently encounter a "Connected" status message in the runtime that does not actually display any process tags, and the TIA Portal editor refuses to go Online with the panel project. The root cause is almost always a mismatch between the HMI connection configuration in the TIA project and the PC Station access point (PG/PC interface) used by the runtime. The same failure mode appears when S7-PLCSIM (or S7-PLCSIM V20, the modern variant) runs in a separate VM and the HMI runtime runs in a second VM and the TCP/IP routing layer (PLCSIM Virtual Ethernet Adapter, NetToPLCSIM, or a bridged virtual NIC) is misconfigured.

This reference consolidates the official Siemens procedures for tag simulation, the S7ONLINE access point, PG/PC interface configuration, and the "non-integrated connection" requirement for S7-300/S7-400 PLCs simulated by PLCSIM. The procedures apply to TIA Portal V13 SP1 through V20. Where the source product is V13 and the modern equivalent is V20, both procedures are given.

1. Problem Description

The reported symptom set is consistent across multiple Siemens and customer configurations:

• WinCC RT Advanced starts and reports Connected in the title bar or status line, but all configured process tags display 0, ###, or the initial value defined in the HMI tags table.
• The TIA Portal editor cannot establish an Online connection to the HMI tag, even though the project compiles without errors.
• S7-PLCSIM is running in the same VM as the TIA Portal project, or in a separate VM bridged to the HMI runtime VM. PLCSIM is in RUN, the CPU is not in STOP, and the instance shows no connection errors.
• Both virtual machines (or hosts) can ping each other on the bridged network. The Windows Firewall has been temporarily disabled for testing and the problem persists.
• The Siemens Automation License Manager reports valid licenses for both WinCC RT Advanced and S7-PLCSIM.

When the symptom shows "Connected" but no data is exchanged, the HMI runtime is reaching an internal placeholder or a stale OPC DA cache rather than the PLCSIM instance. When the editor cannot go Online, the PG/PC interface assignment is pointing to a different access point than the runtime is using.

2. Root Cause Analysis

Three independent failure mechanisms can each produce the reported symptom. They are usually present in combination when the HMI and the simulated PLC live in different VMs.

2.1 Access Point Mismatch (Primary Cause)

WinCC RT Advanced uses the S7ONLINE access point of the Windows host it runs on. TIA Portal's Online functions use the same S7ONLINE access point when connecting to the panel. The HMI connection defined in the TIA project (HMI Devices → Connections → Connection_1) is bound to a specific access point at compile time. If the project's connection is defined as S7ONLINE (Integrated) and the PC station is configured as a non-integrated connection, the runtime cannot route to PLCSIM.

2.2 NetToPLCSIM / Virtual NIC Not Bridged

When PLCSIM runs in a different VM than the WinCC RT, the HMI host must reach the PLCSIM TCP/IP socket. PLCSIM exposes a simulated Ethernet interface bound to a MAC address. NetToPLCSIM (or the built-in PLCSIM V20 Virtual Ethernet Adapter) acts as a TCP/IP-to-MPI/Profibus relay. If the access point on the HMI host is not assigned to the NetToPLCSIM virtual NIC, the HMI runtime will fail or silently default to no connection.

2.3 Non-Integrated Connection Required for S7-300 / S7-400

S7-300 and S7-400 PLCs, including the S7-414 referenced in the source case, cannot be operated in TIA Portal as a fully integrated PC station when simulated by PLCSIM. The TIA Portal Online diagnostics for these CPU families require the connection to be marked as non-integrated in the HMI connection editor. For S7-1200 / S7-1500 the integrated connection works with PLCSIM V20's virtual adapter.

3. Prerequisites

• TIA Portal V13 SP1 (for V13) or V16–V20 (current). The project's HMI device must be a WinCC RT Advanced, not a Comfort Panel or Basic Panel.
• S7-PLCSIM installed and licensed. For V13: legacy S7-PLCSIM V5.4 SP8 or TIA-integrated PLCSIM V13. For V16+: PLCSIM V16/V17/V18/V19/V20. See the Siemens KB 109747174 (WinCC Runtime Advanced simulation) entry point for version-specific notes.
• If PLCSIM and the HMI runtime are in different VMs, NetToPLCSIM (free) on the HMI host for legacy PLCSIM, or the PLCSIM Virtual Ethernet Adapter that ships with PLCSIM V16+.
• Windows administrative rights to change the PG/PC interface and the SIMATIC AccessPoint settings.
• Network bridge between the two VMs configured (host-only with promiscuous mode enabled, or "Allow promiscuous mode" on the vSwitch if VMware Workstation/ESXi is used).

4. Solution A — Single VM, TIA Portal V13 (V13 Source Case)

This solution applies when both WinCC RT Advanced and S7-PLCSIM are installed in the same VM and the CPU being simulated is an S7-300 / S7-400.

4.1 Mark the HMI Connection as Non-Integrated

1. Open the TIA Portal project. In the project tree, expand HMI_1 [WinCC RT Advanced] → Connections.
2. Double-click Connection_1.
3. In the Connection area, set the Integration dropdown to Non-integrated connection.
4. Set the Access Point to S7ONLINE (the default) and the Interface to TCP/IP (Auto) if simulating a S7-1200/1500, or to the appropriate MPI/Profibus/TCP entry for S7-300/400.
5. Compile the HMI project (right-click HMI device → Compile → Software (rebuild all)).

4.2 Configure PG/PC Interface

1. Open the Windows Control Panel → Set PG/PC Interface (the SIMATIC entry, not the Windows network control).
2. In the Access Point of the Application dropdown, select S7ONLINE.
3. In the Interface Parameter Assignment Used list, select the network adapter that is bridged to the PLCSIM instance. For single-VM simulation, choose the physical NIC or the VMware/VirtualBox host-only adapter. For NetToPLCSIM, choose the PLCSIM virtual NIC entry.
4. Click OK. Restart WinCC RT Advanced.

4.3 Verify S7ONLINE Routing

Open Set PG/PC Interface again, then click Diagnostics. In the Diagnostics dialog the Test button cycles through accessible nodes on the selected access point. With PLCSIM in RUN, the diagnostics should list the simulated CPU's IP address (or the loopback 127.0.0.1) as reachable.

5. Solution B — Two VMs, PLCSIM V16+ with Virtual Ethernet Adapter

This is the recommended path for current TIA Portal projects (V16, V17, V18, V19, V20). PLCSIM V16+ ships with a Virtual Ethernet Adapter that provides a true network interface visible to other hosts, eliminating the need for NetToPLCSIM.

5.1 Configure the Simulated CPU for TCP/IP

1. In PLCSIM, drag the CPU to the PLCSIM instance. The instance window shows the Virtual Ethernet Adapter MAC address.
2. In the TIA Portal project, open the simulated CPU's Properties → PROFINET Interface [X1] → Ethernet addresses. Set the IP address to e.g. 192.168.0.10 and the Subnet mask to 255.255.255.0. Make sure the IPv4 Protocol is set to Use router if the HMI host is on a different subnet.
3. Compile the PLC program and download to PLCSIM.

5.2 Configure the HMI Connection in TIA

1. Open the HMI connection as in §4.1. Set Integration to Non-integrated connection.
2. Set Access Point to S7ONLINE and Interface to the network adapter on the HMI host that can route to the PLCSIM instance (the bridged NIC).
3. Compile the HMI project, then start WinCC RT Advanced.

5.3 Set PG/PC Interface on the HMI Host

1. On the HMI host, open Set PG/PC Interface.
2. Select S7ONLINE → the bridged NIC (e.g. Intel(R) PRO/1000 MT Desktop Adapter - TCP/IP [Auto]).
3. Confirm the assignment with Diagnostics and a ping from the HMI host to 192.168.0.10.

6. Solution C — Two VMs, NetToPLCSIM (Legacy PLCSIM V5.x / V13)

For legacy PLCSIM that lacks a virtual Ethernet adapter, NetToPLCSIM is the standard bridge. It is published on the Siemens support pages and operates as a TCP/IP-to-MPI/Profibus relay.

6.1 Install and Start NetToPLCSIM

1. Install NetToPLCSIM on the HMI host VM (or any VM that can reach the PLCSIM instance via TCP/IP).
2. Start PLCSIM first, then start NetToPLCSIM.
3. In NetToPLCSIM, click Add and enter the IP address of the PLCSIM Virtual Ethernet Adapter (default 127.0.0.1), the MAC address (read from PLCSIM's Station dialog), and the TSAP for the S7 connection (e.g. 01.01 for an S7-300/400).
4. Click Start Server. NetToPLCSIM opens TCP port 102 on the host it is running on.

6.2 Route WinCC RT Through NetToPLCSIM

1. On the HMI host, set PG/PC interface: S7ONLINE → the NetToPLCSIM virtual NIC or the bridged NIC that reaches the NetToPLCSIM VM.
2. In the TIA Portal HMI connection, point the IP address at the NetToPLCSIM VM's IP (or loopback 127.0.0.1 if co-located).
3. Compile and start the runtime.

7. Tag Simulation Without a Real PLC

When the goal is to validate the HMI screen layout and tag animation rather than the PLC interface, WinCC RT Advanced supports a built-in tag simulator. See the Siemens WinCC Runtime Advanced simulation entry page for the canonical description, and the TIA Portal help at Simulating a project for the step-by-step.

1. In TIA Portal, open the HMI project. From the menu bar, choose Online → Simulation → With tag simulator.
2. WinCC RT Advanced starts in simulation mode. The tag simulator opens as a side panel.
3. Add tags to the simulator and choose a generation mode (Sine, Sawtooth, Random, or Increment) and amplitude. The runtime immediately reflects the generated values.
4. This mode does not require PLCSIM, S7ONLINE, or a network connection. It exercises only the HMI logic layer.

8. HMI Connection Configuration Matrix

9. Verification Procedure

1. In the WinCC RT Advanced runtime, open a screen that contains at least one tag reference (e.g. an I/O field bound to "DB1.DBD0").
2. Start PLCSIM and download the PLC program. The simulated CPU must be in RUN. The PLCSIM instance window must show green status indicators for the PROFINET interface.
3. Confirm the runtime screen displays the value from the simulated PLC (not 0 or initial value).
4. From the TIA Portal project tree, right-click the HMI device → Go online. The Online dialog should show the runtime as Online (connected) with the project checksum matching.
5. In the runtime, force a tag value in PLCSIM and verify the change appears on the HMI screen within the configured update cycle (default 1 s).

10. Field-Proven Caveats

• Firewall rules. Siemens PLC communication uses TCP port 102. Windows Firewall on either VM must allow this port, or the connection will fail silently with the same "Connected but no tags" symptom.
• VMware promiscuous mode. The PLCSIM Virtual Ethernet Adapter relies on raw Ethernet frames. The vSwitch must be set to Allow promiscuous mode and Allow MAC address changes, otherwise frames are dropped before reaching the bridge.
• License recheck after VM restore. S7-PLCSIM and WinCC RT Advanced licenses are bound to the host fingerprint. Restoring a VM snapshot reverts the license state. Re-run the Automation License Manager repair function if either runtime reports license failures.
• Multiple NICs. On hosts with both a corporate NIC and the PLCSIM bridge, Windows can bind the wrong adapter to S7ONLINE. Force the binding by editing C:\ProgramData\Siemens\Automation\S7PCT00.INI manually or by disabling the wrong NIC in the S7ONLINE access point list.
• VM clock skew. PLCSIM aborts the connection if the host clock is more than a few minutes off. Synchronize the VMs to a common NTP source before commissioning.

11. Diagnostic Quick Reference

12. FAQ