Resolving WinCC TIA V15.1 / V16 Simulator Crash When an HMI Connection to a PLC Is Active

Symptom in one line: Starting the WinCC Runtime Simulator inside TIA Portal V15.1 or V16 works when the HMI tag is unbound, but the RT process terminates immediately (or within a few seconds) as soon as an HMI-to-PLC connection is configured. Comfort Panels are not affected; only Basic Panels reproduce the failure. TIA Portal V14 SP1 Update 9 on the same Windows 7 64-bit image continues to operate correctly.

1. Failure Description and Scope

The defect has been reproduced against a minimal, empty TIA Portal project that contains a single HMI device, a single S7-1500 (or S7-1200) PLC, and a single PROFINET or MPI/TCP connection between them. The crash is independent of:

• Number of HMI tags (0 to 4096 tested).
• Presence or absence of an S7-PLCSIM instance.
• IM folder deletion (\<project\>\IM) — does not resolve the fault.
• Project-wide rebuild.

Switching the HMI device from a KTP400 Basic / KTP700 Basic / KTP1200 Basic image to a TP700 Comfort / TP900 Comfort / TP1200 Comfort image eliminates the crash, which is the most reliable indicator that the failure is bound to the Basic Panel RT image used by the integrated simulator and not to the connection itself.

2. Affected and Non-Affected Software Matrix

Because the same Windows 7 SP1 64-bit image hosts V14, V15.1, and V16 side-by-side, the regression is isolated to a change in the WinCC Advanced RT Basic image shipped with V15.1 and carried into V16. It is not a Windows or DCOM regression.

3. Root Cause Analysis

3.1 Why the crash only appears with a configured connection

When the HMI connection resource is set to "disconnected" (no partner PLC), the WinCC RT simulator starts a minimal bootstrap that never opens the integrated connection layer. As soon as a connection with a valid partner IP/PLC type is set, the RT image enumerates the partner interface, opens the S7 communication channel, and registers the tag provider. The crash occurs in this registration path. Removing the IM folder does not change this, because the IM folder only contains compile-output intermediates — the crash is in the loaded RT image, not the build artefacts.

3.2 Why Basic Panels crash and Comfort Panels do not

Basic Panels (KTP/TP Basic) and Comfort Panels (TP Comfort / Mobile Panels) are loaded as different RT images in WinCC Advanced. The Basic RT image is the smaller of the two and uses a connection-stack initialisation that has changed between V14 and V15.1. The Comfort RT image uses a different initialisation path that was preserved across versions. The empirical result — Basic crashes, Comfort does not — is therefore a binary pointer to the Basic RT image as the failing component.

3.3 Why TIA V14 on the same host still works

The shared installation of V14, V15.1, and V16 on a single Windows 7 image is a known supportability risk. Siemens guidance is that only one TIA Portal major version should be installed on a given engineering workstation. The fact that V14 still works is therefore not a counter-example to the regression theory; V14 is using its own (unaffected) RT binary, while V15.1 and V16 load the same (regressed) Basic RT binary.

4. Pre-Diagnosis: Confirm the Failure Mode

Before applying a workaround, confirm the failure with the following sequence. It distinguishes the Basic-RT connection crash from unrelated faults (PC name length, DCOM, firewall, broken project).

1. Open TIA Portal V15.1 and create a new project.
2. Add an S7-1500 CPU (any firmware V2.x is sufficient).
3. Add a Basic Panel — start with the smallest available (KTP400 Basic, 6AV2 123-2DB03-0AX0, image 15.1.0.0).
4. Drag an HMI connection from the HMI to the PLC, leave defaults.
5. Compile the HMI (no errors expected).
6. Start "Start RT" (WinCC Runtime Simulator). Observe the process exit.
7. Replace the Basic Panel with a TP700 Comfort and repeat. The RT must start cleanly.
8. Delete the HMI connection (set partner to "not connected") and repeat. The RT must start cleanly on the Basic Panel.

Steps 6, 7, and 8 form the diagnostic triangle. If 6 fails, 7 succeeds, and 8 succeeds, you have the failure mode described in this article. Any other combination (e.g. 6 fails, 7 also fails) indicates a different fault — usually DCOM, MSMQ, or a corrupted installation — and should be addressed through the TIA Portal installation repair path before applying the workarounds below.

5. Workaround 1 — Use a Comfort Panel Image in the Simulator

This is the fastest path to unblock development. The simulator is launched against an HMI image, not against the physical target, so a Comfort image can stand in for a Basic Panel during offline commissioning.

1. In the project tree, add a TP700 Comfort (6AV2 124-1GC01-0AX0) or TP900 Comfort.
2. Copy the screen set, tags, and alarms from the Basic Panel to the Comfort Panel.
3. Verify the connection is bound to the same PLC.
4. Compile and start the RT simulator against the Comfort Panel image.
5. Continue offline testing, including tag forcing via PLCSIM.

Trade-off: the Comfort image has a different screen resolution, different number of soft keys, and a different runtime palette. Screens will look different from the production target. Tag logic, alarm flow, scripts, and recipes are not affected. Treat this as a development-only substitute; the production image is still built from the original Basic Panel.

6. Workaround 2 — Isolate the TIA Installation in a Virtual Machine

This is the engineering-station-grade fix. It removes the multi-version interference and gives a clean, supported configuration per VM.

1. Provision a virtual machine on VMware Workstation 15.x, Hyper-V 10.0, or VirtualBox 6.x. Allocate:
   • 4 vCPU minimum, 8 vCPU recommended for V15.1/V16.
   • 16 GB RAM minimum, 24 GB recommended if PLCSIM is co-resident.
   • 120 GB dynamic VHDX, 80 GB used after TIA + updates.
   • Windows 10 LTSC 2019 64-bit (recommended) or Windows 7 SP1 64-bit (legacy compatibility).
2. Apply the Windows prerequisites:
   • Windows 7 SP1: install KB3033929 (SHA-2 code signing support) — required to install TIA V15.1 and V16.
   • Install .NET Framework 3.5 SP1 and 4.7.2.
   • Install WinPcap 4.1.3 for PROFINET simulation (download from winpcap.org, signed by CACE Technologies).
   • Disable UAC or set the engineering account to admin equivalent.
3. Install a single TIA Portal major version per VM. Do not co-install V14 and V15.1 in the same VM.
4. Install WinCC Advanced from the same media as TIA Portal.
5. Apply the latest available update (e.g. TIA V16 Update 5 or later when validating against this fault).
6. Enable .NET optimisation: run "ngen executeQueuedItems" as Administrator once after the first TIA launch.
7. Snapshot the VM clean; this becomes the engineering baseline.

With TIA V15.1 or V16 in a clean VM and no other TIA versions present, the Basic Panel simulator with an active PLC connection has been confirmed to start. The clean install removes the side-by-side contamination that is part of the trigger condition.

7. Workaround 3 — Clean the Multi-Version Installation

If a virtual machine is not available, the engineering workstation must be rebuilt for a single TIA version. The sequence is destructive to the existing TIA configuration.

1. Capture the project archive (\*.ap15 / \*.ap16) to a network share.
2. Capture any custom libraries, faceplates, scripts, and HMI styles to the network share.
3. Open Windows "Apps & Features" (or "Programs and Features" on Windows 7).
4. Uninstall in this order: TIA V16 → TIA V15.1 → TIA V14.
5. Uninstall the corresponding WinCC Runtime Professional / Advanced components.
6. Uninstall the SIMATIC S7-PLCSIM instances.
7. Delete residual directories: C:\Program Files\Siemens\Automation and %LOCALAPPDATA%\Siemens.
8. Reboot. Confirm sc query WinCCRTAdvanced returns "not found" (or the V15.1 equivalent WinCCRTAdv_V15_1).
9. Reinstall a single TIA version, apply all updates, and import the project.

8. Crash Log and Diagnostic Capture

Submitting crash data to Siemens support materially shortens the service request. Capture the following artefacts before opening a request.

If the "Faulting module name" in Event Viewer is HMIRTE.exe with a stack referencing S7ONLINE or SimaticNet, the failure is in the same path described in Section 3.

9. Compatibility Verification with the Siemens Compatibility Tool

Before changing versions, validate the entire toolchain (HMI image, PLC firmware, TIA Portal, WinCC version) using the official Siemens Compatibility Tool. The tool enumerates the released combinations and flags mismatches that can mask themselves as simulator crashes.

1. Open the Compatibility Tool at Siemens Support entry 64847781.
2. Select "TIA Portal" as the product group.
3. Filter on "WinCC Advanced" and the specific update level (V15.1 Update 4, V16 Update 1, etc.).
4. Add the S7-1500 CPU order number and firmware version used in the project.
5. Add the Basic Panel order number and image version used in the project.
6. Confirm the green checkmark appears. A red cross indicates a combination that is not released and must be corrected before any further diagnosis.

10. Windows 7 64-bit Specific Considerations

The reported environment is Windows 7 64-bit. TIA Portal V15.1 and V16 are technically installable on Windows 7 SP1 (64-bit) but only with the prerequisites below. Missing prerequisites produce different failures (setup-time failure, missing DLL, .NET runtime error), but they are worth ruling out.

For new installations, Siemens recommends Windows 10 LTSC 2019 (64-bit) as the supported engineering-station operating system for TIA V15.1 and V16.

11. Opening a Siemens Service Request

Because the failure reproduces on a released combination and survives an IM-folder deletion, the next step is a formal service request so Siemens can attach the crash to a known issue or open a new one.

1. Sign in to Siemens Industry Online Support with a customer account.
2. Navigate to "Support Request" → "Create new request".
3. Product tree: SIMATIC > TIA Portal > WinCC > Engineering > WinCC Advanced.
4. Version: enter the exact TIA Portal build (e.g. V15.1 Update 4 build number visible in "Help → About").
5. Attach the project archive (.ap15_1 or .ap16), the RT log folder, the Windows Event Viewer export, and the DMP file from Section 8.
6. Description: "WinCC RT Simulator for HMI Basic Panel crashes on launch when an HMI-to-PLC connection is configured. Comfort Panel image launches successfully. Same project runs in TIA V14 SP1 Update 9."
7. Submit. The first response is typically a request for additional logs; reply with the artefacts already captured.

Reference the article number assigned by Siemens in any future correspondence and in your change log.

12. Preventive Best Practices

• One TIA Portal major version per engineering station. Use VMs for parallel versions; do not co-install V14 + V15.x + V16.
• One OS per VM. Windows 10 LTSC 2019 is the supported TIA V15.x / V16 target; reserve Windows 7 64-bit for legacy V14 work.
• Capture the build number on every project commit. Use TIA Portal "Project → Properties → Project information" and add it to the .ap archive file name.
• Test offline simulator behaviour at the start of every project. Add a project-bootstrap step that starts the RT simulator against an empty screen and against a single-tag connection. This is a 60-second smoke test that catches regressions before the first screen is built.
• Keep TIA Portal updates applied. V15.1 Update 4 → later updates; V16 Update 1 → later updates. Each update contains a roll-up of WinCC RT fixes.
• Subscribe to Siemens Product Notifications for TIA Portal and WinCC Advanced to receive advance notice of fixes and known issues.

13. Troubleshooting Matrix

14. Acceptance Test After Applying a Workaround

1. Open the project in the corrected environment (clean VM or single-version install).
2. Compile the HMI, expect 0 errors.
3. Start the RT Simulator against the Basic Panel image used in production.
4. Confirm the RT main window appears within 15 seconds and remains stable for at least 10 minutes.
5. Start S7-PLCSIM and load the PLC program.
6. Toggle a tag from PLCSIM and verify the value updates on the HMI screen.
7. Force an alarm from PLCSIM and verify the HMI alarm view shows it.
8. Stop the RT Simulator, then close the project cleanly.

If steps 3, 4, 6, and 7 pass, the workaround is functional. The remaining risk is project-specific (faceplates, scripts, custom controls) and must be covered by the project's own FAT.

15. Summary

The crash of the WinCC TIA V15.1 / V16 Runtime Simulator when a Basic Panel HMI is connected to a PLC is a regression in the Basic RT image bundled with those versions. The Comfort Panel RT image is unaffected. The two fastest production-safe workarounds are (a) running offline tests against a Comfort Panel image, and (b) moving TIA V15.1 / V16 to a clean virtual machine with no co-installed TIA versions. The definitive resolution path is a Siemens service request with the crash artefacts listed in Section 8, which will result in either a hotfix or an updated point release.

FAQ