S7-1200 PLCSIM to Vijeo Designer: Modbus TCP Simulation Setup

Overview: Simulating S7-1200 Communication with Vijeo Designer

Simulating a complete S7-1200 to Schneider HMI link before commissioning prevents runtime surprises on the shop floor. The most common question is whether S7-PLCSIM V14 can act as a peer for Vijeo Designer V6.2 over the same protocols used with physical hardware. Native S7 communication between PLCSIM and Vijeo Designer is constrained because PLCSIM does not expose the standard S7 server endpoints to external HMI clients in the same way the CPU 1214C firmware does. However, a fully functional simulation can be built using Modbus TCP, which both platforms implement natively and which PLCSIM V14 supports through the MB_SERVER instruction block.

This guide delivers a hardware-free setup: a TIA Portal V14 project with a CPU 1214C simulated in PLCSIM, an MB_SERVER Modbus TCP server instance, and a Vijeo Designer V6.2 project configured as a Modbus TCP client pointing at the loopback address. The same procedure works with TIA Portal V15, V16, and V17 where PLCSIM continues to support the Modbus TCP instruction block. The procedure is also fully compatible with the Magelis GTO, GTU, and STU HMI panels that Vijeo Designer V6.2 targets.

Prerequisites and Software Stack

Why Direct S7 Communication Does Not Work in PLCSIM

Vijeo Designer V6.2 ships with two drivers relevant to Siemens hardware:

• Siemens S7 Ethernet (ISO-on-TCP / TCP) – targets the S7 server running on a physical CPU.
• Modbus TCP/IP Master – generic Modbus TCP client.

The S7 driver in Vijeo Designer establishes a connection to the CPU on TCP/102 using the S7Comm protocol. PLCSIM V14 implements only a subset of the S7 server surface, optimised for engineering tools (STEP 7, WinCC) running on the same PC. External HMI clients cannot reliably handshake with the simulated S7 server, and there is no documented configuration that opens TCP/102 to off-host clients. Schneider Electric's own technical support has documented this behaviour for firmware combinations above V4.6 as well, where the Vijeo Designer Basic 1.3 driver set requires specific TCP keep-alive parameters that PLCSIM does not accept (Schneider Electric Community: S7-1200 FW 4.7 communication issue).

Modbus TCP, by contrast, uses standard TCP/502 socket semantics. PLCSIM V14 implements the MB_SERVER instruction as a fully functional Modbus server that accepts connections from any local process, including Vijeo Designer. The exchange uses the same memory layout (DB or bit memory) that a real CPU would expose, so the HMI application behaves identically in simulation and on real hardware. Schneider HMIs natively support Modbus TCP because it is the protocol used across most non-Siemens PLC lines, which makes it the de-facto interoperability layer.

Architecture: Modbus TCP Bridge Between PLCSIM and Vijeo Designer

The loopback architecture keeps every component on the engineering PC. PLCSIM binds the simulated PROFINET interface to a Softnet adapter that exposes IP 127.0.0.1 (or the host IP assigned during PLCSIM start-up). Vijeo Designer on the same PC opens a TCP socket to 127.0.0.1:502, which PLCSIM receives through its Softnet stack and forwards to the MB_SERVER instance running inside the simulated CPU 1214C.

Configuring the Modbus TCP Server in TIA Portal V14

Step 1: Create the project and add the CPU

1. Open TIA Portal V14 and create a new project.
2. Add a new device: Controllers → SIMATIC S7-1200 → CPU → CPU 1214C DC/DC/DC → 6ES7214-1AG40-0XB0 → V14.0.
3. In the device configuration, set the PROFINET interface IP address to 192.168.0.10 with subnet mask 255.255.255.0.
4. Disable Optimised Block Access on the data block that will hold Modbus data. The MB_SERVER instruction accesses the holding register DB only via absolute byte offsets; optimised access hides the offset and the instruction returns STATUS = 0x80C8.

Step 2: Create the Modbus data DB

1. Add a new global DB named Modbus_Data.
2. Disable Optimised block access in the DB properties.
3. Define the structure below.

DATA_BLOCK "Modbus_Data"
  { S7_Optimize_Access := 'FALSE' }
  STRUCT
    Holding   : ARRAY[0..99] OF WORD;   // 100 holding registers (FC 03/06/16/23)
    Coils     : ARRAY[0..99] OF BOOL;   // 100 coils          (FC 01/05/15)
    Inputs    : ARRAY[0..99] OF BOOL;   // 100 discrete inputs (FC 02)
    RegIn     : ARRAY[0..99] OF WORD;   // 100 input registers (FC 04)
  END_STRUCT;
END_DATA_BLOCK

Step 3: Insert the MB_SERVER instruction

Add the MB_SERVER call in OB1 ("Main") using SCL:

// SCL – OB1 cycle call
"MB_SERVER_DB"(
  DISCONNECT := FALSE,                    // keep TCP session open
  IP_PORT     := 502,                     // standard Modbus TCP port
  MB_HOLD_REG := "Modbus_Data".Holding,   // pointer to holding register area
  CONNECT     := TRUE,                    // passive server, accept all
  NDR         => "statNDR",              // new data received
  DR          => "statDR",               // data read by client
  ERROR       => "statErr",              // error flag
  STATUS      => "statStatus"            // extended status word
);

The background instance DB MB_SERVER_DB is generated automatically by TIA Portal when you drag the instruction into the editor. No further parameterisation is required.

Configuring Vijeo Designer V6.2 as Modbus TCP Client

Step 1: Create the project and add the driver

1. Open Vijeo Designer V6.2 and create a new project targeting your Magelis panel (for example HMIGTO2310 or HMIGTU735).
2. In the Project Browser, right-click IO Manager → Equipment and add Modbus TCP/IP Master from the Schneider driver list.
3. Set the equipment IP address to 127.0.0.1 (PLCSIM loopback) and the port to 502.
4. Set the connection timeout to 3000 ms and the polling period to 500 ms for development; tune later on real hardware.

Step 2: Declare variables

Vijeo Designer uses the standard Modicon addressing convention (4xxxx for holding registers, 0xxxx for coils, 1xxxx for discrete inputs, 3xxxx for input registers). The driver subtracts 1 internally, so address 40001 corresponds to register 0.

Step-by-Step Simulation Procedure

1. Compile and download the TIA project to PLCSIM. In TIA Portal V14, click Start → Compile → Download to device → PLCSIM. PLCSIM V14 launches and loads the simulated CPU 1214C.
2. Verify MB_SERVER is running. In PLCSIM, open the project tree and add a watch table for the status tags: statNDR, statDR, statErr, statStatus. Force TRUE on CONNECT if needed.
3. Start PLCSIM RUN mode. Click the green Run button. The CPU enters RUN and OB1 starts executing MB_SERVER.
4. Confirm the TCP/502 listener. Open a command prompt and run netstat -ano | findstr :502. The output should show 0.0.0.0:502 or 127.0.0.1:502 in LISTENING state, bound to a PID owned by PLCSIM.
5. Open Vijeo Designer V6.2 and download the HMI project. Use Build → Download to deploy to the simulated runtime. The Vijeo Designer simulator and PLCSIM share the same PC, so no network switches are required.
6. Test the link. Click a button on the Vijeo Designer screen bound to CO_MotorOn. The MB_SERVER instance receives an FC 05 write, sets Modbus_Data.Coils[0] in the simulated DB, and the new value appears in the HMI feedback indicator within the next poll cycle (default 500 ms).
7. Trigger diagnostic logging. In Vijeo Designer, enable Diagnostics → Modbus TCP/IP Master → Trace to record all requests and responses. Save the trace for the commissioning report.

Verification and Diagnostics

After completing the procedure, perform the following verification checks before declaring the simulation acceptable for development:

• Watch table check: All four MB_SERVER status tags (statNDR, statDR, statErr, statStatus) read zero in steady state when no client is connected.
• Vijeo Designer diagnostic panel: The IO Manager indicator turns green and shows the active connection.
• Round-trip test: Write a value of 1234 to HR_SpeedSet from Vijeo Designer; observe Modbus_Data.Holding[1] = 16#04D2 in PLCSIM within one second.
• Sustained poll test: Leave the simulation running for 30 minutes. No statErr events should occur unless the Vijeo Designer runtime was deliberately stopped.

MB_SERVER Status Code Reference

Troubleshooting Matrix

Alternative Workarounds

If the Modbus TCP bridge does not fit the application—for example because the HMI panel only ships with the Siemens S7 Ethernet driver and cannot be reconfigured—consider the following alternatives:

• S7 routing through WinCC RT on the same PC: Run WinCC RT Professional and have it poll the simulated CPU on behalf of Vijeo Designer. This requires an OPC bridge, which is rarely worth the configuration cost.
• Use a Modbus TCP to S7 gateway: Devices such as the HMS Anybus X-gateway can sit on the network and translate Modbus TCP from Vijeo Designer into S7Comm to the physical CPU. For simulation, the same gateway can be placed between PLCSIM (running on the engineering PC) and Vijeo Designer on the same PC using two Softnet adapters.
• Run the HMI application on a real Magelis panel connected to PLCSIM through a hardware bridge: This is the closest equivalent to commissioning and is recommended for the final acceptance test.

Migrating the Project from Simulation to Real Hardware

Once the simulation behaves as expected, migrate to real hardware with the following sequence:

1. Change the Vijeo Designer driver IP address from 127.0.0.1 to the physical CPU 1214C IP (192.168.0.10 in this example).
2. Download the same TIA Portal project to the real CPU 1214C using Online → Download to device.
3. Connect the Magelis panel to the same physical switch as the CPU.
4. Verify the same watch table values now reflect real I/O instead of simulated values.

No changes are required to the SCL code or the Vijeo Designer variable list; the Modbus TCP interface is identical on the physical CPU because the MB_SERVER instruction is firmware-resident.

References and Supporting Documentation

• Siemens TIA Portal V20 S7-1200 manual collection – HMI-to-PLC communication
• Siemens Support: S7-1200 Modbus TCP communication (entry 63481236)
• Siemens Support: MB_SERVER instruction manual (entry 109741637)
• Schneider Electric Community – Communication issue between S7-1200 FW 4.7 and Vijeo Designer Basic
• SiePortal forum – Communication between S7-1200 and a Schneider HMI

Frequently Asked Questions