S7 PLCSIM CPU-to-CPU Communication: NetPro Setup Guide

Overview: Simulating S7 Communication Between Two Virtual CPUs

S7-PLCSIM is the Siemens virtual controller runtime that allows STEP 7 (V5.x) and TIA Portal programs to be executed against a simulated S7-300, S7-400, ET 200S, or WinAC CPU instead of physical hardware. A recurring engineering question is whether two separate PLCSIM instances can exchange S7 Communication data without a connection being defined in NetPro (or the TIA Portal "Devices & Networks" editor). The short, field-proven answer is no: every SFB that transports data over an S7 connection — SFB8/9 (USEND/URCV), SFB12/13 (BSEND/BRCV), SFB14/15 (GET/PUT background), and the standard PUT/GET via the S7 connection — requires an explicitly configured connection resource on both participating CPUs. PLCSIM does not bypass this requirement; it only emulates the runtime that the connection points to.

The connection resource can be created in two ways:

• Classic STEP 7 V5.x: NetPro → insert an S7 connection, bind it to the local CPU's CP or MPI/DP/PN interface, and assign the partner.
• TIA Portal (V13+): Project tree → Devices & Networks → Connections → select the two CPUs → choose S7 connection → download the connection configuration to both PLCSIM instances.

Without that connection object, SFB12/13 will return status word W#16#0A (no configured connection) on first execution and W#16#8081 (connection terminated) on subsequent cycles. This article documents the prerequisites, the exact configuration steps, the program-side code for SFB12/13 and PUT/GET, the verification procedure, and the documented limits of S7-PLCSIM and S7-PLCSIM Advanced for multi-instance simulations.

S7 Communication Protocol Blocks and Connection Types

S7 Communication is a Siemens-proprietary application-layer protocol that rides on top of ISO-on-TCP (RFC1006, port 102), ISO transport, or MPI/Profibus depending on the configured connection type. The blocks typically used to move data between two S7 CPUs are summarized in the table below.

All four block families share one common requirement: the calling CPU must have a connection resource of type S7 connection whose local ID is passed to the block's ID input. The local ID is generated by NetPro / TIA Portal at connection compile time and is the only thing the block uses at runtime — it does not resolve the partner IP or rack/slot dynamically. If the connection is missing, the block fails before any TCP socket is opened.

Why a NetPro Connection Configuration Is Mandatory

The NetPro (or TIA Portal) connection configuration performs four functions that cannot be replaced by program code:

1. Local endpoint definition. It binds the connection to a specific interface on the local CPU: e.g. PN-IO interface, IP 192.168.0.10, rack 0 slot 2. Without this, the CPU's communication stack has no route to the partner.
2. Remote endpoint definition. It defines the partner's IP/MPI address and rack/slot, which is downloaded to the connection resource and used to open the TCP/ISO session.
3. TSAP and resource allocation. The S7 Communication handshake exchanges Transport Service Access Points (TSAPs) that identify the partner's application slot. The connection object is the only place these TSAPs are configured.
4. Local connection ID generation. A 16-bit integer is assigned and compiled into the SDB (System Data Block) container. This is the handle that the SFB passes at runtime.

Because PLCSIM emulates the same connection database as a real CPU, attempting to call SFB12/13 with a hard-coded ID, or to bypass the connection via UC calls against a free port, will always produce a resource error. The only documented workaround is to create the connection in NetPro or in TIA Portal and download it to both PLCSIM instances before the program is started.

S7-PLCSIM V5.4+SP3 vs. S7-PLCSIM Advanced

Two generations of the simulator are relevant to multi-CPU communication.

For S7-300/400 programs that already use SFB12/13, S7-PLCSIM V5.4+SP3 is the minimum-supported runtime that allows two independent PLCSIM instances on the same host to open a TCP session against each other. Earlier PLCSIM versions (V5.3 and below) only supported a single instance and could not be used for end-to-end CPU-to-CPU testing.

For S7-1500 work, S7-PLCSIM Advanced replaces the old PLCSIM V14/V15 and is the only path to validate S7 connections between two virtual controllers on the same engineering PC, because the standard PLCSIM bundled with TIA Portal only supports a single instance per session. Refer to the S7-PLCSIM Advanced product page for the current feature matrix and download.

Prerequisites: Hardware, Software, and Licensing

Before any code is written, confirm the following on the engineering workstation.

• Operating system: Windows 10 (64-bit, 1909 or later recommended) or Windows Server 2016/2019. Older Windows 7 hosts work with PLCSIM V5.4+SP3 but are no longer supported for S7-PLCSIM Advanced.
• STEP 7 / TIA Portal: STEP 7 V5.5 SP4 or V5.6 (for the classic path) or TIA Portal V15.1 with the S7-PLCSIM Advanced option package installed.
• PLCSIM V5.4+SP3 (or later SP) installed and licensed — the SP3 is the minimum revision that lifts the single-instance restriction. The license is a floating "S7-PLCSIM V5.4+SP3" key, separate from the STEP 7 license.
• Network adapter: A real or virtual Ethernet adapter (Microsoft Loopback Adapter is acceptable) bound to TCP/IPv4. For two PLCSIM instances on the same host, assign them distinct static IPv4 addresses on the same subnet, e.g. 192.168.0.10 and 192.168.0.11, mask 255.255.255.0.
• Windows firewall: Permit inbound TCP/102 (ISO-on-TCP / S7 Communication) and TCP/2008 (S7-PLCSIM Advanced API) on both addresses.
• User rights: Local administrator for the Loopback Adapter install and firewall rules; standard user rights are sufficient for daily PLCSIM use.

Step-by-Step: Configuring a CPU-to-CPU Connection in NetPro

The following procedure is the documented path for classic STEP 7 V5.x with two S7-300 PLCSIM instances (the same procedure applies for S7-400 and for the TIA Portal Connections editor).

1. Create the project structure

1. Open STEP 7 V5.5/5.6 and create a new project, e.g. PLCSIM_S7Comm_Test.
2. Insert two SIMATIC 300 stations: PLC_1 (CPU 315-2 PN/DP, IP 192.168.0.10) and PLC_2 (CPU 315-2 PN/DP, IP 192.168.0.11).
3. In HW Config, set the PN interface IP and subnet on each CPU. Confirm the MAC address field is filled with a unique locally-administered value.

2. Insert and configure the S7 connection

1. Open NetPro from the project tree (or via Options → NetPro).
2. Select PLC_1 in the station list. From the menu, Insert → New Connection.
3. In the connection dialog, choose partner PLC_2 and type S7 connection. Click OK.
4. In the connection properties:
   • Local ID: 1 (record this — it is the value passed to SFB12/13 and PUT/GET).
   • Partner address: 192.168.0.11, rack 0, slot 2.
   • Connection type: S7 connection (ISO-on-TCP, port 102).
   • Active connection establishment: leave the default (active for PLC_1, passive for PLC_2) unless the program requires the opposite.
5. Save and compile the connection. The connection object now appears in both PLC_1 and PLC_2's connection lists with a mirrored local ID of 1.

3. Download to both PLCSIM instances

1. Start PLCSIM V5.4+SP3; insert an instance for PLC_1 and select PN-IO as the access point.
2. Set PLCSIM to RUN-P and download the system data (SDB) to PLC_1 via PLC → Download → System Data. This loads the connection configuration.
3. Open a second PLCSIM window, insert PLC_2, and download its system data.
4. Verify in PLCSIM CPU → Module Information → Communication that one S7 connection resource is reported as Established on the active partner (PLC_1) within a few seconds of download.

Program Code: SFB12/BSEND, SFB13/BRCV, and PUT/GET

With the connection in place, the program-side blocks are simple. The example below shows a 480-byte DB-to-DB transfer on PLC_1 (sender) and PLC_2 (receiver) using SFB12/13.

PLC_1 — BSEND in OB1 (Structured Text)

//  PLCSIM_S7Comm_Test - PLC_1 BSEND example
//  Local connection ID = 1 (defined in NetPro)
//  Send DB100 (first 480 bytes) to PLC_2, receive into DB200

DATA_BLOCK DB100
  STRUCT
    payload : ARRAY[0..479] OF BYTE;  // 480 bytes, 1 BSEND segment
  END_STRUCT
END_DATA_BLOCK

ORGANIZATION_BLOCK OB1
VAR_TEMP
  info : SFB12_STATUS;  // user-defined UDT
END_VAR
BEGIN
  // Trigger on first scan or on rising edge of StartSend
  IF "StartSend" THEN
    "sendBusy" := TRUE;
    SFB12.DB     := 100;           // source DB number
    SFB12.DBB_NO := 0;             // start byte offset in DB100
    SFB12.LEN    := 480;           // bytes to send (must be even)
    SFB12.ID     := W#16#1;        // local connection ID from NetPro
    SFB12.R_ID   := 16#AA01;       // any 32-bit handshake tag (must match BRCV)
    SFB12.DONE   := FALSE;
    SFB12.ERROR  := FALSE;
    SFB12.STATUS := W#16#0;
  END_IF;

  // Re-call SFB12 every cycle until DONE or ERROR
  SFB12(
    REQ    := "StartSend",
    R      := "ResetSend",
    ID     := W#16#1,
    R_ID   := 16#AA01,
    DONE   => "sendDone",
    ERROR  => "sendError",
    STATUS => "sendStatus",
    DB     := 100,
    DBB_NO := 0,
    LEN    := 480
  );

  IF "sendDone" OR "sendError" THEN
    "StartSend" := FALSE;
  END_IF;
END_ORGANIZATION_BLOCK

PLC_2 — BRCV in OB1 (Structured Text)

//  PLCSIM_S7Comm_Test - PLC_2 BRCV example
//  Mirrored local connection ID = 1 (NetPro, on PLC_2's side)

DATA_BLOCK DB200
  STRUCT
    payload : ARRAY[0..479] OF BYTE;
  END_STRUCT
END_DATA_BLOCK

ORGANIZATION_BLOCK OB1
BEGIN
  SFB13(
    EN_R   := TRUE,                // always ready to receive
    ID     := W#16#1,              // local connection ID (PLC_2's side)
    R_ID   := 16#AA01,             // must match BSEND's R_ID
    RD     := 200,                 // destination DB number
    DB_BNO := 0,                   // destination byte offset in DB200
    NDR    => "recvNewData",
    ERROR  => "recvError",
    STATUS => "recvStatus",
    LEN    => "recvLength",
    DB     := 200,
    DBB_NO := 0
  );
END_ORGANIZATION_BLOCK

PUT/GET equivalent (TIA Portal style)

For one-sided reads/writes, the TIA "PUT" and "GET" instruction blocks replace SFB14/15 and use the same connection handle. A PUT from PLC_1 to PLC_2's DB200 looks like:

// PLC_1 writes 100 bytes from its DB10 to PLC_2's DB200 starting at byte 0
"instPUT"(
  REQ     := "putTrigger",
  ID      := W#16#1,                // local connection ID (NetPro)
  DONE    => "putDone",
  ERROR   => "putError",
  STATUS  => "putStatus",
  ADDR_1  := 'DB200.DBB0 BYTE 100', // remote address (TIA syntax)
  SD_1    := P#DB10.DBX0.0 BYTE 100 // local source
);

Verification, Diagnostics, and Status Word Interpretation

After downloading, run the following verification sequence.

1. Connection status. In PLCSIM, open CPU → Module Information → Communication. The S7 connection must show Established on the active partner within 5–10 seconds. A persistent Not established state points to a missing SDB download or a TSAP mismatch.
2. First data cycle. Force StartSend := TRUE in PLCSIM and monitor sendStatus. A healthy first call returns W#16#0 and W#16#7000 on subsequent calls until the send completes with W#16#0000 + DONE = TRUE.
3. Cross-instance check. On PLC_2, monitor recvNewData. It must toggle to TRUE within one BSEND cycle of the partner's DONE event.
4. Byte-level integrity. Use a watch table on both PLCSIM instances to inspect DB100.payload on PLC_1 and DB200.payload on PLC_2. They must be bit-identical.

The most common SFB12/13 status words in a PLCSIM environment are summarized below.

Limitations: What S7-PLCSIM Cannot Simulate

PLCSIM models a CPU but not the wider automation environment. The following are documented out-of-scope and must be validated on real hardware:

• Web server, SMTP, SNMP, FTP, and HTTP client of the CPU. Not implemented in PLCSIM V5.x; partial coverage in S7-PLCSIM Advanced for S7-1500.
• OPC UA server of an S7-1500. Only S7-PLCSIM Advanced exposes OPC UA; the classic PLCSIM does not.
• PROFIBUS DP master/slave with DP-V2 isochronous mode. Not supported in PLCSIM.
• IRT (Isochronous Real-Time) on PROFINET. S7-PLCSIM Advanced emulates PN IO at best-effort; IRT schedules are not honored.
• Fail-safe CPUs (F-CPU). PLCSIM does not execute the F-runtime; F-programs must be tested on a real or H-system.
• Real-time wall-clock determinism. PLCSIM runs on a non-real-time Windows scheduler; cycle jitter of 1–5 ms is normal. Do not use PLCSIM timing for performance benchmarking.

Troubleshooting Matrix: Common Errors and Fixes

Field-Proven Caveats and Commissioning Notes

When deploying the S7-PLCSIM V5.4+SP3 (or S7-PLCSIM Advanced) CPU-to-CPU test bed on a real engineering bench, the following caveats have been observed in the field.

• Compile the connection in NetPro, not the SFC configuration tool. In STEP 7 V5.5, a connection created in Configure Network (a different entry point) may not be downloaded to the system data of the CPU. Always open NetPro and use Save and Compile (Ctrl+S), then PLC → Download → System Data.
• Local connection IDs are per-CPU. PLC_1 may use ID = 1, and PLC_2's mirrored local ID is also 1, but they are independent handles. The IDs are not shared across the network.
• PN interface must be enabled on both PLCSIM instances. If the CPU is configured with PN but the PLCSIM instance is started with the MPI/DP access point, the S7 connection is unreachable. Verify with PLCSIM → CPU → Module Information → Communication — the connection should be listed as PN-IO.
• One S7 connection per active partner per interface. For a 315-2 PN/DP, the S7-300 connection resource table permits up to 16 S7 connections on the PN interface and 16 on MPI/DP combined. Going over the limit yields STATUS = W#16#8083.
• Re-downloading the SDB resets the connection. If the user re-downloads the program to a running PLCSIM, the S7 connection is torn down and re-established within 2–3 seconds. Any in-flight BSEND/BRCV is aborted with W#16#8081; the calling program must be designed to retry.
• PLCSIM is not deterministic. Cycle time on PLCSIM V5.4+SP3 is 100–300 ms vs. 1–10 ms on a real S7-300. Timeouts set to 100 ms in the partner program will fire prematurely in PLCSIM. Increase timeouts by an order of magnitude when running in simulation.
• Microsoft Loopback Adapter is sufficient for two instances. No physical switch is required; the loopback adapter is bound to TCP/IPv4 with static addresses and the two PLCSIM instances communicate entirely within the host kernel.
• Watchdog OBs (OB30–OB38) do not run in PLCSIM by default. If the SFB12/13 call lives in OB35, ensure PLCSIM is configured with the "Run cyclic OBs" option in PLCSIM → Options → CPU Settings, otherwise the SFB never receives a call and the connection appears idle.

References and Standards to Verify Against

The following official Siemens documents and standards are the authoritative sources for the connection configuration, SFB semantics, and licensing terms referenced in this article. Always confirm against the latest revision in the Siemens Industry Online Support portal.

• S7-PLCSIM Advanced product page (Siemens Global)
• Siemens support entry ID 38726591 — "How do you configure an S7 connection between two S7-PLCSIM instances?" (Siemens Industry Online Support)
• STEP 7 V5.5 / V5.6 Help: Configuring Connections in NetPro and SFB12 BSEND / SFB13 BRCV system block descriptions
• TIA Portal Help: Devices & Networks → Connections → S7 connection and the PUT / GET instruction descriptions
• IEC 61131-3 — Programmable controllers, Part 3: Programming languages (referenced for the OB1 cyclic execution model assumed above)
• IEC 61511 / IEC 62061 — Functional safety lifecycle for process and machinery (referenced for the safety callout)