Simulate S7-1200 HMI in TIA Portal: PLCSIM and WinCC Runtime

1. Overview

Commissioning an S7-1200 CPU 1214 DC/DC/DC without a physical HMI panel (such as a KTP1000 Basic) is a common requirement during project development, factory acceptance tests (FAT), and engineer training. The legacy environment of WinCC Flexible 2008 and the modern TIA Portal (WinCC engineering in the TIA Portal, starting with V11) treat "simulation" differently, which has historically confused engineers migrating from one toolchain to the other. This guide clarifies the architectural difference, shows how to operate an S7-1200 panel project in PC-based Runtime, and walks through PLCSIM integration and the integrated Tag Simulator.

The end state described in this document is a configuration PC running WinCC Runtime that communicates to either a real S7-1200 CPU or to S7-PLCSIM, with a Tag Simulator available to force I/O without manual wiring. The same workflow applies to the KTP1000 Basic, KTP400 Basic, TP1500 Basic, and the Comfort Panel families supported by WinCC in the TIA Portal.

2. Prerequisites

The S7-PLCSIM version must match the TIA Portal version. PLCSIM V13 SP1 and later expose S7-1200 CPUs; earlier PLCSIM versions (V11, V12) only support S7-300/S7-400. Confirm your license covers S7-PLCSIM for the S7-1200 if you intend to use the S7-1200/1500 target. Detailed version compatibility is documented in the Siemens Online Support article S7-PLCSIM V18 - Function Overview.

3. S7-1200 CPU 1214 DC/DC/DC: Hardware Reference

The CPU 1214 DC/DC/DC ships in two main variants relevant for simulation work:

• 6ES7214-1AG40-0XB0 – DC/DC/DC, 14 digital inputs (24 V DC), 10 digital outputs (24 V DC, 0.5 A transistor), 2 analog inputs (0–10 V), work memory 100 KB code / 4 MB data, firmware V4.x. The most common variant in service today.
• 6ES7214-1AE30-0XB0 – DC/DC/DC, firmware V1.x/V2.x, 75 KB work memory, legacy variant with limited PLCSIM and TIA Portal coverage beyond V13.

Both units expose a single PROFINET interface (X1) with one port. The IP default is 192.168.0.1, subnet mask 255.255.255.0, no router. CPU-to-CPU or PC-to-CPU communication is pure TCP/IP on port 102 (ISO-on-TCP / RFC1006). For the S7-1200, the integrated Ethernet port is the only programming and HMI interface; there is no MPI/DP on the 1214 DC/DC/DC. The full pinout and terminal diagram is in the S7-1200 Programmable Controller System Manual.

For simulation work, you do not need to wire any field I/O. The digital and analog I/O is exercised through the Tag Simulator or through the S7-PLCSIM I/O forcing interface.

4. WinCC Flexible 2008 vs TIA Portal: Simulation Semantics

Engineers familiar with WinCC Flexible 2008 expect a single "Simulate" button (the eyeglass icon in the toolbar) to launch a Runtime that is decoupled from the real PLC and uses a built-in tag engine. In TIA Portal the semantic is split:

Operationally the workflow is: select the HMI in the project tree, then choose Online > Simulation > Start for connected simulation, or Online > Simulation > Start with tag simulator for the offline-with-forcing mode. The TIA Portal equivalents are documented in the WinCC Engineering in TIA Portal - Simulation Manual.

5. S7-PLCSIM Configuration for S7-1200

S7-PLCSIM (V13 SP1 onward) emulates an S7-1200 CPU as a SoftPLC on the engineering PC. It listens on TCP port 102 like a real CPU and accepts the S7 communication used by WinCC Runtime and STEP 7.

1. Open the S7-1200 project in TIA Portal.
2. From the project tree, right-click the S7-1200 device and choose Start simulation. TIA Portal launches S7-PLCSIM (the "SIMATIC S7-PLCSIM" window opens with a soft front panel).
3. PLCSIM picks the next free IP in the 192.168.0.x range by default. To fix the address, open the PLCSIM soft front panel, click the Ethernet slot, and set IP = 192.168.0.1, mask = 255.255.255.0, gateway = 192.168.0.10. Match the project device configuration.
4. Download the STEP 7 program to PLCSIM. The S7-1200 program is loaded into the simulated work memory; the LED indicators on the soft front panel turn green when RUN is active.
5. Confirm the program is executing: open the soft front panel, switch to RUN/RUN-P, and verify the RUN LED is steady green. The MAINT/ERROR LED should be off.

If the download fails with error ERROR: Online: The connection to the target system could not be established, check that no other S7-PLCSIM instance is running, that the Windows firewall allows TCP/102 inbound, and that no real S7-1200 is bound to the same IP on the engineering NIC. The Siemens Knowledge Base PLCSIM S7-1200 connection troubleshooting collects the most common remedies.

6. Configuring the HMI Connection in the TIA Project

The HMI must reference the S7-1200 (or PLCSIM instance) through an HMI connection. The default HMI connection type for a SIMATIC S7-1200 panel is S7ONLINE (ISO-on-TCP) on port 102.

For the KTP1000 Basic, the connection is configured in the device configuration: Devices & Networks > HMI_1 [KTP1000 Basic] > Connections > S7ONLINE_1. Double-click the connection row, set the partner (PLC) IP, and verify the rack/slot pair is 0/1. If the KTP1000 is replaced by a PC-based Runtime target, the connection remains identical – the Runtime simulator on the PC uses the same HMI connection block.

7. PC-Based Runtime Targets (Replacing the KTP1000)

When no physical KTP1000 is available, you run the HMI image on the PC. TIA Portal exposes the following PC-based Runtime targets:

Add a new HMI device in the project, choose PC systems > WinCC Runtime Advanced > RT 1024 (example), copy the screens from the KTP1000 project, recompile, and load the compiled HMI image to the PC Runtime directory. The HMI connection remains pointed at the S7-1200 (or PLCSIM) on 192.168.0.1.

8. Tag Simulator Usage

The Tag Simulator is a forcing tool that lets you drive tags without a live PLC, without wiring, and without PLCSIM. It is the closest TIA Portal equivalent to WinCC Flexible 2008's offline simulation engine.

1. Open the HMI project in TIA Portal.
2. Select the HMI device in the project tree.
3. Choose Online > Simulation > Start with tag simulator.
4. The HMI Runtime launches in a window. The Tag Simulator pane appears next to it, listing every tag, its current value, quality code, and last update timestamp.
5. To force a Boolean: double-click the value cell, type 1 or 0, press Enter. The HMI screen responds within one polling cycle (default 1 s).
6. To force an integer with a sine function: right-click the tag, choose Generate function, and select sine, ramp, random, or step. Set amplitude and period.
7. To record: right-click the tag, choose Record. The Tag Simulator writes a CSV log to %USERPROFILE%\AppData\Local\Siemens\Automation\WinCCRT\TagSimulator\log.

The Tag Simulator writes directly to the HMI's internal tag image. It does not require the PLC to be online. However, if the HMI connection to a real PLC is active and the PLC is also writing the same tag, the PLC value overrides the simulator value at the next acquisition cycle. Disable the connection (right-click the connection row, set Active = no) for pure offline forcing.

9. Step-by-Step: End-to-End Simulation with PLCSIM and WinCC Runtime

1. Build the project. Configure the S7-1200 program (ladder, FBD, or SCL), the HMI screens, and the HMI connection. Save and compile both devices (Project tree > right-click device > Compile > Hardware and software (rebuild all)).
2. Start PLCSIM. Right-click the S7-1200 in the project tree and choose Start simulation. Wait for the PLCSIM soft front panel to open.
3. Download the S7 program to PLCSIM. Click Download to device in the toolbar. Select the PLCSIM interface, confirm target = PLCSIM, and click Load. Finish by clicking Start module in the next dialog. The PLCSIM soft front panel shows RUN.
4. Add a PC Runtime target. In the project tree, double-click Add new device > PC systems > WinCC Runtime Advanced > RT 1024. Copy the screens from the KTP1000 device into the PC Runtime device by drag-and-drop. Re-bind the HMI connection to point at the S7-1200 PLCSIM instance (rack 0, slot 1, IP 192.168.0.1).
5. Compile the PC Runtime project. Right-click the PC Runtime device, choose Compile > Software (rebuild all). TIA Portal emits a *.fwx runtime file.
6. Start PC Runtime with tag simulator. Right-click the PC Runtime device, choose Online > Simulation > Start with tag simulator. The Runtime window opens, the Tag Simulator pane opens, and the HMI connects to PLCSIM over Ethernet loopback.
7. Verify the connection. On the HMI, navigate to a screen that displays a tag from the PLC. The tag should show a current value. Open the connection diagnostics (touch the status indicator on the HMI status bar) – the connection state should be Connected, quality code Good.
8. Force a tag from the Tag Simulator. Locate a Boolean output tag (e.g., "Motor_Start"). Set it to 1. The HMI screen should update within 1 s, and the corresponding input in PLCSIM's I/O view should change to 1.
9. Run for 10 minutes under load. Cycle through all screens, force every tag at least once, confirm no Runtime exception dialog appears, and confirm no memory leak in Task Manager (Runtime process should stay under 250 MB working set for a small project).
10. Save the project archive. Project > Archive > Save as. TIA Portal writes a *.zap archive. Store this alongside the FAT report.

10. Verification Checklist

11. Troubleshooting Matrix

12. Field-Engineer Cautions

• License sizing. PC Runtime licenses are sized in power tags. The KTP1000 Basic panel itself does not require a Runtime license – it is a hardware device. If you replicate the KTP1000 image on a PC, you must license the PC Runtime with at least RT128 even if the project only uses 16 tags.
• Time synchronization. PLCSIM and the HMI Runtime share the PC system clock. The S7-1200 in PLCSIM is also synchronized. If you simulate a midnight rollover (e.g., shift counter reset at 00:00), confirm that all three clocks agree, or use a single Time-of-Day tag from the CPU to drive the HMI clock.
• Retentive behavior. PLCSIM persists retentive tags across simulation restarts. To force a clean state, close PLCSIM, delete the *.s7p working file from %USERPROFILE%\AppData\Roaming\Siemens\Automation\PLCSIM, and restart.
• Firewall on Windows 10/11. The first PLCSIM start may require explicit firewall approval for S7-PLCSIM.exe on port 102. Click Allow access on the prompt, or pre-create an inbound rule for TCP/102 restricted to the engineering subnet.
• Real CPU coexistence. If a physical CPU 1214 is connected to the same PC and shares the 192.168.0.1 IP, PLCSIM and the real CPU will collide. Either disconnect the CPU from the network, change the real CPU's IP to 192.168.0.2, or set PLCSIM to a different subnet (e.g., 192.168.1.1) and update the HMI connection.
• KTP1000 specific. The KTP1000 Basic supports 800 x 480 px and a 10.1 in display. If the PC Runtime screen resolution differs, scale the screen size in the HMI device properties to 800 x 480 before compiling to avoid touch-target misalignment when you later deploy back to the physical panel.

13. FAQ