Simulating Siemens S7-1200 Programs: PLCSIM and SIMIT Guide

1. Virtual Commissioning for the Siemens S7-1200 — Architecture Overview

Virtual commissioning (VC) replaces physical hardware-in-the-loop (HIL) testing with software-in-the-loop (SIL) emulation. For an S7-1200 controlling a light crane, overhead conveyor, or transfer car, VC lets the controls engineer validate ladder, FBD, SCL, and GRAPH logic before the steelwork is erected, the cable trays are pulled, and the safety hardware is type-certified. Reported reductions in on-site commissioning time for crane builders range from 35% to 65% when a mature VC loop is in place; reported reductions in I/O rework range from 40% to 80%.

The minimum viable rig has four blocks:

1. Program development environment — TIA Portal with STEP 7 Basic (V17 minimum, V18/V19 recommended for second-generation S7-1200 G2 CPUs).
2. S7-1200 virtual CPU — S7-PLCSIM (bundled with TIA Portal) or S7-PLCSIM Advanced (separate install, multi-instance, supports Softbus and external OPC UA).
3. Plant/mechanical simulator — SIMIT (Siemens-native), Visual Components (3D focus), or WinMOD (real-time line emulation).
4. Coupling interface — OPC UA, PROFINET, S7Comm/ISO-on-TCP, or Modbus/TCP.

The remainder of this reference walks each block, the supported protocol stacks, and a step-by-step commissioning procedure that ties TIA Portal to Visual Components via OPC UA.

2. S7-1200 Hardware Targets and Simulator Selection Matrix

Choose a simulator based on the CPU firmware generation, the program language mix, the number of simultaneous instances required, and whether PROFINET device emulation is needed. The most common S7-1200 article numbers you will see in this rig are:

• 6ES7211-1AE40-0XB0 — CPU 1211C DC/DC/DC.
• 6ES7214-1AG40-0XB0 — CPU 1214C DC/DC/DC.
• 6ES7215-1AG40-0XB0 — CPU 1215C DC/DC/DC.
• 6ES7217-1AG40-0XB0 — CPU 1217C DC/DC/DC.
• Second-generation S7-1200 G2 CPUs use article numbers beginning 6ES721x-1xx with firmware V5.0 and require TIA Portal V18 or newer.

3. S7-PLCSIM — The TIA Portal Built-in Simulator

S7-PLCSIM is delivered with every licensed STEP 7 Basic / Professional installation and provides a single virtual instance of an S7-1200 or S7-1500 CPU that runs locally on the engineering workstation. It executes the same machine code that will run on the physical PLC, so program behaviour is functionally identical for non-safety code. The S7-PLCSIM manual entry is on Siemens Industry Online Support.

Capabilities

• Full execution of LAD/FBD/SCL/GRAPH blocks compiled for the target CPU.
• Tag monitoring and forcing from the TIA Portal Online & Diagnostics view.
• Breakpoint and single-step execution (introduced in V16).
• Time scaling (0.1×–10×) for accelerated testing of long-cycle processes.
• Integrated web server of the virtual CPU (accessible at http://<PLCSIM-IP>).
• OPC UA server (TIA V17+) — publishes configured DB tags automatically.

Limitations to Plan Around

• Single instance — only one PLCSIM can run on a workstation. For multi-CPU scenarios (master/slave crane pairs, conveyor line segments) you must move to PLCSIM Advanced or use multiple VMs.
• No real PROFINET device emulation — only the OPC UA, S7Comm, and Modbus/TCP server sides are exposed.
• No safety (F-CPU) program simulation — F-blocks are skipped; safety logic must be validated on hardware.
• No PROFIBUS DP master/slave — the S7-1200 DP variant is unsupported in the simulator.

4. S7-PLCSIM Advanced — External Instance for S7-1200

S7-PLCSIM Advanced is the Siemens product for engineers who need more than one virtual CPU on a single host, who need an OPC UA server that is reachable from external clients (Visual Components, WinMOD, or custom .NET apps), or who need a shared Softbus so multiple PLCSIM instances communicate as if wired to the same backplane. The product page and release notes are on Siemens Industry Online Support.

Installation Path

1. Download the PLCSIM Advanced installer from Siemens Industry Online Support. The release notes (search the entry ID for the latest V6.x release) list the supported TIA Portal versions and CPU firmware levels.
2. Install with administrator rights. The service S7-PLCSIM Advanced VirtualEth registers a virtual Ethernet adapter vEthernet (PLCSIM Advanced).
3. License with a Siemens License Server (SLS) USB stick or software-license file.
4. From TIA Portal, choose Online → Start Simulation → PLCSIM Advanced. The TIA project CPU entry switches from PN/IE to PLCSIM.

API and Scripting

PLCSIM Advanced exposes a .NET API and a REST API. Common use cases for crane and conveyor work include programmatic project download, tag read/write for test orchestration, and event-driven simulation steps.

// PowerShell: start a virtual S7-1200 instance and download the TIA project
Add-Type -Path "C:\Program Files\Siemens\Automation\PLCSIM Advanced\API\Siemens.Simatic.Simulation.Runtime.dll"
$api = New-Object Siemens.Simatic.Simulation.Runtime.SimulationRuntime
$instance = $api.CreateInstance("S7-1200_CPU_01")
$instance.Start()
$instance.DownloadProject("C:\Projects\CraneConveyor_V18.ap18")
$api.RegisterTag("DB_Hoist.HoistSpeed_mmps", "INT")

Network Layout

Each PLCSIM Advanced instance binds to a unique IP on the vEthernet (PLCSIM Advanced) adapter. For a typical crane rig with one S7-1200 controlling the hoist and one controlling the trolley, use the layout below:

5. Siemens SIMIT — Plant and Process Simulation

SIMIT (Siemens simulation platform for mechanical, industrial, and thermal processes) is the official Siemens answer to "where do I get an S7-1200 virtual PLC that talks to a plant model?" SIMIT is documented on Siemens automation product pages and on Siemens Industry Online Support. It plays two roles: as a stand-alone process simulator with its own I/O models, and as a coupling framework that connects any external simulator (including Visual Components and WinMOD) to one or more PLCSIM instances.

SIMIT Components

• SIMIT Editor — drag-and-drop library of pre-built models (motors, valves, conveyors, drives, tanks).
• SIMIT Manager — runs the simulation, manages time, exposes OPC UA / Modbus / TCP coupling points.
• SIMIT Coupling — maps SIMIT I/O to PLCSIM tags. Supports OPC UA, PROFINET, S7Comm, Modbus.
• SIMIT Library — ready-made crane and conveyor templates under the Material Handling catalog.

Typical SIMIT + PLCSIM Workflow

1. Build the plant model in SIMIT Editor using library components (motor starter block, conveyor block, hoist block).
2. Compile and start the SIMIT Manager. Confirm the simulation runs in real time or scaled time.
3. Start the PLCSIM (or PLCSIM Advanced) instance from TIA Portal.
4. Configure the SIMIT Coupling with the PLCSIM IP and the DB address map.
5. Drive the S7-1200 program from the TIA Online view while watching the plant animate in SIMIT.
6. Inject faults from the SIMIT faceplate to verify interlocks and alarm paths.

Coupling Configuration Example

In SIMIT Manager, add a new coupling of type OPC UA with the following parameters:

Endpoint URL:    opc.tcp://192.168.0.10:4840
Security Policy: None (dev) / Basic256Sha256 (prod)
Authentication:   Anonymous (dev) / Username+Password (prod)
Node ID mapping:
   PLC.DB_Hoist.HoistPosition_mm  ->  SIMIT.Conveyor1.Position
   PLC.DB_Hoist.HoistSpeed_mmps   ->  SIMIT.Conveyor1.SpeedCmd
   SIMIT.Conveyor1.Overload       ->  PLC.DB_Hoist.OverloadAlarm
   SIMIT.Conveyor1.EndOfTravel    ->  PLC.DB_Hoist.EndOfTravelDI

Once the mapping is saved and the coupling is started, every cycle of OB1 exchanges the listed variables between the S7-1200 program and the SIMIT plant model.

6. Third-Party Simulators — WinMOD and Alternatives

If your plant is dominated by real-time line emulation rather than 3D visualisation, WinMOD (from MPDV GmbH, Germany) is a long-standing alternative in the European automotive and conveyor industry. WinMOD builds a virtual machine from a library of motors, drives, conveyors, robots, and hydraulics and runs them in real time against an actual PLC — or against a virtual PLC such as PLCSIM.

WinMOD ↔ PLCSIM Coupling

• WinMOD exposes its I/O as S7 inputs and outputs to PLCSIM via the S7Comm protocol (ISO-on-TCP port 102).
• Up to 8 PLCSIM instances can be coupled simultaneously, simulating a distributed line.
• WinMOD also supports OPC UA for non-S7 couplings.
• For Visual Components geometry, WinMOD accepts DXF and STEP geometry but does not natively render SolidWorks assemblies; use a STEP export from SolidWorks as the bridge.

Alternative 3D Simulators

7. Visual Components 3D — Coupling to the S7-1200 Virtual PLC

Visual Components (VC) is the de-facto choice for 3D material-flow simulation in crane and conveyor applications. A VC scene can import a complete SolidWorks assembly, position it on a layout, and animate it through Python scripts that subscribe to external I/O. The PLC add-on exposes three coupling modes:

1. S7Comm direct — VC acts as an S7 client against the PLCSIM instance over ISO-on-TCP port 102. The simplest path; works for any S7-1200 with default settings.
2. OPC UA — VC subscribes to the OPC UA server exposed by PLCSIM Advanced or the SIMIT Coupling. Required for multi-instance rigs and for any environment where a Siemens SIMIT coupling front-end sits between PLCSIM and VC.
3. Modbus/TCP — for environments where the PLC program writes to a Modbus-mapped DB instead of an S7 area.

VC Component Configuration

In a VC component script (Python), bind an external tag to a 3D property:

# VC Python: bind S7-1200 tag to a 3D conveyor speed
from vcScript import *

comp = getComponent()
event = comp.OnSignal("HoistSpeed_mmps")

def OnSignal(arg):
    speed = readTag("S7:[S7-1200_CPU_01]DB1,DBW0") / 1000.0  # mm/s -> m/s
    comp.findBehaviour("Conveyor").setSpeed(speed)
    return 0

For OPC UA, replace readTag with the OPC UA subscription call from the VC OPC UA plugin:

node = vc_opcua.get_node("ns=4;s=DB_Hoist.HoistSpeed_mmps")
subscription = vc_opcua.subscribe(node, callback=on_speed_change, interval_ms=50)

Typical Cycle Time Targets

For VC scenes running alongside a PLCSIM Advanced instance, observe these cycle budgets on a Windows 11 engineering workstation with a 6-core CPU and 32 GB RAM:

8. Communication Protocol Selection

Pick the coupling protocol by data volume, latency requirement, and engineering effort. The matrix below summarises the realistic choices for an S7-1200 virtual rig.

OPC UA Server Configuration on PLCSIM Advanced

1. In TIA Portal, open the S7-1200 device view → Properties → OPC UA Server.
2. Enable Activate OPC UA Server.
3. Set port 4840, security policy None for development or Basic256Sha256 for production.
4. Add the DBs to the server address space — by default, only tags flagged as OPC UA visible are exposed.
5. Compile and download to the PLCSIM instance.
6. Test from UA Expert (free OPC UA client) using the endpoint URL opc.tcp://<PLCSIM-IP>:4840.

9. Step-by-Step — S7-1200 Virtual PLC → Visual Components

Prerequisites

• TIA Portal V18 with STEP 7 Basic licence (V19 needed for S7-1200 G2 second-generation CPUs).
• S7-PLCSIM Advanced with valid licence.
• Visual Components 4.x with the Premium or Experience licence (these enable OPC UA and S7 coupling).
• SolidWorks assembly file (.SLDASM) of the crane or conveyor component.
• Windows 10/11 Pro or Windows Server 2019+ on the engineering workstation.
• Network: single subnet, Windows firewall rules opened for ports 102, 4840, 502 as needed.

Procedure

1. Build the S7-1200 program in TIA Portal. Create a project, add an S7-1200 CPU (for example CPU 1214C DC/DC/DC, article number 6ES7214-1AG40-0XB0). Define at least one DB (e.g. DB_Hoist) with the I/O tags you want to exchange: HoistPosition_mm (INT), HoistSpeed_mmps (INT), OverloadAlarm (BOOL), RunCommand (BOOL), EndOfTravelDI (BOOL).
2. Enable OPC UA on the CPU. Follow the OPC UA Server Configuration procedure in section 8.
3. Start PLCSIM Advanced. From the Windows Start menu, launch S7-PLCSIM Advanced Manager. Click Start Virtual CPU. Note the IP shown in the manager (default 192.168.0.10).
4. Download the TIA project. In TIA Portal: Online → Extended Download to Device → PLCSIM Advanced. Pick the running instance. Confirm the download and verify the RUN/STOP LED shows green (RUN) in the PLCSIM Advanced status panel.
5. Verify tags via UA Expert. Open UA Expert, add the endpoint opc.tcp://192.168.0.10:4840, browse to Objects → DeviceSet → [CPU name] → DB_Hoist. Confirm all five tags are visible and read/write.
6. Import SolidWorks geometry into Visual Components. In VC, drag a 3D component onto the layout, set its geometry source to the .SLDASM file. Confirm the assembly renders. If the assembly exceeds ~5000 parts, simplify it in SolidWorks (defeature, suppress small fasteners) before import.
7. Configure the OPC UA coupling in VC. In VC Home → Connections → Add OPC UA Connection. Enter the endpoint URL, security policy, and tag mapping table. Save and test.
8. Bind the OPC UA tags to 3D properties. Use VC Python (snippet in section 7) to read HoistSpeed_mmps and drive the conveyor's speed behaviour. Repeat for each tag.
9. Run the closed loop. Start the VC simulation, start the PLCSIM, and toggle RunCommand from the TIA watch table. Confirm the 3D model accelerates and the HoistPosition_mm tag increments in UA Expert at the expected rate.
10. Log and replay. Use VC's built-in logger or an external OPC UA recorder to capture traces for review and post-mortem analysis.

10. Verification and Acceptance

Run this acceptance matrix before declaring the VC rig production-grade:

11. Troubleshooting Matrix

12. Performance Limits and Production-Code Caveats

Virtual commissioning is a development tool, not a certified verification path for safety functions. The following limits must be respected:

• Safety programs (F-CPU) are not simulated. PLCSIM skips all F-blocks. Run them on real hardware or on a Safety Validation Workstation.
• Real-world I/O timing is approximated. PLCSIM Advanced Softbus introduces 1–5 ms of jitter that is not present on a real backplane.
• Cycle time on PLCSIM is not deterministic. The host OS scheduler can delay OB1 by tens of milliseconds under load. If your logic depends on cycle determinism (e.g. closed-loop motion control with a G120 drive), validate on hardware.
• OPC UA security policies are off by default. Switch to Basic256Sha256 with certificate authentication before connecting any rig outside the engineering LAN.
• PLCSIM licence is bound to the engineering workstation. A floating licence via the Siemens License Server is required for parallel rigs across multiple engineers.
• SIMIT coupling adds latency. When using SIMIT as a coupling front-end (instead of direct PLCSIM ↔ VC), expect an additional 10–30 ms of round-trip time.

13. Frequently Asked Questions