Simulating Tags in WinCC Unified: SIMIT, PLCSIM, Scripts

1. Overview: Why Simulate Tags in WinCC Unified

Tag simulation is a fundamental requirement during WinCC Unified runtime development. Engineers need to verify screen logic, alarm behavior, trend curves, script reactions, and faceplate dynamic visibility without standing up a full PLC and field wiring. In WinCC Flexible 2008 and earlier, the integrated "Tag Simulation" tool exposed a small dialog where you could force values for any configured tag. That feature was removed in the WinCC Unified / TIA Portal V16+ HMI line, and it has not been reintroduced as a built-in button.

WinCC Unified runs on the WinCC Unified PC Runtime and Unified Comfort Panel lines. Both surfaces consume tags from a configured HMI connection (S7-1500, S7-1200, OPC UA, MODBUS TCP, etc.). If the connection drops or the tag has no source, the runtime continues to display the last cached value (or the configured start value). To drive dynamic content during commissioning, you need to inject values into the HMI tag database from one of the supported simulation sources.

This reference covers four production-grade paths:

1. Siemens SIMIT (officially recommended) — coupling between HMI tags and a virtual plant model.
2. Siemens S7-PLCSIM / S7-PLCSIM Advanced — a virtual S7-1500 or S7-1200 CPU that exchanges real tag data with the Unified runtime.
3. Scheduled JavaScript inside WinCC Unified — pure-runtime scripts that periodically write to internal tags.
4. Open Pipe Interface and .NET API — programmatic tag write access from external processes.

Each path is appropriate for a specific test phase. SIMIT and PLCSIM are used during project acceptance and FAT. JavaScript is used for unit-testing faceplate behavior. The Open Pipe Interface is used for load and stress tests, or for digital-twin integration.

2. Prerequisites

3. Method 1 — SIMIT (Officially Recommended by Siemens)

Siemens SIMIT is the only tool that the Siemens Industry Online Support explicitly names as a WinCC Unified tag simulation source. Siemens KB article 109760641 describes the SIMIT↔WinCC Unified coupling as a fully bidirectional process-data exchange that uses the WinCC Unified Open Pipe Interface over TCP port 5001 (default) or a named pipe on the same machine.

3.1 Architecture

SIMIT runs on the same PC as WinCC Unified PC Runtime (or on a separate engineering station if WinCC Unified exposes a remote Open Pipe Interface endpoint). Inside SIMIT you build a virtual plant using SIMIT Component Type Editor (CTE) charts: function blocks such as PID, ramp, integrator, two-position controller, and signal generators. SIMIT exposes each chart's I/O as OPC UA or as a SIMIT-specific channel. The SIMIT "WinCC Unified Coupling" plug-in maps these channels to HMI tag names.

3.2 Step-by-Step SIMIT Coupling

1. Install SIMIT V11 alongside the engineering PC. Accept the default port 5001 for the SIMIT SP (Shared Parameter) service.
2. In TIA Portal, open the WinCC Unified device, switch to "Connections" and add an HMI connection of type SIMATIC HMI Unified - Open Pipe Interface. Enter localhost (or the Unified PC's IP) and confirm port 5001.
3. Create the HMI tags you want to simulate (e.g. HMI_Tag_Pressure, HMI_Tag_Level, HMI_Tag_Pump1_Run) and assign them to the Open Pipe Interface connection. Set the acquisition mode to Cyclic in operation with a 1000 ms cycle for analog and 500 ms for digital tags.
4. Compile the Unified project and start WinCC Unified PC Runtime. Confirm in the Runtime Manager that the Open Pipe Interface status is Running and that the connection shows Connected.
5. Start SIMIT, open Component Type Editor and create a new chart, e.g. Plant_1. Insert a RAMP block configured to output 0–10 bar over 60 s, then a NOISE block modulating ±0.2 bar around the ramp value. Wire the output to the chart's I/O connector ProcessValue.
6. Open the SIMIT project manager, right-click the chart instance, select Coupling > WinCC Unified. In the dialog, browse the HMI tag tree exposed by the Open Pipe Interface. Map the chart I/O to HMI_Tag_Pressure. Click Apply and Start Coupling.
7. Switch back to the WinCC Unified runtime. The pressure gauge on your screen should sweep from 0 to 10 bar. Open the HMI tag diagnostics in the runtime (Project view > right-click device > Runtime > Tag diagnostics) and confirm the quality code is Good (0xC0) instead of Uncertain (0x40) or Bad (0x00).

3.3 Sizing and Performance

SIMIT V11 sustains roughly 4,000 signals per second on a quad-core 3.0 GHz workstation with 16 GB RAM. If your test requires 10,000+ tags, run SIMIT and WinCC Unified on separate physical machines and connect them over Ethernet. The Open Pipe Interface handshake supports remote endpoints without code changes.

4. Method 2 — S7-PLCSIM (S7-1500 / S7-1200 Virtual CPU)

S7-PLCSIM emulates an S7-1500 or S7-1200 CPU in software. The Unified runtime connects to it exactly the same way it would connect to a physical controller: S7ONLINE / TCP over port 102. PLCSIM is the right choice when you want to reuse the real PLC program, including the FB and DB logic, and only the field I/O is missing.

4.1 Configuration

1. In TIA Portal, open the S7-1500 device (e.g. 6ES7515-2AM02-0AB0) and add it to the project if it is not already there.
2. Open the CPU properties, switch to Protection & Security and verify that Permit access with PUT/GET communication from remote partner is enabled. PLCSIM requires this for external HMI connections.
3. Compile the PLC program (Ctrl+Shift+B) and download to PLCSIM (Start > S7-PLCSIM). Use the softbus interface (PLCSIM V16) or the local TCP interface (PLCSIM V17+).
4. Set the PLCSIM instance to Run. The status LED turns green when the CPU is in RUN.
5. In the WinCC Unified device, the HMI connection to the S7-1500 should already exist. Open the connection properties and verify the IP address matches the PLCSIM virtual adapter (typically 192.168.0.1 / 255.255.255.0 with gateway 192.168.0.2).
6. Compile and download the HMI project. Start the runtime. Tags should now resolve to Good quality with the values computed by your PLC program.

4.2 Driving Test Values

PLCSIM exposes a force table (right-click the CPU > Force table) and a watch table. You can force individual inputs and DB values to step through the logic. For trend tests, place a small FB in the PLC program that uses RTC plus a ramp generator. Example STL-style pseudo-code:

// Ramp test signal 0..100% over 30 s
#rampOut := #rampOut + (REAL#100.0 / 30.0) * cycleTime;
IF #rampOut > 100.0 THEN #rampOut := 0.0; END_IF;
"HMI_Tag_RampTest" := #rampOut;

S7-PLCSIM Advanced (catalog 6ES7822-1AA05-0YA5) supports multiple virtual instances and an OPC UA server endpoint, which allows a Unified runtime to subscribe via OPC UA instead of S7 communication when needed.

5. Method 3 — Scheduled JavaScript Inside WinCC Unified

WinCC Unified V17+ uses Chromium-based scripting (VBScript is deprecated but still available). You can attach a scheduled task that runs at a fixed cycle and writes a generated value into an internal tag. Internal tags are HMI-local variables that never leave the runtime, which makes them safe to overwrite from a script.

5.1 Create the Internal Tag

1. In the TIA Portal project tree, expand the Unified device and open HMI tags.
2. Create a new tag: name Sim_Pressure, connection = Internal tag, data type = Real, acquisition mode = Cyclic continuous with 1000 ms cycle.
3. Repeat for any other tags you need (e.g. Sim_Pump1_Run as Bool).

5.2 Add the Script

Open Scripts > Scheduled tasks in the Unified project. Add a new task named TagSim_Ramp, schedule it with a 1 s period, and assign a new JavaScript function:

// TagSim_Ramp.js - Linear ramp on internal tag Sim_Pressure
let cur = Tags("Sim_Pressure").Read();
if (cur < 0 || cur > 100) cur = 0;
let next = cur + 1.0;     // 0..100 in 100 s
if (next >= 100) next = 0;
Tags("Sim_Pressure").Write(next);

// Square wave on digital tag every 5 s
let t = new Date().getSeconds();
Tags("Sim_Pump1_Run").Write( (t % 10) < 5 );

The script API surface is the HMIRuntime object. Tags("name") returns a tag handle; .Read() and .Write(value) are synchronous for internal tags. For external tags the read/write is async and returns a Promise. Always handle the error case:

Tags("Ext_Pressure").Write(next).then(function(){
  HMIRuntime.Trace("Write OK");
}).catch(function(e){
  HMIRuntime.Trace("Write failed: " + e);
});

5.3 Limitations

JavaScript is single-threaded within the V8 isolate that Unified uses, so you cannot block with while(true). The scheduled-task rate is also throttled to the configured cycle, and tasks longer than the cycle overlap; this is normally fine for lightweight value generation. Do not use scheduled scripts to drive tags that need ms-level determinism — for that, use SIMIT or a real PLC.

6. Method 4 — Open Pipe Interface and .NET API

The Open Pipe Interface (OPI) is a public API available in WinCC Unified that lets external processes read and write HMI tags. The .NET API Siemens.Runtime.HmiUnified is part of the WinCC Unified SDK. Both are intended for vendor integration (MES, historians) and for stress test harnesses.

6.1 Open Pipe Interface Endpoints

6.2 .NET C# Example

// Drive three tags cyclically from a C# console process
using Siemens.Runtime.HmiUnified;
using (var conn = new UnifiedConnection("localhost", 5001))
{
    conn.Connect();
    var t1 = conn.CreateTagHandle("HMI_Tag_Pressure");
    var t2 = conn.CreateTagHandle("HMI_Tag_Level");
    var t3 = conn.CreateTagHandle("HMI_Tag_Pump1_Run");
    double p = 0.0;
    while (true)
    {
        t1.WriteFloat((float)p);
        t2.WriteFloat((float)(50.0 + 10.0 * Math.Sin(p / 10.0)));
        t3.WriteBool((p % 20.0) < 10.0);
        p += 0.5;
        if (p >= 100.0) p = 0.0;
        System.Threading.Thread.Sleep(200);
    }
}

Build the project against Siemens.Runtime.HmiUnified.dll shipped with the WinCC Unified SDK. The DLL lives in C:\Program Files\Siemens\Automation\WinCCUnified\SDK\Bin by default.

7. Tag Configuration Reference

8. Verification Procedure

1. Start the simulation source (SIMIT, PLCSIM, or script) and confirm its service status is Running.
2. Start WinCC Unified PC Runtime. In Runtime Manager, the device should transition from Connecting to Running within 30 s.
3. Open the tag diagnostics view (Project tree > right-click device > Online > Tag diagnostics). All simulated tags must show quality Good (0xC0).
4. Force a known value (e.g. write 42.0 to Sim_Pressure) and confirm the screen gauge shows 42 within one acquisition cycle plus 200 ms display refresh.
5. Kill the simulation source. The tag quality should drop to Bad (0x00) within 5 s and the configured substitute value should appear on the screen.
6. Restart the simulation source. The tag should recover to Good (0xC0) automatically without restarting the runtime.
7. Open the trace log (Runtime Manager > Logs > Diagnostic) and confirm no connection-timeout or subscription-error entries.

9. Troubleshooting Matrix

10. Safety and Operational Notes

• Disable the simulation connection on the engineering image once testing is complete to prevent accidental use during a real plant trip.
• Do not let simulated values leak into the historian. Configure the WinCC Unified tag logging to exclude the simulation connection, or use a separate logging database for the test bench.
• Keep the simulation PC on a private engineering VLAN. The Open Pipe Interface has no built-in authentication in its base form, so network isolation is the primary security control.
• When using PLCSIM Advanced with OPC UA, set the endpoint security policy to None only on the engineering VLAN.

11. Choosing the Right Method

For most acceptance tests, start with SIMIT because it requires no PLC program changes. For tests where the PLC program is the unit under test, use PLCSIM. Use JavaScript only when you need a quick stand-in for a value that is not yet implemented in the PLC. Use the Open Pipe Interface for digital-twin or load-test scenarios where neither a virtual PLC nor SIMIT exists.

12. References to Official Documentation

Refer to the following Siemens Industry Online Support entries when implementing any of the methods above:

• Siemens KB 109760641 — "WinCC Unified: Tag simulation with SIMIT".
• WinCC Unified System Manual — "Tags and Tag Connections" chapter.
• S7-PLCSIM V18 Function Manual — "Working with S7-PLCSIM and WinCC Unified".
• Open Pipe Interface developer guide, shipped with the WinCC Unified SDK.
• TIA Portal Help > "Configuring an HMI connection > SIMATIC HMI Unified - Open Pipe Interface".