Testing STEP 7 Projects Without PLC Hardware Using PLCSIM

1. Problem Definition: Validating STEP 7 Logic Without Physical PLC

Engineers commissioning Siemens SIMATIC S7-300, S7-400, S7-1200, and S7-1500 programs routinely need to validate control logic, I/O mapping, and interlock sequences before a real CPU is available. Common scenarios include:

• Home office / remote development without PLC hardware on the desk.
• Pre-FAT (Factory Acceptance Test) verification of a program months before the panel is wired.
• Customer demos where shipping a CPU is impractical.
• Training environments that must run dozens of students on a single PC.
• Code review and static analysis on a virtual machine without a live Ethernet/PROFINET interface.

Siemens addresses this need primarily through the S7-PLCSIM product family, a software-based virtual PLC that runs in the same process space as STEP 7 / TIA Portal and executes the compiled S7 program instruction-by-instruction against a simulated I/O image. PLCSIM is not a free add-on in production form, but it ships in a license-protected demo mode and is bundled with STEP 7 Professional and higher TIA Portal packages.

2. PLCSIM Product Family Overview

All three share the same operational model: the compiled S7 blocks (OB, FB, FC, DB, UDT) are downloaded to a virtual CPU that runs the same scan cycle code path as a real controller. The differences are in the supported instruction set, the number of simultaneous instances, and the API exposure for external test harnesses.

3. Prerequisites

3.1 Hardware / OS

• Windows 10 (64-bit, version 1809 or later) or Windows 11; TIA Portal V16 and later support Windows Server 2019/2022 for engineering VMs.
• Minimum 16 GB RAM (32 GB recommended for PLCSIM Advanced running 3+ virtual CPUs).
• 20 GB free disk for TIA Portal installation; 2–4 GB per additional PLCSIM instance.
• Local administrator rights for the Automation License Manager (ALM) operation.

3.2 Software

• STEP 7 Professional V18 or V19 in TIA Portal (the article assumes V18 SP1 / V19; substitute equivalent path for older V16/V17). Siemens STEP 7 TIA Portal product page.
• S7-PLCSIM (installed automatically as a plug-in of TIA Portal; selectable during installation under "TIA Portal options").
• Automation License Manager V6.0 SPx for license handling.

3.3 Engineering Setup

• Completed TIA Portal project with at least one S7-1200/S7-1500 device configured.
• Compiled program (no compile errors) — PLCSIM cannot load a program with unresolved symbols or unknown instructions.
• A consistent PLC program version in the project (any DBs, FBs, FCs, UDTs).

4. Step-by-Step: S7-PLCSIM in TIA Portal V18 / V19

1. Install the PLCSIM plug-in. Run the TIA Portal installation in modify mode and ensure "S7-PLCSIM" is checked under "SIMATIC S7-PLCSIM". Restart the TIA Portal after install.
2. Open your project. Open the project containing the target S7-1500 or S7-1200 station. Select the PLC device in the project tree.
3. Select the PG/PC interface. From the menu choose Options → Set PG/PC interface and select S7-PLCSIM (TCP/IP, Auto). This directs downloads to the virtual CPU over the loopback adapter (no physical Ethernet required).
4. Start the simulation. Click the Start simulation button on the toolbar, or navigate to Online → Simulation → Start. A floating PLCSIM window appears with the virtual CPU status, MRES button, RUN/STOP toggle, and slot indicator.
5. Download the configuration. With the PLCSIM instance selected, click Download to device. TIA Portal will perform an "extended download to device", transferring the system data (SDB) and blocks. The PLCSIM window confirms the connection by showing the assigned slot, e.g. PLC_1 [CPU 1515-2 PN].
6. Toggle the CPU to RUN. Click the green RUN/STOP toggle in the PLCSIM instance window. The virtual CPU begins cyclic OB1 execution.
7. Open a Watch Table. From the project tree, double-click Watch and force tables → Add new watch table. Insert the inputs (%I0.0, %IW64) and outputs (%Q0.0, %QW80) you wish to monitor. Click the "Monitor all" (glasses) icon to start the online view.
8. Force an input. Right-click a Boolean input bit (e.g. %I0.0) and choose Modify to 1 or Force to 1. Force operations are persistent across scan cycles until released.
9. Observe output reaction. The expected output bit (%Q0.0) should turn true within one PLC scan. Use the watch table to verify timing and interlock state.
10. Capture a trace. For sequential logic, open Traces → Add new trace, record the relevant tags at 1 ms resolution, and download the trace configuration to PLCSIM. Trigger the recording and export the .csv for review.
11. Stop the simulation. Stop the CPU via RUN/STOP, then disconnect and close the PLCSIM instance window.

5. Step-by-Step: S7-PLCSIM V5.x (SIMATIC Manager / STEP 7 Classic)

The legacy S7-PLCSIM supports S7-300 and S7-400 stations and is invoked from inside SIMATIC Manager.

1. Install STEP 7 V5.6 Professional from the Siemens DVD or download portal. The installer places PLCSIM V5.4 SPx in the Start → SIMATIC → S7-PLCSIM group.
2. Open SIMATIC Manager and open the S7 project containing the S7-300/400 station.
3. Launch S7-PLCSIM V5.x from the start menu. A virtual CPU appears; select the CPU model (e.g. CPU 315-2 PN/DP) that matches the station.
4. In SIMATIC Manager select the S7 program (Blocks folder) and choose PLC → Download to push the blocks to the virtual CPU.
5. Toggle the virtual CPU to RUN-P using the toolbar button. The "SF", "BF", and "DC5V" LEDs extinguish when the program is healthy.
6. Open a VAT (Variable Table) from the project, click Monitor, and use Modify / Force to drive inputs.
7. Use PLCSIM → Insert Input Variable / Insert Output Variable / Insert Memory Bit / Insert Timer / Insert Counter to expose simulated I/O to the program.

6. S7-PLCSIM Advanced: Headless / Multi-Instance Simulation

PLCSIM Advanced extends PLCSIM with the ability to start virtual S7-1500 controllers from a Windows command line or PowerShell, run them as Windows services, and expose their I/O via an OPC UA server or TCP/IP socket. This enables CI/CD pipelines and digital twin integration.

6.1 Installation

• PLCSIM Advanced V5.x / V6.x is distributed as a separate installer (order number family: 6AV2105-... for floating licenses).
• Install on a Windows 10/11 or Server 2019/2022 host. Restart required.

6.2 Command-Line Operation

"C:\Program Files\Siemens\Automation\PLCSIMAdvanced\PLCSimAdv.exe" -n PLC_1 -t S7-1500 -ip 127.0.0.1 -pw S7-PLCSIM -api 127.0.0.1:2222

Parameters:

6.3 Use Cases

• Running two virtual PLCs on one PC to test PROFIsafe / PROFINET IO controller ↔ device handshakes.
• Running an OPC UA client in Python to inject process values for model-in-the-loop testing.
• Embedding a virtual line in a Unity/Unreal 3D twin that exchanges cyclic data via the PLCSIM Advanced API.

7. Free and Low-Cost Alternatives to PLCSIM

When a Siemens license is not available, several third-party or open-source approaches can be used to validate STEP 7 logic. The compatibility and faithfulness of the simulation varies.

8. Building a Test Harness in FC / FB

Best practice for repeatable, hardware-free testing is to build a dedicated test FC in the STEP 7 program that emulates field devices. The same FC is active only when a project-level compile switch is set (e.g. Simulation_Active := TRUE).

FUNCTION_BLOCK "FB_Sim_Harness"
VAR
    Sim_Active : BOOL;       // global flag from DB_SimConfig
    Pump_FB    : BOOL;       // simulated pump feedback
    LS_Upper   : BOOL;       // simulated upper limit switch
    LS_Lower   : BOOL;       // simulated lower limit switch
    Cycle_Time : TIME;       // 100 ms tick from OB35
END_VAR
BEGIN
    IF NOT Sim_Active THEN RETURN; END_IF;

    // Emulate upper limit switch triggering after 5 s
    IF TON(IN := NOT LS_Upper, PT := T#5s).Q THEN
        LS_Upper := TRUE;
    END_IF;

    // Echo pump command to feedback with 200 ms delay
    Pump_FB := TON(IN := "DB_Main".Pump_Run, PT := T#200ms).Q;
END_FUNCTION_BLOCK

The harness is called from OB1 in series with the real I/O driver, so the same control logic path executes against simulated values. This pattern allows the program to be tested in PLCSIM and in the real plant with a single compile-time switch.

9. Watch Tables, Force Tables, and Trigger Conditions

9.1 Watch Table Operations

9.2 Trigger Conditions

Watch tables can be configured to modify or force only when a defined trigger tag transitions, e.g. "write %I0.0 := 1 when %M100.0 changes from 0 to 1". This is invaluable for sequencing tests without manual timing.

10. Working with the Trace Function

TIA Portal's Trace (S7-1500 / PLCSIM only) records tag values at user-defined sample rates from 0.1 ms upward. The trace is downloaded to the CPU, which buffers the data in ring memory. Use Trace to:

• Capture PID output behavior against a simulated setpoint step.
• Verify interlock timing in a sequence (e.g. conveyor start delay 500 ms after guard close).
• Compare two PLC program revisions on the same stimulus to detect regressions.

Sample rate trade-off: 1 ms sampling uses about 1 KB of ring buffer per 1000 samples; 0.1 ms sampling pushes the buffer tenfold. Use the shortest duration necessary to keep traces exportable.

11. Verification Checklist

Use the following checklist before declaring a STEP 7 program "tested".

1. Compile clean — zero errors and zero warnings in the project tree.
2. CPU diagnostics buffer free of events after a 30-minute test run.
3. All interlocks validated with the worst-case input combination.
4. All timers (TON, TOF, TP) verified with the trace recorder.
5. Edge detection (positive and negative) tested for all flags used in sequence logic.
6. Watch table captures confirm all expected outputs toggle on every test stimulus.
7. Force / Modify operations are released before ending the session.
8. OB82, OB83, OB86, OB122 (diagnostic / pull-plug / I/O error) OBs exercised if any optional I/O is configured.
9. Trace recording exported to .csv and archived in the project documentation folder.
10. Program version and PLCSIM version recorded in the test report (e.g. "V19 SP1 / PLCSIM V19").

12. Troubleshooting Matrix

13. Performance and Sizing Notes

• A single PLCSIM V18 instance consumes about 200–500 MB of RAM and 2–5% of one CPU core on a modern Intel/AMD processor.
• PLCSIM Advanced supports up to 16 concurrent virtual S7-1500 CPUs on a single host; a 32 GB RAM workstation is the practical ceiling.
• Scan time in PLCSIM is wall-clock-equivalent — a 10 ms OB1 runs every 10 ms. This is useful for timing tests but consumes real CPU on the host.
• Communication (PROFINET / PROFIBUS / OPC UA) is local-only; external devices cannot connect to PLCSIM without PLCSIM Advanced's API.

14. Migrating Test Rigs Between PLCSIM and Real CPU

The same test FC, watch table, and trace configuration work against both PLCSIM and a real S7-1500. To migrate:

1. Re-select the PG/PC interface to the real Ethernet adapter.
2. Identify the real CPU in Online → Accessible devices.
3. Download the project to the real CPU; the previously online values are overwritten.
4. Use the same watch tables — the syntax is identical.
5. Remove or disable the test harness by setting Simulation_Active := FALSE.

15. Licensing and Cost Considerations

Confirm current part numbers and pricing on the official Siemens Industry Online Support portal.

16. Best-Practices Summary

• Always isolate the simulation boundary in a dedicated FC/FB with a project-level enable flag.
• Use Force sparingly and document every forced value in the test report.
• Record the PLCSIM version and TIA Portal version in the test deliverables.
• Automate regression tests with PLCSIM Advanced and a Python/OPC UA harness.
• Keep a "golden" watch table that exercises every interlock — re-run on every program revision.

FAQ