TIA Portal HMI Simulation: PLCSIM Integration and Runtime Limits

Overview

TIA Portal provides three distinct simulation paths for testing WinCC HMI applications before they are deployed to a physical panel or PC runtime: HMI Simulation, HMI Simulation with Tag Simulator, and the full PLCSIM coupled mode. Each path is intended for a different stage of the engineering workflow and has a different license footprint, a different set of supported instructions, and a different behavior for peripheral functions such as file system access, recipe handling, and tag forcing.

Engineers routinely ask whether a development workstation can replace a real Comfort Panel, an IPC, or an S7 CPU during acceptance testing. The short answer is yes, with documented limitations. This reference consolidates the simulation architecture, the licensing model, the tag-counting rules, and the field-proven caveats for FileCtl scripts, Win CE file paths, and mixed-vendor PLC communication.

Prerequisites

• TIA Portal V15.1, V16, V17, V18, or later installed with WinCC Professional / WinCC Comfort / WinCC Advanced (depending on the target panel family).
• STEP 7 Professional for PLCSIM integration with S7-300, S7-400, S7-1200, or S7-1500 programs.
• S7-PLCSIM (V15.1 or later, matching the TIA Portal version) for PLC simulation. PLCSIM and the engineering software must be the same major release to avoid version-mismatch dialogs.
• Either an active Runtime license (RT 128 / RT 256 / RT 512 / RT 2048 / RT 4096) for full Panel Simulation, or no license for HMI Simulation only.
• A project with compiled HMI configuration, no blocking errors in the compile log, and a valid HMI device assignment.

HMI Simulation Modes in TIA Portal

The Start Simulation command in the TIA Portal toolbar exposes the following sub-modes. The choice is made per launch and does not modify the project offline.

The two HMI-only modes are deliberately license-free so that OEMs and system integrators can iterate screen design and PLC logic in parallel without tying up Runtime license seats on a single engineering workstation.

Power Tags and Runtime Licensing

When the engineering PC starts Panel Simulation without an installed Runtime license, TIA Portal displays the dialog "The maximum number of power tags has been exceeded." The text counts the number of configured power tags in the project against the count of the absent license (default 0). Clicking OK continues the simulation; no functions are disabled at runtime. This is the expected behavior and is not an error.

Power tags include all HMI tags that are used in the project (visible in the HMI tag table filtered by the "Used" column) and have an external connection to the PLC. Internal tags and array elements do not count. The license is tied to the PC, not the project; a USB-dongle or software-based license (ALM / Automation License Manager) moves with the engineering workstation.

PLCSIM Integration with HMI Simulation

When PLCSIM is started, the simulated CPU instance exposes a Softbus interface on the engineering PC. TIA Portal routes the HMI's PROFINET or MPI/TCP connection to the PLCSIM instance transparently, so the HMI runtime talks to the simulated CPU exactly as it would talk to a real S7-1500 on the plant network. The following constraints apply:

• PLCSIM occupies the local PROFINET interface stack; the HMI runtime running on the same PC cannot reach a second real PLC on the same interface while PLCSIM is active. This is the root cause of the field observation that "PLC does cut you other interfaces."
• A real PLC and PLCSIM cannot be used as two simultaneous PLC partners from one HMI. The connection partner is fixed in the HMI connection editor.
• The HMI Simulation still works while PLCSIM is active because both share the Softbus; the HMI does not require the host's PROFINET hardware for the simulation connection.
• If the project uses an HMI tag connected to multiple PLCs (multiplexed), only the active PLCSIM instance responds; the secondary connection shows the configured substitute value.

To combine a real PLC with HMI Simulation, disconnect the project from PLCSIM (right-click the PLC in the project tree → "Disconnect from PLCSIM") and let the HMI runtime resolve the connection via the normal PROFINET stack. The HMI then talks to the real CPU while still running on the engineering PC.

FileCtl and Win CE-Specific Functions

The FileCtl family of VBScript functions (e.g., FileCtl.Open, FileCtl.LineInput, FileCtl.LinePrint, FileCtl.FileLen, FileCtl.Kill, FileCtl.MkDir) was introduced for Windows CE panels, where the standard FileSystemObject is not available. On a PC runtime or in HMI Simulation, the path conventions differ:

Scripts that hard-code \Storage Card2\ paths will create a directory of that exact name on the engineering PC's C: drive during simulation. This is harmless on the workstation but indicates that the script must be refactored to use a project-relative path or a configurable storage location before deployment.

Other Win CE-specific functions to audit before relying on simulation results:

• ShowSystemCursor — no effect on PC, but relevant for touch-only panels.
• GetPasswordLevel / SetPasswordLevel — works the same on PC runtime.
• WinCE_Screen_Saver style calls — silently no-op on PC.
• Direct registry access via Shell.Run "regedit" — blocked by UAC on PC runtime.

Non-Siemens PLC and Non-S7 Communication

PLCSIM only emulates S7-300, S7-400, S7-1200, and S7-1500 firmware. Projects that connect to Allen-Bradley Logix, Modbus TCP/RTU devices, OPC UA servers, or third-party PLCs have no PLCSIM equivalent in TIA Portal. In these cases, the simulation path narrows to HMI Simulation with Tag Simulator (no live PLC) or a vendor-specific simulator (e.g., Studio 5000 Logix Emulate, ModbusPal, Kepware simulation driver).

Configure the HMI to use a SIMATIC OPC UA server or a third-party OPC UA server (e.g., from a vendor's simulation bundle) and point the HMI's OPC UA connection at opc.tcp://localhost:4840. The HMI runtime on the engineering PC can then poll a synthetic tag source while the real PLC is not yet available.

Step-by-Step: Enabling HMI Simulation with PLCSIM

1. Compile the S7 program and the HMI configuration. Resolve every error and every warning of severity "Error" in the inspector.
2. Right-click the PLC station in the project tree → Start simulation. PLCSIM launches and a virtual CPU instance becomes active.
3. Download the S7 program to the PLCSIM instance (drag-and-drop from the project tree onto the PLCSIM window, or use the toolbar download button).
4. Right-click the HMI device in the project tree → Start simulation → HMI Simulation. The HMI runtime opens in a window on the engineering PC.
5. If the project uses area pointers or coordinated tags, click the PLCSIM "Run" (green play) button to put the simulated CPU into RUN. The HMI screens populate within one cycle.
6. To force or modify tags from the HMI side, open the HMI tag table, right-click the tag, and use Modify. The change is written to PLCSIM and is visible in the PLCSIM watch table.
7. To track tag values from the PLC side, open the S7 watch table in TIA Portal, connect online to PLCSIM, and observe the same values the HMI is displaying.

Step-by-Step: HMI Simulation with Tag Simulator Only

1. Compile the HMI configuration standalone. A PLC project is not required.
2. Right-click the HMI device → Start simulation → HMI Simulation with tag simulator.
3. The tag simulator dialog opens. Add each external HMI tag that needs to be exercised, set its data type and an initial value.
4. Use the Quality code dropdown to simulate bad-quality scenarios: 0x00 (good), 0x40 (bad, device failure), 0x48 (bad, communication failure).
5. Switch screens, test navigation, animations, script triggers, and alarm views. Because no PLC code is loaded, only the visual and logical behavior of the HMI screens is exercised.

This mode is the fastest way to validate screen layout, multilingual texts, permission handling, and script logic when the S7 program is not yet ready.

Verification and Test Procedure

After the simulation is running, perform the following checks before signing off the test:

1. Confirm that all configured tags in the HMI tag table show good quality (icon green in the diagnostics view). Any persistent bad-quality tag indicates a connection or naming mismatch with PLCSIM.
2. Force a bit tag from the HMI screen and verify in the PLCSIM watch table that the value changed.
3. Trigger an alarm from PLCSIM (set the trigger tag) and verify that the alarm appears in the HMI alarm view with the correct timestamp and class.
4. Exercise a script that calls FileCtl.LinePrint and verify the log file is created in C:\Siemens\Automation\WinCC RT\Logs (or the configured path).
5. Save a recipe, cycle power on the PLCSIM instance, and verify that the recipe values reload correctly on the next HMI start.
6. Stop the simulation, restart it cold, and verify the dialogs for the license warning, the connection status, and the start screen appear in the expected order.

Troubleshooting Matrix

Deployment and License Migration

The same project that runs in HMI Simulation on the engineering PC downloads to a physical Comfort Panel, Mobile Panel, or IPC running WinCC Runtime without code changes. The differences that matter at the cutover are:

• License activation: the Runtime license moves from the engineering PC to the target device via the Automation License Manager.
• Path conventions: replace C:\ and the auto-created simulation directories with \Storage Card2\ or \Flash\ paths appropriate for the panel.
• Touch calibration and screen saver: handled by the panel firmware, not by the PC simulation.
• PROFINET stack: on a real panel, the connection uses the physical port; on the PC, it uses the host adapter selected in Set PG/PC interface.

Run a final acceptance test on the physical target device with the same test cases used in simulation. The simulation cannot validate panel-specific behavior such as touch response time, brightness control, audio playback, or SD card hot-swap.

Frequently Asked Questions