WinCC Flexible: Connecting PLCSIM to Real HMI Panels

Overview

WinCC Flexible is the Siemens engineering software used to configure the SIMATIC HMI panel portfolio that was sold between 2005 and 2010: the OP 73/77 micro family, the TP 170/177/270/277 thin-client line, the MP 177/277/370/377 multi-panel family, the Mobile Panel 170/177/277/370, the C7-635/C7-636 operator panels, and the PC-based WinCC Flexible Runtime. The final release is WinCC Flexible 2008 SP5 (build K1.8.6.0), which Siemens shipped in 2014 before the product line was migrated into TIA Portal under the WinCC Comfort/Advanced/Professional brand.

Engineers who maintain legacy installations routinely run into three boundary questions that are not answered in any single Siemens manual: (1) whether a WinCC Flexible project can be authored for a third-party panel, (2) whether the S7-PLCSIM soft-PLC can talk to a real HMI panel on the bench without the actual S7 CPU being present, and (3) how to push a compiled runtime file onto a panel when the engineering laptop that has WinCC Flexible installed is not on the production floor. The procedures, port settings, and tool paths documented below are the field-verified answers to all three questions, including the NetToPLCSim TCP bridge that makes (2) possible.

The reference target for these procedures is WinCC Flexible 2008 SP5 against STEP 7 V5.5 + S7-PLCSIM V5.4 SP5 on Windows 7 SP1 / Windows 10 1909, and against the SIMATIC HMI panels listed in the compatibility matrix under SIMATIC HMI.

WinCC Flexible Panel Compatibility Scope

WinCC Flexible supports only Siemens-branded SIMATIC HMI devices. The Device Integration catalog shipped with WinCC Flexible 2008 SP5 contains the device descriptions for the following families:

• Micro panels: OP 73 micro, OP 77A, OP 77B
• Operator panels: OP 170B, OP 270, OP 277
• Touch panels: TP 170A, TP 170B, TP 177A, TP 177B, TP 177micro, TP 270, TP 277
• Multi panels: MP 177, MP 270B, MP 277, MP 370, MP 377
• Mobile panels: Mobile Panel 170, Mobile Panel 177, Mobile Panel 277, Mobile Panel 370
• C7 compact systems: C7-635, C7-636
• PC-based runtime: WinCC Flexible Runtime 2008 (single-user and server)

No project import or export path exists from WinCC Flexible to third-party HMI engineering tools such as Pro-face GP-Pro EX, Beijer Electronics iX Developer, Red Lion Crimson, or Maple Systems EBPro. The compiled runtime format (.fwx) is a proprietary Siemens container, and the runtime protocols that WinCC Flexible supports are limited to S7-MPI/DP, S7 over ISO-on-TCP (port 102), PROFINET IO, OPC DA (RT only), and HTTP/HTTPS for the WinCC channel. None of those protocols map directly onto the Modbus TCP, EtherNet/IP, or Mitsubishi MC protocol stacks required by the non-Siemens panels.

For multi-vendor fleet applications, the practical path is to migrate the Siemens-side panels to TIA Portal WinCC and select a vendor-neutral SCADA runtime (Ignition, InTouch, MOVICON) for the third-party hardware. Mixed-runtime HMI deployments must be designed up front because the S7 connection model in WinCC Flexible cannot be retro-fitted onto Modbus/TCP tags without a custom script adapter.

PLCSIM and Real HMI Communication

Direct S7 communication between STEP 7 S7-PLCSIM and a physical WinCC Flexible panel over the network is not natively possible. PLCSIM attaches itself to the local STEP 7 PG/PC interface and exposes the simulated CPU only to the local process; it does not bind a server socket on the workstation's Ethernet interface, so the panel cannot establish a S7 connection. The panel's connection status bar stays on "Connecting" (yellow) and times out after the configured retry interval.

Two verified workarounds exist:

1. NetToPLCSim – open-source TCP relay published on SourceForge. It binds a S7 ISO-on-TCP server socket on the workstation's Ethernet adapter and forwards all S7 frames to the local S7-PLCSIM instance via the Simatic Application Interface. The panel can then connect to the workstation as if it were a real S7 CPU.
2. WinCC Flexible Runtime Simulator – local PC-based runtime that loads the compiled HMI project and connects to PLCSIM on the same machine through the PLCSIM TCP/IP interface. This works out of the box, but the HMI is software-only; no real panel is involved.

A real HMI panel can only be brought into the PLCSIM loop through NetToPLCSim or a functionally equivalent TCP bridge. There is no Siemens-published patch that exposes the S7-PLCSIM back-end over Ethernet natively.

NetToPLCSim Architecture and Prerequisites

NetToPLCSim is implemented as a small Windows service (NettoplcsimS7.dll + GUI) that registers itself as an ISO-on-TCP server on the workstation's Ethernet interface. When the HMI panel sends a S7 communication request, NetToPLCSim decodes the TPKT/COTP/S7 frame, replaces the destination address with the local PLCSIM handle, and pushes the payload into the PLCSIM data space through the Simatic application API. The reverse path is identical in the opposite direction.

Additional requirements:

• S7-PLCSIM V5.4 SP5 (or later) installed and licensed.
• STEP 7 V5.5 SP4 (or later) installed on the same workstation.
• The WinCC Flexible project compiled and downloaded to the panel is required in addition to the STEP 7 project; both must agree on the tag names and DB layout.
• The HMI panel must be a PROFINET-capable model: TP 177B/270/277, MP 177/277/370/377, Mobile Panel 277/370. S7-MPI-only panels (OP 73, OP 77A, TP 170A) cannot use NetToPLCSim because they lack an Ethernet interface.

NetToPLCSim Configuration Procedure

1. Install S7-PLCSIM and verify that it appears in the Accessible Nodes dialog of STEP 7 when the service is running.
2. Install NetToPLCSim as administrator; the installer places nettoplcsim.exe and the GUI shortcut on the desktop.
3. Disable the Windows Firewall on the engineering workstation, or open an inbound rule for TCP port 102 (and 2001 if used). Confirm with netstat -an | findstr :102 from an elevated command prompt.
4. Set the PG/PC Interface assignment to PLCSIM (TCP/IP) -> TCP/IP(Auto) in the Windows Control Panel applet.
5. Open the STEP 7 project, compile all blocks, and download the hardware configuration + blocks to the S7-PLCSIM instance.
6. Launch NetToPLCSim. In the main window, click Add and configure the entry:
   - IP address on network: workstation Ethernet IP (e.g., 192.168.0.10)
   - PLC (PLCSIM) address: 127.0.0.1
   - Rack: 0
   - Slot: 2 (S7-300) or 0 (S7-400)
   - Port: 102
7. Click Start Server. The status indicator turns green when the local listener is up.
8. In the WinCC Flexible project, open the panel connection editor, change the PLC address to the workstation Ethernet IP (192.168.0.10), and recompile.
9. Download the recompiled HMI project to the real panel using ProSave or WinCC Flexible's transfer dialog.
10. Power-cycle the panel so that the cached S7 connection from any previous commissioning session is released.
11. From the panel, start the runtime. The connection indicator should change from yellow "Connecting" to green "Connected" within 2-5 seconds. Verify the data path by toggling a bit in the STEP 7 PLCSIM Monitor/Modify view and observing the corresponding indicator on the panel.

Project Transfer Without WinCC Flexible

Three documented methods exist to transfer a compiled WinCC Flexible project (.fwx) to a panel without running the full WinCC Flexible engineering software on the field laptop. The methods are mutually compatible; engineering teams typically pick the one that matches the panel's available interfaces and the available tooling on site.

ProSave (Siemens service tool)

ProSave is the Siemens service utility bundled with WinCC Flexible 2008 SP5. It provides backup, restore, OS update, and project download over Ethernet, MPI/PROFIBUS, USB, or serial RS-232. ProSave is the recommended method for any team that needs to deploy to panels in the field without bringing the full ES laptop. The standalone installer is published under Siemens support article ID 22060254 at ProSave service tool download.

Pack & Go

Pack & Go is a WinCC Flexible export function that packages the compiled .fwx runtime plus a stripped-down transfer wizard into a single self-extracting file. The recipient PC does not need WinCC Flexible installed. The wizard restores the project to the panel using the same ProSave transfer logic.

Memory card transfer

On panels that support external storage (MP 277, MP 377, Mobile Panel 277, all Comfort Panel variants), the .fwx can be copied to a CF/SD/MMC card. The panel imports the project from the card through the Control Panel Service -> Project Transfer menu. No PC connection is required.

ProSave Transfer Procedure

1. Connect the field PC to the panel using a Cat-5 cable (cross-over or via switch) on the panel's PROFINET port.
2. Configure the PC Ethernet IP in the same subnet as the panel. Comfort Panels default to 192.168.0.10; the field PC may use 192.168.0.1.
3. From the panel Control Panel, navigate to Settings -> Transfer and enable Remote Control if the panel is in Run mode. The panel enters Transfer mode automatically on connection.
4. Launch ProSave from the Start menu (Siemens Automation -> ProSave). On first launch, accept the license terms.
5. From the device dropdown, select the panel model. The dropdown is filterable by part number (e.g., 6AV2 124-1GC01-0AX0 for a TP 177B 6").
6. Set the connection type to Ethernet, enter the panel IP address, and click Connect. ProSave reads back the panel model, firmware (image) version, and project name. The image version must equal or exceed the device version embedded in the .fwx.
7. Click Restore (or Download Project in newer builds), browse to the .fwx file, and confirm. ProSave also installs the matching license if one is bundled in the .fwx.
8. Wait for ProSave to report "Transfer complete". The panel reboots into the new runtime automatically.

Pack & Go Procedure

1. In WinCC Flexible on the engineering PC, open the project to be deployed.
2. Select Project -> Pack & Go. The dialog prompts for an output path and a runtime file selection.
3. WinCC Flexible creates a single self-extracting file (typically *.zip or *.exe) that contains the .fwx, any referenced graphics, and a transfer wizard built around ProSave.
4. Copy the file to the field PC (USB stick, network share, or remote access).
5. Double-click the file, accept the license prompt, and follow the wizard. The wizard presents the same ProSave UI flow described above but does not require WinCC Flexible to be installed.

Memory Card Transfer Procedure

1. Export the .fwx from WinCC Flexible: Project -> Transfer -> Memory Card, or manually copy the compiled file from the WinCC Flexible project folder.
2. Place the .fwx in the card's \Simatic\HMI\ directory. The directory name is case-insensitive on the panel but must match exactly.
3. Insert the card into the panel slot (MP 277/377: CF slot; Mobile Panel 277: CF slot; Comfort Panels: SD slot).
4. Open the panel Control Panel and navigate to Settings -> Service -> Project Transfer -> Source: Memory Card.
5. Select the project file and confirm the restore. The panel imports the project, prompts for reboot, and starts the new runtime.

Verification and Diagnostics

Troubleshooting Matrix

Field Commissioning Notes

• Always set a static IP on the engineering workstation; DHCP leases can change during a multi-day commissioning and silently break the NetToPLCSim listener.
• The Comfort Panel series (and the newer Unified family) is not supported by NetToPLCSim. For those panels, use PLCSIM in TIA Portal with the WinCC Runtime Simulator.
• For S7-400 simulation, the default slot is 0/0, not 0/2; mixing the two is the single most common commissioning failure on legacy STEP 7 V5.5 + PLCSIM V5.4 setups.
• Confirm the panel firmware version is compatible with the compiled .fwx before connecting the panel to the production bus. A mismatched image can trigger a hard reset and project loss.
• When using Pack & Go, the recipient's ProSave wizard can install a license only if the source .fwx contains a license container. License-only fields cannot be transferred by Pack & Go without the license container.
• NetToPLCSim is a community-maintained project. Production commissioning on a factory floor should always include a fall-back to a real S7 CPU for the final acceptance test.

Security and Licensing

WinCC Flexible requires a runtime license key installed on the panel. ProSave can transfer the license container as part of a project restore, or a license can be moved between panels with the Automation License Manager. S7-PLCSIM is licensed with STEP 7 Professional; a standalone PLCSIM license is also available for engineering seats that do not have STEP 7. NetToPLCSim does not require an additional license, but it does require a licensed PLCSIM instance on the same workstation.

Migration Path to TIA Portal

WinCC Flexible 2008 SP5 reached end of life in 2014. New projects should use TIA Portal WinCC Comfort (for Comfort Panels), WinCC Advanced (for higher-end Unified), or WinCC Professional. The TIA Portal "Migrate project" function converts a WinCC Flexible .hmi project to a TIA Portal .ap project, but only devices that are supported by the active TIA Portal HSP can be migrated. The HMI connection model in TIA Portal is documented at HMI connection (RT Unified).

For mixed-vintage fleets, the recommended sequence is: (1) freeze the WinCC Flexible project as a backup using ProSave on every panel, (2) commission the TIA Portal project against a real S7-1500 CPU on the bench, (3) schedule a production cut-over with the legacy panels as hot-spares for at least 30 days.