Edition 02/2024

FUNCTION MANUAL

SIMATIC
S7-1500
S7-PLCSIM Advanced

support.industry.siemens.com
 Introduction
1

Product overview
2

SIMATIC Installing
3

S7-PLCSIM Advanced Communication paths

4

Function Manual
Simulating
5

Virtual time response

6

Restrictions, messages, and

solution
7

List of abbreviations
A

V6.0 UPD1, 03/2024

A5E37039512-AG
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.

DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.

WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.

CAUTION
indicates that minor personal injury can result if proper precautions are not taken.

NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:

WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended or
approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.

Trademarks
All names identified by ® are registered trademarks of Siemens Aktiengesellschaft. The remaining trademarks in
this publication may be trademarks whose use by third parties for their own purposes could violate the rights of
the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.

Siemens Aktiengesellschaft A5E37039512-AG Copyright © Siemens 2024.

Digital Industries Ⓟ 02/2024 Subject to change All rights reserved
Postfach 48 48
90026 NÜRNBERG
GERMANY
Table of contents

1 Introduction........................................................................................................................................ 7
1.1 Using the S7-PLCSIM Advanced documentation................................................................. 8
1.2 Function Manuals documentation guide........................................................................... 10
1.3 Cybersecurity information................................................................................................. 14

2 Product overview ............................................................................................................................... 16

2.1 What is S7-PLCSIM Advanced? .......................................................................................... 16
2.2 S7-PLCSIM products.......................................................................................................... 17
2.3 Compatibility in case of updates........................................................................................ 18
2.4 Security for S7-PLCSIM Advanced...................................................................................... 19
2.5 Supporting simulation....................................................................................................... 20
2.6 Supported CPUs................................................................................................................ 21
2.7 Differences between a simulated and a real CPU................................................................ 22
2.7.1 Restrictions for all supported CPUs.................................................................................... 23
2.7.2 Notes............................................................................................................................... 24
2.8 Password to protect confidential configuration data.......................................................... 25

3 Installing............................................................................................................................................. 27
3.1 Introduction..................................................................................................................... 27
3.1.1 System requirements........................................................................................................ 27
3.1.2 Restrictions due to antivirus programs .............................................................................. 28
3.1.3 Licenses............................................................................................................................ 29
3.1.4 Trial License...................................................................................................................... 29
3.1.5 Functions for licenses....................................................................................................... 30
3.1.6 Installation log.................................................................................................................. 31
3.1.7 Contents of the S7-PLCSIM Advanced package................................................................... 31
3.2 Installing S7-PLCSIM Advanced.......................................................................................... 32
3.3 Changing an installation................................................................................................... 33
3.4 Repairing an installation.................................................................................................... 34
3.5 Uninstalling the product................................................................................................... 34

4 Communication paths........................................................................................................................ 36
4.1 Local communication ....................................................................................................... 37
4.2 Communication via TCP / IP............................................................................................... 38
4.2.1 Communication via TCP/IP in Single Adapter Network Mode (promiscuous mode).............. 38
4.2.2 Communication via TCP/IP in Multiple Adapter Network Mode (non-promiscuous .... 40
mode)

S7-PLCSIM Advanced
4 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Table of contents

4.2.3 Using a Software/Open Controller with a TCP/IP communication interface.......................... 43

4.3 Enable distributed communication ................................................................................... 44

5 Simulating.......................................................................................................................................... 47
5.1 Simulating a CPU.............................................................................................................. 47
5.1.1 Basic procedure for the simulation.................................................................................... 47
5.1.2 Control Panel - User interface............................................................................................ 48
5.1.2.1 S7-PLCSIM Advanced Symbol............................................................................................ 48
5.1.2.2 Control Panel quick view and window............................................................................... 48
5.1.2.3 S7-PLCSIM Advanced Control Panel................................................................................... 49
5.1.2.4 Importing instances.......................................................................................................... 54
5.1.3 Downloading a STEP 7 project........................................................................................... 55
5.1.4 Network addresses in the simulation................................................................................. 57
5.1.4.1 Siemens PLCSIM Virtual Ethernet Adapter.......................................................................... 57
5.1.4.2 S7-PLCSIM Advanced instances......................................................................................... 58
5.1.5 Simulate peripheral I/O..................................................................................................... 60
5.1.6 Simulate communication.................................................................................................. 60
5.1.6.1 Communication services that can be simulated................................................................. 60
5.1.6.2 Communication between instances................................................................................... 62
5.1.7 Provide project data offline for simulation ........................................................................ 62
5.2 Simulating a CPU with ODK functionality........................................................................... 64
5.2.1 Special features of ODK..................................................................................................... 64
5.2.2 Loading functions ............................................................................................................ 67
5.2.3 Calling functions............................................................................................................... 67
5.2.4 Unloading functions......................................................................................................... 68
5.4 Simulating the SIMATIC Drive Controller............................................................................ 70
5.5 Simulating a redundant S7-1500R/H system...................................................................... 71

6 Virtual time response......................................................................................................................... 74

6.1 Speed up and slow down simulation................................................................................. 75

7 Restrictions, messages, and solution................................................................................................. 76

7.1 OPC UA server................................................................................................................... 76
7.2 Web server....................................................................................................................... 76
7.3 Backing up and restoring the configuration of an S7-PLCSIM Advanced instance................ 77
7.4 Loading project data of an F-CPU to a standard CPU .......................................................... 77
7.5 Update of a TIA Portal project to a new CPU firmware........................................................ 78
7.6 Restrictions for storage paths............................................................................................ 78
7.7 Restrictions for instance names......................................................................................... 79
7.8 Restrictions for communications services........................................................................... 79
7.9 Restrictions for instructions............................................................................................... 79
7.10 Restrictions to local communication via Softbus................................................................ 79

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 5
Table of contents

7.11 Unknown data records...................................................................................................... 80

7.12 Messages for communication via TCP/IP............................................................................ 80
7.13 Time synchronization via NTP mode ................................................................................. 82
7.14 Restrictions of security with VMware vSphere Hypervisor (ESXi)......................................... 82
7.15 Restrictions for Hyper-V..................................................................................................... 83
7.16 Restrictions for AWS Cloud................................................................................................ 83
7.17 Monitoring overflow ........................................................................................................ 83
7.18 Deviating I/O values in the STEP 7 user program ............................................................... 84
7.19 Multiple simulations and possible collision of IP addresses................................................. 84
7.20 Lacking access to an IP address......................................................................................... 84
7.21 Simulation in standby mode.............................................................................................. 84
7.22 Time response of S7‑PLCSIM Advanced in connection with I/O systems.............................. 85
7.23 Simulation start of SIMIT with S7-PLCSIM Advanced........................................................... 85
7.24 Known restrictions when operating with a co-simulation, for example, SIMIT..................... 85
7.25 ET 200SP CPUs: Use of BusAdapters with fiber-optic interface............................................ 86
7.26 Installing SIMATIC NET...................................................................................................... 86
7.27 No simulation for configuration control............................................................................. 87
7.28 Restrictions for RT_INFO.................................................................................................... 87
7.29 Communication interface is not updated on the control panel when using an older API...... 88
7.30 Trace jobs with duplicate timestamps for motion OBs........................................................ 88
7.31 The control panel shows VPNs........................................................................................... 88
7.32 Downloading a central CP with S7-1500R/H CPU family using TCP/IP.................................. 88
7.33 Axis control panel functionality......................................................................................... 88

A List of abbreviations........................................................................................................................... 89

S7-PLCSIM Advanced
6 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
Introduction 1
Purpose of the documentation
This function manual describes the simulation software, SIMATIC S7‑PLCSIM Advanced. You
can use this software to simulate and test your SIMATIC STEP 7 programs on a simulated PLC
instance. You can also use an API to connect the simulated PLC instance to a system or
machine simulation (co-simulation).

Basic knowledge required

The software must only be used by qualified staff.
The following knowledge is required:
• Industrial Automation and Automation Technology
• Programming with STEP 7 (TIA Portal)
• SIMATIC CPUs and CPU programming
• PC-based automation using S7‑1500 and WinCC Runtime Advanced
• Knowledge of programming with C++ or C#
• PC technology
• Windows operating system

Conventions
STEP 7: In this documentation, "STEP 7" is used as a synonym for all versions of the
configuration and programming software "SIMATIC STEP 7 (TIA Portal)".
Also observe notes marked as follows:

NOTE
A note contains important information on the product described in the documentation, on
the handling of the product or on the section of the documentation to which particular
attention should be paid.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 7
Introduction
1.1 Using the S7-PLCSIM Advanced documentation

Scope
This function manual is valid for the following product variants:

Article number Product variants

6ES7823-1FA05-0YA5 SIMATIC S7‑PLCSIM Advanced V6.0
6ES7823-1FE05-0YA5 SIMATIC S7‑PLCSIM Advanced V6.0 Download
6ES7823-1FA05-0YE5 SIMATIC S7‑PLCSIM Advanced V6.0 Upgrade V1.0 -> V6.0
6ES7823-1FE05-0YE5 SIMATIC S7‑PLCSIM Advanced V6.0 Upgrade V1.0 -> V6.0 Download
6ES7823-1FE05-0YA7 SIMATIC S7‑PLCSIM Advanced V6.0 POC
6ES7823-1FE00-0YN5 SIMATIC S7‑PLCSIM Advanced Subscription Download
The articles each contain one license, which is valid for two instances.

NOTE
You can obtain online readme updates to the function manual on the Internet
(https://support.industry.siemens.com/cs/us/en/view/109824282).

Application examples
You can find the following application examples for S7‑PLCSIM Advanced on the Internet:
• SIMATIC S7‑PLCSIM Advanced: Co-Simulation via API
(https://support.industry.siemens.com/cs/ww/de/view/109739660/en)
• Digitalization with TIA Portal: Virtual commissioning with SIMATIC and Simulink
(https://support.industry.siemens.com/cs/ww/en/document/109749187)

Recycling and disposal

For environmentally sustainable recycling and disposal of your old equipment, contact a
certified electronic waste disposal service and dispose of the equipment according to the
applicable regulations in your country.

Industry Mall
The Industry Mall (https://mall.industry.siemens.com) is the catalog and order system of
Siemens AG for automation and drive solutions on the basis of Totally Integrated Automation
(TIA) and Totally Integrated Power (TIP).

1.1 Using the S7-PLCSIM Advanced documentation

The S7-PLCSIM Advanced Function Manual and API Manual are HTML5 Web sites. HTML5 Web
sites have advantages for screen viewing on a variety of devices.

S7-PLCSIM Advanced
8 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Introduction
1.1 Using the S7-PLCSIM Advanced documentation

Navigating
When you open an HTML5 Web site, click Begin from the Start page.
The table of contents displays on the left. Each chapter collapses as you navigate from one
chapter to the next to optimize screen space on devices such as phones and tablets. You can
also click the button to hide the table of contents. Click to restore it.
Left and right arrow buttons allow to navigate back and forward through topics that you have
previously viewed:
Previous and next page buttons allow you to navigate sequentially through topics and
chapters in the order of the table of contents:

Searching
To search an HTML5 Web site, click the button on the right. When you enter your search
text, you see a list of topics that contain the search text. Click any topic to view it. The page
highlights occurrences of the matched search text.
To see where the topic exists in the table of contents, click the button to switch from the
search view to the table of contents view. To switch back to your search, click again. The
search functions much the same as any search from a Web browser. Ctrl+F searches within
the displayed topic.

Changing the language

If an HTML5 Web site includes multiple languages, click the button to switch to another
language.

Accessing documentation online in other formats

Documentation for this product is available at Siemens Industry Online Support
(//https://support.industry.siemens.com/). Formats include the following for display or
download:
• PDF document
• Multimedia document (HTML5 Web site)
• Website with chapter structure (display only, useful for providing a specific topic link to
other people)
From the Web site, search for your product name. Filter the search results by manuals if you
are only looking for documentation. For your product, select the edition that corresponds to
the version of your product. You can switch the display language for the page and the
documents from the menu.
The various document formats provide navigation and search features based on their
documentation format.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 9
Introduction
1.2 Function Manuals documentation guide

1.2 Function Manuals documentation guide

The documentation for the SIMATIC S7‑1500 automation system, for the 1513/1516pro-2 PN,
SIMATIC Drive Controller CPUs based on SIMATIC S7‑1500 and the SIMATIC ET 200MP,
ET 200SP, ET 200AL and ET 200eco PN distributed I/O systems is arranged into three areas.
This arrangement enables you to access the specific content you require.
You can download the documentation free of charge from the Internet
(https://support.industry.siemens.com/cs/ww/en/view/109742705).

Basic information
The system manuals and Getting Started describe in detail the configuration, installation,
wiring and commissioning of the SIMATIC S7‑1500, SIMATIC Drive Controller, ET 200MP,
ET 200SP, ET 200AL and ET 200eco PN systems. Use the corresponding operating instructions
for 1513/1516pro-2 PN CPUs.
The STEP 7 online help supports you in the configuration and programming.
Examples:
• Getting Started S7-1500
• System manuals
• Operating instructions ET 200pro and 1516pro-2 PN CPU
• Online help TIA Portal

Device information
Equipment manuals contain a compact description of the module-specific information, such
as properties, wiring diagrams, characteristics and technical specifications.
Examples:
• Equipment manuals for CPUs
• Equipment manuals for interface modules
• Equipment manuals for digital modules
• Equipment manuals for analog modules
• Equipment manuals for communication modules
• Equipment manuals for technology modules
• Equipment manuals for power supply modules
• Equipment manuals for BaseUnits

General information
The function manuals contain detailed descriptions on general topics relating to the
SIMATIC Drive Controller and the S7-1500 automation system.
Examples:
• Function Manual Diagnostics
• Function Manual Communication
• Function Manuals Motion Control
• Function Manual Web Server
• Function Manual Cycle and Response Times
• PROFINET Function Manual
• PROFIBUS Function Manual

S7-PLCSIM Advanced
10 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Introduction
1.2 Function Manuals documentation guide

Product Information
Changes and supplements to the manuals are documented in a Product Information. The
Product Information takes precedence over the device and system manuals.
You will find the latest Product Information on the Internet:
• S7-1500/ET 200MP (https://support.industry.siemens.com/cs/de/en/view/68052815)
• SIMATIC Drive Controller
(https://support.industry.siemens.com/cs/de/en/view/109772684/en)
• Motion Control (https://support.industry.siemens.com/cs/de/en/view/109794046/en)
• ET 200SP (https://support.industry.siemens.com/cs/de/en/view/73021864)
• ET 200eco PN (https://support.industry.siemens.com/cs/ww/en/view/109765611)

Manual Collections
The Manual Collections contain the complete documentation of the systems put together in
one file.
You will find the Manual Collections on the Internet:
• S7-1500/ET 200MP/SIMATIC Drive Controller
(https://support.industry.siemens.com/cs/ww/en/view/86140384)
• ET 200SP (https://support.industry.siemens.com/cs/ww/en/view/84133942)
• ET 200AL (https://support.industry.siemens.com/cs/ww/en/view/95242965)
• ET 200eco PN (https://support.industry.siemens.com/cs/ww/en/view/109781058)
The tools described below support you in all steps: from planning, over commissioning, all
the way to analysis of your system.

TIA Selection Tool

The TIA Selection Tool (https://support.industry.siemens.com/cs/ww/en/view/109767888)
supports you in the selection, configuration, and ordering of devices for Totally Integrated
Automation (TIA).
As successor of the SIMATIC Selection Tools, the TIA Selection Tool assembles the already
known configurators for automation technology into a single tool.
With the TIA Selection Tool, you can generate a complete order list from your product
selection or product configuration.

SIMATIC Automation Tool

You can use the SIMATIC Automation Tool
(https://support.industry.siemens.com/cs/ww/en/view/98161300) to perform commissioning
and maintenance activities on various SIMATIC S7 stations as bulk operations independent of
TIA Portal.
The SIMATIC Automation Tool offers a wide range of functions:
• Scanning of a PROFINET/Ethernet system network and identification of all connected CPUs
and devices
• Assignment of addresses (IP, subnet, Gateway) and device name (PROFINET device) to a
CPU
• Transfer of the date and the programming device/PC time converted to UTC time to the
module
• Program download to CPU
• RUN/STOP mode switchover
• CPU identification by flashing LEDs
• Reading CPU error information

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 11
Introduction
1.2 Function Manuals documentation guide

• Reading the CPU diagnostic buffer

• Resetting to factory settings
• Firmware update of the CPU and connected modules

PRONETA
SIEMENS PRONETA (PROFINET network analysis) is a commissioning and diagnostic tool for
PROFINET networks. PRONETA Basic
(https://support.industry.siemens.com/cs/ww/en/view/67460624) has two core functions:
• In the network analysis, you get an overview of the PROFINET topology. Compare a real
configuration with a reference installation or make simple parameter changes, e.g. to the
names and IP addresses of the devices.
• The "IO test" is a simple and rapid test of the wiring and the module configuration of a
plant, including documentation of the test results.
SIEMENS PRONETA Professional (https://www.siemens.com/proneta-professional) is a
licensed product that offers you additional functions. It offers you simple asset management
in PROFINET networks and supports operators of automation systems in automatic data
collection/acquisition of the components used through various functions:
• The user interface (API) offers an access point to the automation cell to automate the scan
functions using MQTT or a command line.
• With PROFIenergy diagnostics, you can quickly detect the current pause mode or the
readiness for operation of devices that support PROFIenergy and change these as needed.
• The data record wizard supports PROFINET developers in reading and writing acyclic
PROFINET data records quickly and easily without PLC and engineering.

SINETPLAN
SINETPLAN (https://new.siemens.com/global/en/products/automation/industrial-
communication/profinet/sinetplan.html), the Siemens Network Planner, supports you in
planning automation systems and networks based on PROFINET. The tool facilitates
professional and predictive dimensioning of your PROFINET installation as early as in the
planning stage. In addition, SINETPLAN supports you during network optimization and helps
you to exploit network resources optimally and to plan reserves. This helps to prevent
problems in commissioning or failures during productive operation even in advance of a
planned operation. This increases the availability of the production plant and helps improve
operational safety.
The advantages at a glance
• Network optimization thanks to port-specific calculation of the network load
• Increased production availability thanks to online scan and verification of existing systems
• Transparency before commissioning through importing and simulation of existing STEP 7
projects
• Efficiency through securing existing investments in the long term and the optimal use of
resources

TIA Portal Test Suite Advanced

TIA Portal Test Suite Advanced
(https://support.industry.siemens.com/cs/ww/en/view/109813414) supports quality assurance
of automation programs in the TIA Portal.

S7-PLCSIM Advanced
12 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Introduction
1.2 Function Manuals documentation guide

It contains the following tools for checking the programming style and for creating test
routines for software modules:
• Styleguide Checker: Ensures a unified programming style by enabling you to define rule
sets with programming guidelines in the TIA Portal project.
You can regularly check compliance to the rule sets.
• Application test: Checks the correct processing of individual logic blocks or entire S7-1500
applications.
It also enables you to create test routines in a TIA Portal project. You can subsequently
execute the tests and validate the results with the help of S7-PLCSIM Advanced.
• System test: Allows you to define and execute test cases for a PLC program using OPC UA
server interfaces.
You can use System test to perform the following tests:
– Hardware-in-the-loop tests with S7-1200 and S7-1500
– Software-in-the-loop tests with PLCSIM Advanced
Additional SIMATIC documents will complete your information. You can find these
documents and their use at the following links and QR codes.
The Industry Online Support gives you the option to get information on all topics. Application
examples support you in solving your automation tasks.

Overview of the SIMATIC Technical Documentation

Here you will find an overview of the SIMATIC documentation available in Siemens Industry
Online Support:

Industry Online Support International

(https://support.industry.siemens.com/cs/ww/en/view/109742705)

Watch this short video to find out where you can find the overview directly in Siemens
Industry Online Support and how to use Siemens Industry Online Support on your mobile
device:
Quick introduction to the technical documentation of automation products per
video (https://support.industry.siemens.com/cs/us/en/view/109780491)

YouTube video: Siemens Automation Products - Technical Documentation at a

Glance (https://youtu.be/TwLSxxRQQsA)

mySupport
With "mySupport" you can get the most out of your Industry Online Support.

Registration You must register once to use the full functionality of "mySupport". After registra­
tion, you can create filters, favorites and tabs in your personal workspace.
Support requests Your data is already filled out in support requests, and you can get an overview of
your current requests at any time.
Documentation In the Documentation area you can build your personal library.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 13
Introduction
1.3 Cybersecurity information

Favorites You can use the "Add to mySupport favorites" to flag especially interesting or fre­
quently needed content. Under "Favorites", you will find a list of your flagged
entries.
Recently viewed The most recently viewed pages in mySupport are available under "Recently viewed
articles articles".
CAx data The CAx data area gives you access to the latest product data for your CAx or CAe
system. You configure your own download package with a few clicks:
• Product images, 2D dimension drawings, 3D models, internal circuit diagrams,
EPLAN macro files
• Manuals, characteristics, operating manuals, certificates
• Product master data
You can find "mySupport" on the Internet. (https://support.industry.siemens.com/My/ww/en)

Application examples
The application examples support you with various tools and examples for solving your
automation tasks. Solutions are shown in interplay with multiple components in the system -
separated from the focus on individual products.
You can find the application examples on the Internet.
(https://support.industry.siemens.com/cs/ww/en/ps/ae)

1.3 Cybersecurity information

Siemens provides products and solutions with industrial cybersecurity functions that support
the secure operation of plants, systems, machines, and networks.
In order to protect plants, systems, machines, and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
cybersecurity concept. Siemens’ products and solutions constitute one element of such a
concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be connected
to an enterprise network or the internet if and to the extent such a connection is necessary
and only when appropriate security measures (e.g. firewalls and/or network segmentation)
are in place.
For more information on protective industrial cybersecurity measures for implementation,
please visit (https://www.siemens.com/global/en/products/automation/topic-areas/industrial-
cybersecurity.html).
Siemens' products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends that product updates are applied as soon as they are
available and that the latest product versions are used. Use of product versions that are no
longer supported, and failure to apply the latest updates may increase customers' exposure to
cyber threats.
To stay informed about product updates at all times, subscribe to the Siemens Industrial
Cybersecurity RSS Feed under
(https://new.siemens.com/global/en/products/services/cert.html).

S7-PLCSIM Advanced
14 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Introduction
1.3 Cybersecurity information

NOTE
Administrator rights
For normal operation, the standard user rights are sufficient. You need administrator rights
only when you install or repair S7‑PLCSIM Advanced or change the network configuration.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 15
Product overview 2
2.1 What is S7-PLCSIM Advanced?
You use S7‑PLCSIM Advanced to simulate your CPU programs on a simulated PLC instance.
You do not need any real controllers for simulation. You configure your CPU with STEP 7 in
TIA Portal, program your application logic and then load the hardware configuration and the
program into the simulated CPU. From STEP 7, you run your program logic, monitor the
effects of simulated inputs and outputs, and adapt your programs.
In addition to communication via Softbus, which limits communication to a local PC or virtual
machine, S7‑PLCSIM Advanced offers a full Ethernet connection and thus also supports
distributed I/O systems.
S7‑PLCSIM Advanced also includes an application programming interface (API), which enables
interaction with native C++/C# programs or simulation software. The API extends simulation
capabilities and provides features such as the following:
• Simulation of hardware interrupts
• Stopping a simulation
• Synchronization with simulation partners
For these and other API functions, refer to the S7‑PLCSIM Advanced API manual included with
your release.

Application areas
Typical application areas of S7‑PLCSIM Advanced are:
• Verification of the user program (TIA Portal)
• Testing of the STEP 7 program
• Software in the loop simulation for the virtual commissioning of machine tools/production
machines, production cells, and production lines in a plant.
• Operator training through the connection of a real HMI

Advantages
S7‑PLCSIM Advanced offers numerous advantages:
• Improve the quality of automation projects by early error detection
• Avoid costs for hardware in simulation environments
• Shorten commissioning time
• Reduce risk for commissioning
• Train operators earlier
• Increase production efficiency by optimizing program components
• Increase efficiency during replacement of machine components
• Increase efficiency during expansion of existing plants

S7-PLCSIM Advanced
16 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Product overview
2.2 S7-PLCSIM products

2.2 S7-PLCSIM products

Comparison of S7‑PLCSIM Advanced V6.0, S7‑PLCSIM V19, and S7‑PLCSIM V5.x

Function S7‑PLCSIM Advanced V6.0 S7‑PLCSIM V19 S7‑PLCSIM V5.x

Runtime Independent Programming with STEP 7 Programming with STEP 7
User interface S7‑PLCSIMAdvanced Control S7‑PLCSIM UI Look&Feel of STEP 7 V5.x
Panel
Communication Softbus 4, TCP/IP Softbus 4 Softbus 4
Supported CPU families S7‑1500 (C, T, F), S7-1500R/H, S7-1200 (F), S7-1500 (C, T, F), S7‑300, S7‑300F,
SIMATIC Drive Controller, 1500R/H, S7‑400, S7‑400F
ET 200SP, ET 200SP F, SIMATIC Drive Controller,
ET 200pro, ET 200pro F, ET 200SP, ET 200SP F,
SIPLUS CPUs (S7-1500; Stand­ SIPLUS CPUs (S7-1500; Stand­
ard and F-CPUs, S7-1500R/H ard and F-CPUs, S7-1500R/H
and ET 200SP; Standard and F- and ET 200SP; Standard and F-
CPUs) CPUs)
Software/Open Controller Software/Open Controller
API for co-simulation1 ✓ - -
Web server ✓ via TCP/IP - -
ODK ✓ - -
OPC UA ✓ via TCP/IP - -
Process diagnostics ✓ ✓ -
S7 communication ✓ Using Softbus Using Softbus
Open user communication ✓ UDP via TCP/IP Using Softbus -
Secure Communication ✓ via TCP/IP - -
Traces2 ✓ - -
Motion ✓ ✓3 -
Protected blocks (KHP) ✓ ✓ for S7-1500 CPUs only -
Multiple instances Up to 16 Up to 2 -
Support of distributed ✓ via TCP/IP - -
instances
Virtual time ✓ - -
Connection of real CPUs/HMIs ✓ via TCP/IP - -
DHCP/DNS use ✓ via TCP/IP - -
Virtual memory card ✓ - -
Communication between the - S7‑PLCSIM as of V12 and S7‑PLCSIM V5.x can be installed and
instances operated on the same PC or the same virtual machine.
1 Via C++ and C# programs and simulation software
2 Can be monitored with S7‑PLCSIM V16 and higher in the TIA Portal; can also be monitored with S7‑PLCSIM Advanced V3.0
and higher on the Web server.
3 With S7‑PLCSIM V16 and higher, the axes are always in simulation mode irrespective of the axis configuration.
4 You can find more information on Softbus (online access PLCSIM) in the "Communication" section.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 17
Product overview
2.3 Compatibility in case of updates

Function S7‑PLCSIM Advanced V6.0 S7‑PLCSIM V19 S7‑PLCSIM V5.x

Communication between the - Instances of S7‑PLCSIM as of V12 can communicate via Soft­
instances bus with S7‑PLCSIM V5.x.
S7‑PLCSIM Advanced V3.0 and higher and S7‑PLCSIM V15 and -
higher can be installed and operated on the same PC or the
same virtual machine. The communication between the two
applications cannot be simulated.
S7‑PLCSIM V5.4 SP8 is automatically installed with S7‑PLCSIM Advanced. The communication
between the two applications can be simulated. Instances of S7‑PLCSIM Advanced can com­
municate via Softbus with S7‑PLCSIM ≥ V5.4 SP8.
1 Via C++ and C# programs and simulation software
2 Can be monitored with S7‑PLCSIM V16 and higher in the TIA Portal; can also be monitored with S7‑PLCSIM Advanced V3.0
and higher on the Web server.
3 With S7‑PLCSIM V16 and higher, the axes are always in simulation mode irrespective of the axis configuration.
4 You can find more information on Softbus (online access PLCSIM) in the "Communication" section.

2.3 Compatibility in case of updates

When you install S7‑PLCSIM Advanced, you update any earlier version to the current version.

Compatibility with TIA Portal and with CPU firmware versions

A simulated PLC instance in S7‑PLCSIM Advanced corresponds to that of a
CPU S7‑15xx V3.1.1.
These CPUs are compatible to the TIA Portal versions V14 to V19.

NOTE
Password encryption in case of updates
When a TIA Portal project is updated from CPU firmware version < V2.0 to CPU firmware
version ≥ V2.0, the following error message is displayed during a download of the project to
SIMATIC S7‑PLCSIM Advanced:
"Loading of hardware configuration failed (0020 -3 2 0). Please check the diagnostic buffer of
the target hardware."
To successfully download such a project to SIMATIC S7‑PLCSIM Advanced, click the "Update
password encryption" button while updating the project.

S7-PLCSIM Advanced
18 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Product overview
2.4 Security for S7-PLCSIM Advanced

2.4 Security for S7-PLCSIM Advanced

Restrictions for security

S7‑PLCSIM Advanced does not provide options for authentication and authorization.
Communication is not protected by authentication.
Communication
• The multi-computer simulation communication is not encrypted.
• A TCP/IP port is opened on the PC for cross-network communication.
• The installed Npcap program library provides access to TCP/IP network communication.

NOTE
For cross-computer communication, use a closed simulation network that is not connected to
a production network.

Know-how protection

NOTE
Know-how protected blocks
If know-how-protected blocks for the simulation support are enabled, the know-how
protection is limited.

NOTE
CPU function libraries for ODK
The SO files (shared object files) for ODK are not know-how-protected. The customer is
responsible for the SO files and its know-how protection.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 19
Product overview
2.5 Supporting simulation

2.5 Supporting simulation

Requirement for simulation

NOTE
Enable simulation capability
To use a STEP 7 project with simulation, you must select the "Support simulation during block
compilation" option in the "Protection" tab in the properties of the project and confirm with
OK.

Know-how protection
If a know-how-protected block is to be used for the simulation, it must be unlocked by
entering a password.
After you have unlocked the know-how-protected block, you can activate the option "Can be
simulated with SIMATIC S7‑PLCSIM". You will find the option in the properties of the block in
the "General > Compilation" tab.
Additional information can be found on the Internet
(https://support.industry.siemens.com/cs/ww/en/view/109754928).

Global libraries
You cannot use know-how protection with global libraries, because the libraries are write-
protected.
The "Can be simulated with SIMATIC S7‑PLCSIM" option must be set when generating the
blocks (source of the blocks).

S7-PLCSIM Advanced
20 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Product overview
2.6 Supported CPUs

2.6 Supported CPUs

Supported CPUs from the S7‑1500 family

S7‑PLCSIM Advanced supports the simulation of the following CPUs:
Table 2-1 Supported CPUs
Type Firmware version V1.8 to V3.1.1
Standard Fail-safe
CPUs1 CPU 1511‑1 PN CPU 1511F‑1 PN
CPU 1513‑1 PN CPU 1513F‑1 PN
CPU 1515‑2 PN CPU 1515F‑2 PN
CPU 1516‑3 PN/DP CPU 1516F‑3 PN/DP
CPU 1517‑3 PN/DP CPU 1517F‑3 PN/DP
CPU 1518‑4 PN/DP CPU 1518F‑4 PN/DP
CPU 1518-4 PN/DP ODK CPU 1518F-4 PN/DP ODK
CPU 1518-4 PN/DP MFP CPU 1518F-4 PN/DP MFP
Compact CPUs2 CPU 1511C‑1 PN -
CPU 1512C‑1 PN
ET 200SP CPUs1 CPU 1510SP-1 PN CPU 1510SP F-1 PN
CPU 1512SP-1 PN CPU 1512SP F-1 PN
CPU 1514SP-2 PN CPU 1514SP F-2 PN
CPU 1514SP T-2 PN CPU 1514SP TF-2 PN
CPU 1514PA-2 PN CPU 1515SP PC2 (F/TF)4
CPU 1515SP PC2 (T)4
Technology CPUs CPU 1511T-1 PN CPU 1511TF-1 PN
CPU 1515T-2 PN CPU 1515TF-2 PN
CPU 1516T-3 PN/DP CPU 1516TF-3 PN/DP
CPU 1517T-3 PN/DP CPU 1517TF-3 PN/DP
CPU 1518T-4 PN/DP CPU 1518TF-4 PN/DP
R/H-CPUs2 CPU 1513R-1 PN CPU 1518HF-4 PN
CPU 1515R-2 PN
CPU 1517H-3 PN
ET 200pro CPUs CPU 1513pro-2 PN CPU 1513pro F-2 PN
CPU 1516pro-2 PN CPU 1516pro F-2 PN
SIMATIC Drive Controller CPU 1504D TF
CPU 1507D TF
S7-1500 Software/Open Controller3 CPU 1505SP CPU 1505SP F
CPU 1505SP T CPU 1505SP TF
CPU 1507S CPU 1507SP F
CPU 1508S CPU 1508S F
1 SIPLUSand SIPLUS RAIL CPUs are supported. They are of the same design as the standard and fail-safe CPUs listed here with
their own article numbers.
2 The on-board I/O of the CPUs is not simulated. The simulation interface corresponds to the process image.
3 Versions 30.0 and 30.1. STEP 7 only simulates the S7-1500 Software Controller. PC station configuration is not supported.
User must set the IP address of the network interface on the simulated PLC to match the STEP 7 project. If you change the
firmware version in the STEP 7 project, you must delete the simulated PLC instance at the former version and simulate a
new PLC instance for the changed version. You can then download from the TIA Portal to the new instance.
4 Open Controller

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 21
Product overview
2.7 Differences between a simulated and a real CPU

Unsupported CPUs
S7‑PLCSIM Advanced does not simulate S7‑1200 CPUs.
To simulate CPUs of the S7-1200 product family, use S7‑PLCSIM
(https://support.industry.siemens.com/cs/ww/en/view/109814755).
If you download a TIA Portal project whose configuration includes an unsupported CPU, the
following error message appears:
"Loading of hardware configuration failed (0020 -3 2 0). Please check the diagnostic buffer of
the target hardware."

2.7 Differences between a simulated and a real CPU

A simulated PLC instance cannot fully simulate a real CPU down to the individual details. Even
if a program is downloaded without errors to the CPU and running successfully, this does not
necessarily mean that the simulated CPU behaves exactly like a real CPU.

Deterministic
S7‑PLCSIM Advanced runs on a PC with the Windows operating system. The scan cycle time
and the exact time of actions in S7‑PLCSIM Advanced are not the same as when these actions
run on physical hardware. This is because several programs share the processing resources on
your PC.
To provide the best possible deterministic behavior under these conditions,
S7‑PLCSIM Advanced requires one free Core (CPU core) per instance. Information on the
minimum requirements for the computer hardware or a virtual machine can be found in the
section System Requirements.
If your program depends heavily on the time required to execute actions, then make sure that
you do not evaluate your program based only on the results of the simulation time.

Know-how protection
Projects with know-how protection for blocks can only be simulated if they are enabled for
simulation. You need the block password for this purpose.

Instructions
Instructions are simulated with a few exceptions, see Restrictions for instructions (Page 79).
Programs that are based on the instructions behave differently than real CPUs in the
simulation.

Display of the quantity structure

In STEP 7, the maximum quantity structure based on the CPU 1518TF-4 PN/DP is shown in the
project tree under "Program information" for all the CPUs. The maximum quantity structure of
the simulated CPU is displayed under "Online & Diagnostics".
For simulated Software and Open Controllers, the maximum quantity structure is based on
the CPU 1508S TF. The retentive memory is the NVRAM option (410Kb).

S7-PLCSIM Advanced
22 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Product overview
2.7 Differences between a simulated and a real CPU

S7-1500R/H
For communication with other devices, you can configure system IP addresses in STEP 7 for a
redundant S7-1500R/H system.

2.7.1 Restrictions for all supported CPUs

Fieldbus systems
S7‑PLCSIM Advanced does not simulate fieldbus systems (PROFINET IO, PROFIBUS DP).

Intelligent I/O devices (I-devices)

S7‑PLCSIM Advanced does not simulate I-Device functionality.

I/O
S7‑PLCSIM Advanced simulates the real CPU, but not configured I/O modules and the on-
board I/O of the compact CPUs.

Removal and insertion

In contrast to real systems, S7‑PLCSIM Advanced allows the removal and insertion of head
modules in distributed I/O systems.

Communications modules and communications processors

S7‑PLCSIM Advanced does not support CMs and CPs and the related features such as "Access
to PLC via communications module".

Diagnostics / diagnostic alarms

The S7‑PLCSIM Advanced control panel does not enable simulation of diagnostic buffer
entries.

Online and diagnostic functions

Certain online and diagnostic functions (e.g. the "Firmware update" function) are not
supported.

Copy protection
S7‑PLCSIM Advanced does not simulate copy protection.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 23
Product overview
2.7 Differences between a simulated and a real CPU

Limited support
S7‑PLCSIM Advanced simulates some functions to a limited extent. You can find an overview
in the section Restrictions, messages, and solution (Page 76).

2.7.2 Notes

Password applied during CPU swap

Depending on the firmware version of the CPUs affected (the CPU to be replaced and the
replacement CPU), you are either offered an update to the latest algorithm or prompted to
assign a new password because the replacement CPU cannot use the existing password
configuration.
If the CPU to be replaced and the replacement CPU are identical in terms of the algorithm
used, no action is required: the password configuration and the other parameter settings are
transferred.
S7‑PLCSIM Advanced does not support any password encryption for CPU versions with
firmware less than V2.0.
In order to use protection levels, the Web server and the access protection of the F‑CPU in the
simulation, click on the "Update password encryption" button. The button is located in the
CPU properties in the "Protection & Security" tab under "Access level".

HMI devices and CPU protection levels

• S7‑PLCSIM Advanced supports SIMATIC HMI devices as of version 14. Connections to
SIMATIC HMI devices prior to V14 are not supported.
• S7‑PLCSIM Advanced supports protection levels if the virtual S7‑1500 controller is
configured with a firmware version V2.0 or higher.
• It is possible to connect SIMATIC HMI devices as of V14 to virtual S7‑1500 controllers that
are configured with a firmware version V2.0 or higher, with or without protection levels.
• It is possible to connect SIMATIC HMI devices as of V14 to virtual S7‑1500 controllers
which are configured with a firmware version lower than V2.0 without protection levels.

Solution
To establish a connection to the SIMATIC HMI device V13 or earlier, you must update this
SIMATIC HMI device to version V14.
To establish a connection from the simulated PLC instance that is configured with a CPU
firmware version lower than V2.0 to the SIMATIC HMI device, you must remove existing
protection levels from the project.

Safety system versions

To successfully simulate and test a project with fail-safe input and output modules, you need
to use safety system version V1.6, V2.0, V2.1, V2.2, V2.3, V2.4, V2.5, or V2.6. Simulation of
the fail-safe input and output modules does not work correctly with an older version.

Technology module TM Count - Error message of instruction High_Speed_Counter

When you are using S7‑PLCSIM Advanced for the simulation of a high-speed counter in a
TM Count technology module, the instruction High_Speed_Counter signals an error 16#80C7.

S7-PLCSIM Advanced
24 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Product overview
2.8 Password to protect confidential configuration data

The instruction High_Speed_Counter expects that the module has set a bit for "Status ready"
(STS_READY). Because S7‑PLCSIM Advanced does not simulate the module behavior, the
instruction signals an error.
The STS_READY bit is located in the input area of the module at offset 13.4. When the input
area of your TM Count module starts at %I32, for example, the STS_READY bit is located at
%I45.4.
To prevent this error message of the High_Speed_Counter instruction, set the STS_READY bit
accordingly.

2.8 Password to protect confidential configuration data

As of STEP 7 V17, you have the option of assigning a password to protect confidential
configuration data of the respective CPU as of FW version V2.9. This refers to data such as
private keys that are required for the proper functioning of certificate-based protocols.

Assign a password to protect confidential configuration data

You assign the password in STEP 7, in the CPU properties, in the area "Protection & Security >
Protection of the PLC configuration data".
You can use the same password for an S7‑PLCSIM Advanced instance as for the real CPU. This
makes it easier for you to assign it uniquely.
S7‑PLCSIM Advanced stores the password encrypted in a file on the virtual memory card. The
handling of the password is the same as with the real CPU.
Only the current, active Windows user and no other user is allowed to read the password for
the protection of confidential configuration data on the computer.

NOTE
Note that your Windows password protects the password used to protect confidential
configuration data. Therefore, do not share the Windows password with other, untrustworthy
users.

Detailed information on the protection of confidential configuration data and on secure

communication can be found in the Communication function manual
(https://support.industry.siemens.com/cs/ww/en/view/59192925).

Resetting to factory settings

A reset to factory settings causes the instance to start in fault mode under these
circumstances:
• The CPU instance is protected with a password to protect PLC confidential data.
• You perform a reset to factory settings and select only the option "Delete password for
protection of confidential PLC configuration data".
The instance is in fault mode because the password is missing. You cannot make an online
connection or download to the instance.
You must reset the CPU instance with the "Format memory card" selection. With this
selection, the instance is not in fault after the reset to factory settings. The storage is,
however, cleared out.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 25
Product overview
2.8 Password to protect confidential configuration data

Moving the virtual SIMATIC memory card to another virtual machine, for example, SIMIT
If you have not set a password to protect confidential configuration data, there are no
restrictions on move operations.
If you have specified the password to protect confidential configuration data, the following
restriction applies:
When you move the virtual memory card from one computer to another, you cannot start the
S7‑PLCSIM Advanced instance on the new system.

NOTE
To ensure maximum security on your systems, the password for protecting confidential
configuration data is not available on a new system. You must reset the password again in
the new system.

Solution:
The computer is part of an Active Directory.
The password encryption is linked to the Windows user. When you use the same Active
Directory user in your domain on another computer, you can start S7‑PLCSIM Advanced
instances there.

When SIMIT archives the virtual SIMATIC memory card as a ZIP file and another user/computer is
trying to restart this simulation
To recover from this situation, follow these steps:
1. Remove the password for protecting confidential configuration data from the STEP 7
project.
2. Load the project to the simulated PLC instance.
You can move the virtual memory card to other computers without any restrictions.

Switching on the S7‑PLCSIM Advanced instance without a valid password

When you switch on an instance and the password for the protection of confidential
configuration data is incorrect, the instance restarts automatically and switches to STOP
mode. The ERROR LED flashes red.

S7-PLCSIM Advanced
26 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
Installing 3
3.1 Introduction

3.1.1 System requirements

For S7‑PLCSIM Advanced to operate efficiently, the following minimum requirements for
computer hardware or for a virtual machine must be met.
Hardware Virtual machine
Processor • At least one core Intel® Core™ i7 6th Gen­ • One virtual CPU per started instance has
eration or one x86 processor from another to be assigned to the VM.
manufacturer per instance started. • A corresponding number of processors
• At least one additional core for the operat­ has to be physically available on the host.
ing system • At least one additional core for the operat­
• At least one additional core for the addi­ ing system
tional active applications • At least one additional core for the addi­
tional active applications
• At least two cores, if STEP 7 (TIA Portal) is
installed on the VM
RAM • 1 GB per started instance • 1 GB per started instance
• At least 4 GB for the Windows operating • At least 4 GB for the Windows operating
system system
• Additional RAM corresponding to the • Additional RAM corresponding to the
requirements of the remaining active requirements of the remaining active
applications applications
• At least 8 GB, if STEP 7 (TIA Portal) is
installed on the VM
Free hard disk space 5 GB 5 GB
Screen resolution Minimum 1024 x 768 Minimum 1024 x 768

Operating systems and virtualization platforms

S7‑PLCSIM Advanced supports the same operating systems, virtualization, and hard disk
encryption technology as the corresponding STEP 7 Basic version., with the exception of the
Windows Home operating systems. S7‑PLCSIM does not support the Windows Home
operating systems. See the TIA Portal Information System for a full list of supported
technologies.
Refer to online information (https://support.industry.siemens.com/cs/ww/en/view/78788417)
for installing STEP 7 (TIA Portal) and S7‑PLCSIM Advanced on a virtual machine.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 27
Installing
3.1 Introduction

3.1.2 Restrictions due to antivirus programs

NOTICE
Restrictions due to virus scanners and Advanced Threat Protection software (ATP
software)
Virus scanners and ATP software that monitor the behavior of processes and communication
can have a significant influence on the performance of the runtime and communication of
S7‑PLCSIM Advanced and even prevent S7‑PLCSIM Advanced instances from starting.

Solution
You can decrease restrictions during installation and runtime of S7‑PLCSIM Advanced. To do
so, define exceptions for the virus scanner for secure files and folders. Add the following
folders to the exceptions:
• "C:\Program Files\Common Files\Siemens\PLCSIMADV\Drivers"
• "C:\Program Files (x86)\Common Files\Siemens\PLCSIMADV"
• "C:\Program Files (x86)\SIEMENS\Automation\PLCSIMADV\bin"
If the virus scanner only allows files as exceptions, add all files from the listed folders to the
exceptions. The procedure is described in the instructions of the respective manufacturer.

NOTE
Readme
Refer to the latest readme on the Siemens Industry Online Support site for updates. Select the
Edition that corresponds to your release version.

Supported antivirus programs

S7‑PLCSIM Advanced supports the following virus scanners:
• Symantec Endpoint Protection 14.3
• McAfee Endpoint Security (ENS) 10.7
• Trend Micro Office Scan 14.0
• Windows Defender (as part of the Windows operating system)
• Qihoo 360 "Safe Guard 14.0" + "Virus scanner"

Symantec Endpoint Protection 14.3

Note the following restriction for Symantec Endpoint Protection 14.3:
If you use Npcap with Symantec Endpoint Protection, select one of the following options:
• Uninstall Symantec Endpoint Protection.
• Use Symantec Endpoint Protection with Npcap V1.60 or earlier.

S7-PLCSIM Advanced
28 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Installing
3.1 Introduction

3.1.3 Licenses

Floating license
S7‑PLCSIM Advanced is supplied with a floating type license which is version and/or time-
dependent. The license can be stored locally and shared for a network.

NOTE
Validity
A license is valid for two instances within an S7‑PLCSIM Advanced installation.
You must use the correct license for your version.

Handling of licenses is described in the Help for SIMATIC Automation License Manager (ALM).

3.1.4 Trial License

A license is available for the limited period of 21 days for S7‑PLCSIM Advanced. After this Trial
License has elapsed, you can no longer start the instance.

Activating the Trial License

When you start an instance in the Control Panel, the Automation License Manager (ALM)
searches the network for a valid license. If a Floating License is available for
S7‑PLCSIM Advanced, the ALM offers the Trial License for activation.

Figure 3-1 Activating the Trial License

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 29
Installing
3.1 Introduction

A message at the start of an instance shows the remaining number of days.

Figure 3-2 Trial License

NOTE
Remote access
With remote access you have to confirm the message on the PC on which the instance was
started.

Timeout
If you do not confirm the message for the license in a certain amount of time, the instance is
not started and you see an error message.
Start the instance again and confirm the message for the license.

3.1.5 Functions for licenses

API functions for licenses

S7‑PLCSIM Advanced regularly checks whether a license is available. The following return
values provide information about the status (for example, for C++):
• Return values for API function PowerOn() and callback function
OnOperatingStateChanged
– SREC_OK when a floating license is available.
– SREC_WARNING_TRIAL_MODE_ACTIVE when an instance is started with the Trial
License.
– SREC_WARNING_RUNNING_ON_TIA_PORTAL_TEST_SUITE when no valid license for
S7‑PLCSIM Advanced is available, but a "TIA Portal Test Suite" license is available.
S7‑PLCSIM Advanced starts with this license. A download from the TIA Portal is
possible, but the instance terminates without feedback if the download was not made
from the TIA Portal Test Suite.
– SREC_NOT_EMPTY when no valid license for S7‑PLCSIM Advanced is available, but a
"TIA Portal Test Suite" license is available.
If this is the case, power-up from the Virtual SIMATIC Memory Card is not supported.
• Return value for callback function OnOperatingStateChanged
– SREC_LICENSE_NOT_FOUND when the instance is automatically shut down after
21 days.

S7-PLCSIM Advanced
30 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Installing
3.1 Introduction

3.1.6 Installation log

The log files contain automatically recorded information on the following installation
processes:
• Installation of S7‑PLCSIM Advanced
• Change or update of installation of S7‑PLCSIM Advanced
• Repair of an existing installation of S7‑PLCSIM Advanced
• Uninstallation of S7‑PLCSIM Advanced
You can evaluate installation errors and warnings using the log files. You can troubleshoot
the installation yourself or contact Siemens Technical Support. Product Support personnel
need information from the installation log to analyze the problem. Send the folder with the
log files as a ZIP file to Support.

Memory location of the installation log

The memory location of the log file depends on the operating system. To open the folder
with the log files, enter the environment variable "%autinstlog%" in the address bar in
Windows Explorer. Alternatively, you reach the appropriate folder by entering
"cd %autinstlog%" in the command line.
The log files are named as follows:
• "SIA_S7-PLCSIM_Advanced_<version number>@<DATE_TIME>.log"
• "SIA_S7-PLCSIM_Advanced_<version number>@<DATE_TIME>_summary.log"

Setup_Report (CAB file)

The installation log and other required files are stored in a log file. This file can be found at
"%autinstlog%\Reports\Setup_report.cab".
A separate CAB file with a date ID is saved for each installation.
If you need help during installation, send this CAB file to Siemens Technical Support for
troubleshooting.

3.1.7 Contents of the S7-PLCSIM Advanced package

The S7‑PLCSIM Advanced package contains the following software:
• S7‑PLCSIM Advanced
• Automation License Manager
• S7‑PLCSIM
• .NET Framework
• Npcap
The package is available as a download and on DVD. Floating product licenses and product
upgrade licenses are available.
If you installed from a DVD, keep the DVD in a secure, easily accessible place.

Setup program
You can use the Setup program to change, repair, or uninstall your installation, if necessary.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 31
Installing
3.2 Installing S7-PLCSIM Advanced

3.2 Installing S7-PLCSIM Advanced

Installation requirements
The Setup program starts automatically with a double-click on the download package or
when you insert the DVD in the drive. Make sure that the following conditions are met before
you begin the installation process:
• The hardware and software of the computer meet the System requirements (Page 27).
• You have administrator rights on the installation computer.
• No other programs are active. This also applies to the Siemens Automation License
Manager and other Siemens applications.
• All TIA Portal versions prior or equal to V14 are uninstalled.

NOTE
Security settings
For licensing via the ALM, you must agree during installation that port 4410 for TCP can be
entered as an exception in the Windows Firewall (procedure step 5).

NOTE
Use of virus scanners
Note the information provided in section Restrictions due to antivirus programs (Page 28).

Installing S7‑PLCSIM Advanced

To install, follow these steps:
1. Double-click the download package or insert the installation medium into the DVD drive of
your computer. The setup program starts up automatically, provided you have not
disabled the Autostart function on the computer. If the setup program does not start up
automatically, start it manually by double-clicking the "Start.exe" file. The "General
settings" window is displayed.
2. Click the "Read installation notes" button. After you have read the notes, close the file.
3. Click the "Read product information" button. After you have read the information, close
the file.
4. Click "Next". The window with the products to be installed is displayed.
5. Select the products to be installed.
6. Click the "Browse" button if you want to change the default installation path. The
installation path must not exceed 89 characters. The path name must not contain any
UNICODE characters. If you select a different installation path than the default installation
path, the desktop icon may not be displayed correctly.
7. Click "Next". The window with the security settings is displayed. To continue the
installation, select the check box at the bottom of the screen to accept changes to the
security and permissions settings of your system.
8. Click "Next". The window with the installation settings is displayed. You can save or print a
report of the settings by clicking "Save report" or "Print report". Check the settings for
correctness. If you want to make any changes, click "Back" until you reach the point in the
installation process where you want to make changes. Once you have completed your
changes, click "Next".

S7-PLCSIM Advanced
32 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Installing
3.3 Changing an installation

9. The overview screen shows your installation details. Click the "Install" button. The
installation then starts.
10. After completion of the setup program, you must restart your computer. Select "Yes, I
want to restart the computer now" to restart the computer immediately or select "No, I will
restart computer later" to restart the computer later.
11. Click "Restart". If the computer is not restarted, click "Finish".

Error during installation of S7‑PLCSIM Advanced

The installation of S7‑PLCSIM Advanced recognizes an already existing installation of
S7‑PLCSIM Advanced.
A requirement for the installation of S7‑PLCSIM Advanced is that no other S7‑PLCSIM
installation prior or equal to TIA Portal version V14 is located on the same computer.
Even though no installation of S7‑PLCSIM is displayed in the "Programs and Features" list, it is
still possible that the computer has an existing installation.
Remedy
Run the setup for S7‑PLCSIM prior or equal to TIA Portal version V14 and uninstall S7‑PLCSIM.
If the setup is not available, download the setup files for S7‑PLCSIM via Siemens Mall
(https://support.industry.siemens.com/cs/ww/en/view/65601780).

3.3 Changing an installation

Requirements
The following conditions must be met before you can change the installation:
• The hardware and software of the computer meet the system requirements.
• You have administrator rights on the installation computer.
• No other programs are active.

Procedure
To change your S7‑PLCSIM Advanced installation, follow these steps:
1. Double-click the download package or insert the installation medium into the drive. The
setup program starts up automatically, provided you have not disabled the Autostart
function on the computer. If the setup program does not start up automatically, start it
manually by double-clicking the "Start.exe" file.
2. Follow the prompts until you reach the "Configuration" window.
3. Select the "Change upgrade" check box.
4. Follow the remaining prompts to change your installation.
5. Complete the installation operation by restarting your computer.

NOTE
Target directory
You cannot change the target directory because you are changing an existing installation.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 33
Installing
3.5 Uninstalling the product

3.4 Repairing an installation

Requirements
The following conditions must be met before you can repair S7‑PLCSIM Advanced:
• The hardware and software meet the system requirements.
• You have administrator rights on the installation computer.
• No other programs are active.

Procedure
To repair your installation, follow these steps:
1. Double-click the download package or insert the installation medium into the drive. The
setup program starts up automatically, provided you have not disabled the Autostart
function on the computer. If the setup program does not start up automatically, start it
manually by double-clicking the "Start.exe" file.
2. Follow the prompts until you reach the "Configuration" window. Select the "Repair" check
box.
3. Follow the remaining prompts to repair your installation.
4. Complete the repair operation by restarting your computer.

3.5 Uninstalling the product

You have two options for uninstalling S7‑PLCSIM Advanced:
• Uninstalling the program via the Windows Control Panel
• Uninstalling the entire product via the Setup program

Uninstalling S7‑PLCSIM Advanced using the Windows Control Panel

Proceed as follows from the Control Panel:
1. Double-click your S7‑PLCSIM Advanced product version in the Programs and Features.
2. Follow the prompts for uninstallation.
3. Complete the uninstallation operation by restarting your computer.
If you do not perform a restart, the Runtime Manager continues running.
If problems occur when uninstalling S7‑PLCSIM Advanced using the Windows Control Panel,
use the installation medium for uninstalling.

Uninstalling S7‑PLCSIM Advanced using the Setup program

Proceed as follows:
1. Double-click the download package or insert the installation medium into the drive. The
setup program starts up automatically, provided you have not disabled the Autostart
function on the computer. If the setup program does not start up automatically, start it
manually by double-clicking the "Start.exe" file.
If you do not perform a restart, the Runtime Manager continues running.
2. Follow the prompts until you reach the "Configuration" window. Your previous installation
is detected. Select the "Uninstall" check box.

S7-PLCSIM Advanced
34 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Installing
3.5 Uninstalling the product

3. Follow the prompts for uninstallation.

4. Complete the uninstallation operation by restarting your computer.
If you do not perform a restart, the Runtime Manager continues running.

Uninstalling additional software

When you uninstall S7‑PLCSIM Advanced via the setup program, the following software from
the S7‑PLCSIM Advanced package remains installed:
• Automation License Manager
• S7‑PLCSIM
• .NET Framework
• Npcap
If you also want to uninstall this software, use the Windows Control Panel.

NOTE
User data, such as instance data, is not removed by the uninstallation.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 35
Communication paths 4
Local and distributed communication
The following paths are open for communication between STEP 7 V15 or higher and the
instances of S7‑PLCSIM Advanced user interfaces:
Table 4-1 Local and distributed communication
Communication paths Local Local Distributed
Protocol Softbus TCP/IP TCP/IP
Online access setting in S7‑PLCSIM Advanced PLCSIM TCP/IP Single Adapter TCP/IP Single Adapter
or TCP/IP Multiple or TCP/IP Multiple
Adapter Adapter
STEP 7 and instances On a PC / VM On a PC / VM Distributed
Communication...
Between STEP 7 and instances Yes Yes Yes
Among instances Yes Yes Yes
Via OPC UA server and Web server No Yes Yes
Between an instance and a real hardware CPU No No Yes
Between an instance and a real HMI V14 and higher No No Yes
Between an instance and a simulated HMI V14 and Yes Yes Yes
higher
Secure communication...
Via Secure Open User Communication (secure TCP No Yes Yes
communication) V17 and higher
Via OPC UA Server V17 and higher No Yes Yes
Via HTTPS connections to the Web server TIA Portal No Yes Yes
version V17 and higher

PLCSIM online access (Softbus)

Softbus is a communication path via a virtual software interface.
The communication is limited to a local PC or a virtual machine. The advantage here is that no
data can be accidentally downloaded to a hardware CPU or communicate with real hardware.

Communication with S7-1500 R/H CPUs

NOTE
Communication with system IP address
Communication with S7-1500 R/H CPUs over the system IP is limited to local TCP/IP
connection. The system IP cannot be reached by network adapters.

S7-PLCSIM Advanced
36 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Communication paths
4.1 Local communication

Selecting a network mode

You select the network mode for communication in the Control Panel under "Online Access".
The setting is valid for all generated instances. The default setting is the communication via
"PLCSIM" (Softbus).
Additional network settings are necessary for the distributed communication over a TCP/IP
adapter setting, see Network addresses in the simulation (Page 57).

4.1 Local communication

Local communication can be performed via the "PLCSIM" online access point (Softbus
protocol) or TCP/IP.
For local communication, the S7‑PLCSIM Advanced instance is on the same PC or on the same
virtualization platform such as STEP 7 or another communication partner.

Local communication via Softbus

Local communication is performed via Softbus in S7‑PLCSIM Advanced by default. You select
"PLCSIM" for the online access point on the control panel to use the Softbus protocol.
Local communication via Softbus prevents:
• An accidental download to a hardware CPU
• Communication with real hardware

3&90
67(3

5XQWLPH 5XQWLPH
,QVWDQFH ,QVWDQFH

3/&6,06RIWEXV

Figure 4-1 Local communication via Softbus

Local communication via TCP/IP

When you choose TCP/IP Single Adapter or TCP/IP Multiple Adapter for the Online Access
point, communication is performed via a simulated network interface that behaves like a real
network interface.

NOTE
Local communication via TCP/IP
Make sure that communication is only local and cannot be downloaded to real hardware. For
this, you must have no other adapters of your Windows PC configured in the physical
network and on the subnet of your simulated PLC instance. Microsoft KB 175767 provides
background.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 37
Communication paths
4.2 Communication via TCP / IP

3&90
67(3

5XQWLPH 5XQWLPH
,QVWDQFH ,QVWDQFH

3/&6,07&3,32QOLQH$FFHVV

Figure 4-2 Local communication via TCP/IP

4.2 Communication via TCP / IP

4.2.1 Communication via TCP/IP in Single Adapter Network Mode (promiscuous

mode)

Distributed communication
Distributed communication via TCP/IP means that the S7‑PLCSIM Advanced instances
communicate with other devices via the S7‑PLCSIM Advanced Virtual Switch . Communication
is possible with real or simulated CPUs, real or simulated HMIs.
You must activate the S7‑PLCSIM Advanced Virtual Switch in Windows (Page 44) for instances
on the network to be visible.
The network interface you configure as the S7‑PLCSIM Advanced Virtual Switch must be in
the same IP subnet as the IP address of the simulated PLC instance. If the virtual switch is not
in the same subnet, you can assign it an IP address that is in the same subnet. Each CPU
interface requires an IP address that is unique throughout the entire, accessible network.

Example 1: Distributed communication

In the following example, STEP 7 is on a PC and the S7‑PLCSIM Advanced instances are on
another PC or a virtual machine. The PCs are connected via their real Ethernet adapter.

1$
 1$7.

3VOUJNF 3VOUJNF
45&1

*OTUBODF
 *OTUBODF


41-$4*.
"EWBODFE
7JSUVBM
4XJUDI

&UIFSOFU
"EBQUFS 1-$4*.
5$1*1
4JOHMF
"EBQUFS &UIFSOFU
"EBQUFS

&UIFSOFU
5$1*1

Figure 4-3 Distributed communication via Ethernet

S7-PLCSIM Advanced
38 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Communication paths
4.2 Communication via TCP / IP

Example 2: Distributed communication on a PC

In the following example, STEP 7 is on a PC and the S7‑PLCSIM Advanced instances are on a
virtual machine on the same PC. The PC and virtual machine are connected via the (virtual)
network adapters.

1$


7.
45&1
 1-$4*. 1-$4*.
*OTUBODF
 *OTUBODF


41-$4*.
"EWBODFE
7JSUVBM
41-$4*.
"EWBODFE
7JSUVBM

/FUXPSL
BEBQUFS 4XJUDI 4XJUDI
5$1*1
4JOHMF
"EBQUFS /FUXPSL
BEBQUFS

7.
7JSUVBM
/FUXPSL

Figure 4-4 Distributed communication via network adapters

Required settings in the "Virtual Machine Settings" dialog using the VMware
visualization platform as an example
If you have opened STEP 7 (TIA Portal) and your project within the virtual machine, enable
the following options for your online connection as follows:
1. Right-click on the VM and select "Settings" or select the menu "VM > Settings".
2. Open the "Virtual Machine Settings" dialog via the menu command "Player > Manage >
Virtual Machine Settings".
3. Then click "Network Adapter" in the "Hardware" tab and activate the following options in
the right window:
– Connected
– Connect at power on
– Bridged: Connected directly to the physical network
– Replicate physical network connection state
4. Click the "Configure Adapters" button and activate your network connection, for example
"Intel(R)82574L LM Gigabit Network Connection".
5. Confirm the setting with OK and exit the "Virtual Machine Settings" dialog with OK.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 39
Communication paths
4.2 Communication via TCP / IP

Example 3: Distributed communication

The following example shows a structure with PCs on which distributed STEP 7,
S7‑PLCSIM Advanced instances and virtual machines with S7‑PLCSIM Advanced instances are
running.

1$
 4FSWFS

7.XBSF
W4QIFSF
&49J
*OTUBODF
 7.
 7.
 7.
 7.
9

*OTUBODF *OTUBODF
 

4XJUDI

1$

1$


7.XBSF
8PSLTUBUJPO

45&1
 7.
 7.
 7.


*OTUBODF *OTUBODF *OTUBODF

  

Figure 4-5 Distributed communications with PCs and virtual machines

4.2.2 Communication via TCP/IP in Multiple Adapter Network Mode (non-

promiscuous mode)
In TCP/IP Single Adapter Network Mode (promiscuous mode), the network adapter reads all
incoming telegrams. The network adapter also reads telegrams that are not intended for the
network adapter. The network adapter then forwards the data to the operating system for
processing.
In TCP/IP Multi-Adapter Network Mode (non-promiscuous mode), the evaluation of MAC
addresses ensures that only data intended for the network adapter reaches the operating
system.
However, on virtualization platforms or corporate networks, it is often not permitted to run
the network interface of the PC in TCP/IP Single Adapter Network Mode (promiscuous mode)
for security reasons.

S7-PLCSIM Advanced
40 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Communication paths
4.2 Communication via TCP / IP

Overview
The following figure provides an overview of the possibilities and differences between the
following communication options:
• Local TCP/IP communication
• Single Adapter Network Mode (promiscuous mode)
• Multi-Adapter Network Mode (non-promiscuous mode)

0OMJOF
BDDFTT

TFMFDUJPO

1-$4*.
OFUXPSL
NPEF QPTTJCMF
WJB
"1*

BOE
$POUSPM

1BOFM

5$1*14JOHMF
"EBQUFS
5$1*1.VMUJ"EBQUFS

1-$4*.
4PGUCVT
/FUXPSL
.PEF /FUXPSL
.PEF

"MM
QPTTJCJMJUJFT
PG
MPDBM

"MM
QPTTJCJMJUJFT
PG
MPDBM
BOE
BOE
5$1*1
DPNNVOJDB
.FNPSZCBTFE 5$1*1
DPNNVOJDBUJPO
UJPO
BWBJMBCMF
-JNJUFE
GVODUJPOBMJUZ BWBJMBCMF 6TF
JO
UIF
DMPVE

1SPNJTDVPVT
NPEF
JT
QPTTJCMF
SFRVJSFE /FUXPSL
TFQBSBUJPO

$BOOPU
CF
VTFE
GPS
QVCMJD
QPTTJCMF
.PEF
GPS

DMPVE
FOWJSPONFOUT WJSUVBMJ[FE
QVCMJD
DMPVE

&YUFSOBM
OFUXPSLT
OPU
FOWJSPONFOUT
WJTJCMF

&YUFSOBM
OFUXPSLT

WJTJCMF

Figure 4-6 S7‑PLCSIM networking

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 41
Communication paths
4.2 Communication via TCP / IP

Applications
The following applications describe how you can also communicate in TCP/IP Multi-Adapter
Network Mode (non-promiscuous mode). You communicate in this mode by performing a
one-to-one mapping of the MAC addresses between the CPU network interfaces and the
network adapters of the PC.
The following applications assume that you are working in an environment where security
restrictions apply and you have therefore switched to TCP/IP Multi-Adapter Network Mode
(non-promiscuous mode).
Application 1:
You start multiple instances. Each CPU interface is assigned to the MAC address of the
respective physical or virtual PC adapter.
Precondition: Each interface of a running instance is assigned to its own physical or virtual PC
interface (one-to-one mapping).

5$1*1
.VMUJQMF
"EBQUFS
/FUXPSL
.PEF %FEJDBUFE
NBQQJOH
PG
BO
JOUFSGBDF

.VMUJQMF
OFUXPSL
BEBQUFST
NBQQFE
UP
B
TJNVMBUJPO
JOTUBODF UP
BO
BEBQUFS
1$

"QQMJDBUJPO 1-$4*.
1PTTJCJMJUZ
PG
1-$4*.
45&1
 *OTUBODF
 *OTUBODF

DPNNVOJDBUJPO
CFUXFFO
$16

$16

EFEJDBUFE
$16
JOUFSGBDFT
0OMZ

JOUFSGBDFT
VTFE
PG
POF
JOUFSGBDF
UP

9 9 9
BOPUIFS
XJUIPVU
IBWJOH

UP
TFU
QSPNJTDVPVT
NPEF
*OUFSGBDF
NBQQJOH

41-$4*.
"EWBODFE
7JSUVBM

4XJUDI
41-$4*.
"EW 41-$4*.
"EW 41-$4*.
"EW

1-$4*.
7JSUVBM
&UI
"EBQUFS 7JSUVBM
4XJUDI 7JSUVBM
4XJUDI 7JSUVBM
4XJUDI
/FUXPSL
BEBQUFS /FUXPSL
BEBQUFS /FUXPSL
BEBQUFS

/FUXPSL
BEBQUFS

4XJUDI

Figure 4-7 Application 1

Application 2:
The following application shows the behavior with multiple instances that have the same
MAC addresses. Each CPU interface is assigned to the corresponding physical or virtual PC
adapter.

S7-PLCSIM Advanced
42 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Communication paths
4.2 Communication via TCP / IP

The scenario is only valid if only one instance is running at a time.

5$1*1
.VMUJQMF
"EBQUFS
/FUXPSL
.PEF %FEJDBUFE
NBQQJOH
PG
BO
JOUFSGBDF

.VMUJQMF
OFUXPSL
BEBQUFST
NBQQFE
POUP
B
TJNVMBUJPO
JOTUBODF POUP
BO
BEBQUFS
1$

"QQMJDBUJPO
7.
1PTTJCJMJUZ
PG
DPNNVOJDB
UJPO
CFUXFFO
EFEJDBUFE
1-$4*.
1-$4*.
$16
JOUFSGBDFT
PG
POF
*OTUBODF

*OTUBODF

JOUFSGBDF
UP
BOPUIFS
$16

$16

XJUIPVU
IBWJOH
UP
TFU
0OMZ

JOUFSGBDFT
VTFE
QSPNJTDVPVT
NPEF 9 9 9
*OUFSGBDF
NBQQJOH

41-$4*.
"EWBODFE
7JSUVBM

/FUXPSL
BEBQUFS 4XJUDI
1-$4*.
7JSUVBM
&UI
"EBQUFS 41-$4*.
"EW
41-$4*.
"EW
41-$4*.
"EW

7JSUVBM
4XJUDI 7JSUVBM
4XJUDI 7JSUVBM
4XJUDI
W/FUXPSL
BEBQUFS W/FUXPSL
BEBQUFS W/FUXPSL
BEBQUFS

7JTVBMJ[FE
JOGSBTUSVDUVSF
TXJUDIW/*$

7.
1-$4*.
*OTUBODF

$16

0OMZ

JOUFSGBDFT
VTFE
9
*OUFSGBDF
NBQQJOH

1-$4*.
7JSUVBM
4XJUDI
1-$4*.
1-$4*.
7JSUVBM
&UI
"EBQUFS 7JSUVBM
4XJUDI
W/FUXPSL
"EBQUFS

Figure 4-8 Application 2

Refer to the S7‑PLCSIM Advanced API manual for a procedure to perform external
communication in TCP/IP Multi-Adapter Network Mode.

4.2.3 Using a Software/Open Controller with a TCP/IP communication interface

If you have selected a TCP/IP communication interface for the online access of a
Software/Open Controller, the IP address of your S7-PLCSIM Advanced Instance must match
the IP address defined in your TIA Portal project.
In your device configuration, select "Set IP address in the project" and configure a static IP
address to the PLC Interface. Do not assign IP addresses with 0.0.0.0 and 192.168.0.1 values.
When you download to your instance, select the appropriate "Direct at slot 1 Xn" variant in
the Connection to interface/subnet dropdown in the Extended download to device window.
The TIA Portal Load Preview window displays an error message if an IP Address mismatch
occurs. In this case, you must cancel the download and re-create your instance.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 43
Communication paths
4.3 Enable distributed communication

4.3 Enable distributed communication

By default, the S7‑PLCSIM Advanced Virtual Switch is not enabled for communication
connection properties. For distributed communication to be possible, that is cross-computer
communication, you must activate the S7‑PLCSIM Advanced Virtual Switch for a real network
adapter.

NOTE
Network adapter
Make sure that the S7‑PLCSIM Advanced Virtual Switch is activated for only one network
adapter. The Control Panel of S7‑PLCSIM Advanced checks the activation and can report an
incorrect configuration (error code -50).

S7-PLCSIM Advanced
44 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Communication paths
4.3 Enable distributed communication

Activating the S7‑PLCSIM Advanced Virtual Switch

To make the S7‑PLCSIM instances visible on the network and to reach other devices, activate
the S7‑PLCSIM Advanced Virtual Switch in Windows:
1. To do this, open the "Network and Sharing Center" in the Windows Control Panel.
2. Open the properties of the desired network adapter, for example, for the "Local Area
Connection".
3. Select the check box for the "S7‑PLCSIM Advanced Virtual Switch" and confirm with OK.

Figure 4-9 Activating the S7‑PLCSIM Advanced Virtual Switch

Accessible devices
On the local computer, the S7‑PLCSIM Advanced instances are always displayed in the TIA
Portal as accessible devices of the Siemens PLCSIM Virtual Ethernet Adapter.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 45
Communication paths
4.3 Enable distributed communication

The S7‑PLCSIM Advanced instances are not visible locally via the configured network, even if
the S7‑PLCSIM Advanced Virtual Switch is activated.

Figure 4-10 Accessible devices on the Siemens PLCSIM Virtual Ethernet Adapter

Distributed communication via WLAN

When using distributed communication via WLAN, it can happen that the Npcap program
library installed by S7‑PLCSIM Advanced does not work with the integrated WLAN adapter of
the PC. In this case, no WLAN connection can be established.
Remedy
Use the wired network adapter of the PC/notebook and connect a WLAN adapter upstream.

S7-PLCSIM Advanced
46 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
Simulating 5
5.1 Simulating a CPU

5.1.1 Basic procedure for the simulation

The following overview shows the basic steps to perform simulation with a simulated PLC
instance.

Requirements
The following requirements must be met for starting simulation via local communication:
• STEP 7 (V14 or higher) and S7‑PLCSIM Advanced are installed on the same PC.
• The CPU hardware is configured in STEP 7.

NOTE
Enable simulation support
To support simulation (Page 20), select the check box "Support simulation during block
compilation" from the "Protection" tab in the properties of the project in STEP 7,

Create and activate an instance via the Control Panel

• Open the S7‑PLCSIM Advanced Control Panel. (Page 48)
• Open the "Start Simulated PLC Instance" options.
• Enter a name for an instance. Do not use Unicode characters in the instance name.
• Select the CPU family.
• Create an instance using the "Start" button.

In STEP 7, perform the download and start the simulation

• Download the program (Page 55) to the simulated PLC instance
• Switch the simulated PLC instance to RUN to start the simulation
• Perform diagnostics

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 47
Simulating
5.1 Simulating a CPU

5.1.2 Control Panel - User interface

5.1.2.1 S7-PLCSIM Advanced Symbol

After installing S7‑PLCSIM Advanced, the following icons are on the Windows desktop:

Figure 5-1 S7‑PLCSIM Advanced Symbol

A double-click on the symbol opens the Control Panel for S7‑PLCSIM Advanced. If the Control
Panel is in the background, it is moved to the foreground with another double-click.
You can use Windows functions to permanently display the icon in the system tray of the
taskbar.

Opening the Control Panel or viewing status from the taskbar

Right-clicking the icon in the taskbar opens the Control Panel with the quick view. Double-
click to start the Control Panel as a window.
You can use the mouse-over function to display messages about the current status of the
instances.

Figure 5-2 Example: Message in the taskbar

5.1.2.2 Control Panel quick view and window

S7‑PLCSIM Advanced provides the Control Panel with two views:
• Control Panel as quick view
Right-clicking on the icon in the taskbar opens the quick view.
Clicking on an empty area on the desktop minimizes the quick view. The instances are not
affected.
• Control Panel as window
Double-clicking the icon on the desktop or in the taskbar opens the Control Panel as a
window.

S7-PLCSIM Advanced
48 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.1 Simulating a CPU

Control Panel as window

Unlike the quick view, you can operate the Control Panel with the buttons in the title bar.
You can close this window without exiting the simulation Runtime process.

① Stores the Control Panel as icon in the taskbar.

② No function. The window size cannot be changed.
③ Closes the Control Panel and stores it in the system tray of the taskbar.
The instances and the simulation Runtime process remain active.
This function therefore differs from the Exit function .
The Exit function switches off the local instances, logs them off and closes the Control Panel.
④ Pins the Control Panel on the screen so that it remains in the foreground.
Figure 5-3 Control Panel: Title bar

5.1.2.3 S7-PLCSIM Advanced Control Panel

The S7‑PLCSIM Advanced Control Panel is only available in English.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 49
Simulating
5.1 Simulating a CPU

Features of the Control Panel

The figure below shows the structure of the S7‑PLCSIM Advanced Control Panel.


 








① Online access Selection of the network mode

② TCP/IP com­ Selection of network adapter for distributed communication
munication
③ Virtual time Slider to adjust the scaling factor
Scaling

S7-PLCSIM Advanced
50 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.1 Simulating a CPU

④ Strict Motion Check box to disable the overrun detection for Motion Control (OB MC-Servo
Timing [OB91]).
When you select the check box for Strict Motion Timing, PLC instances detect
overruns.
You can only change the Strict Motion Timing setting for overrun detection
when you have started no PLC instances. All instances that you subsequently
start use the Strict Motion Timing setting to either detect or ignore overruns.
⑤ Start Simu­ Selector to open and close the input boxes for creating the instance
lated PLC
Instance
• Instance Unique name for the instance.
name Instance names must be between 3 and 64 characters, inclusive. If the name is
unique in the network, you can click the "Start" button.
• IP address, Input boxes that are visible when you switch the communication interface to a
Subnet TCP/IP mode.
mask,
Default
gateway
• PLC family PLC family to be simulated
• "Start" but­ Button to start the instance that you selected
ton
⑥ Buttons Buttons for operating the selected instances
⑦ Instance list List of available local instances, which you can sort by dragging and dropping
⑧ LEDs LED indicators, which display a tooltip definition when you move the mouse
over them
⑨ Icons Icons for operating the instance
⑩ Runtime Man­ Port on the local PC to be opened
ager Port
⑪ Virtual SIMAT­ Clickable region where you open the storage location of the virtual memory card
IC Memory With the "..." Browse icon you can change the path to the virtual memory card.
Card
⑫ Show Notific­ Check box to disable S7‑PLCSIM Advanced messages in the Windows task bar for
ations the duration of the operation.
⑬ Function Icon for opening the S7‑PLCSIM Advanced Function Manual
manual
⑭ API manual Icon for opening the S7‑PLCSIM Advanced API Manual
⑮ Exit Exit button and bottom region of control panel for logging off all instances and
closing the Control Panel

Online access selection

Choose one of the following for the communication interface to use for all instances you
create:
• S7‑PLCSIM: Local communication via Softbus (default).
• TCP/IP Single Adapter (Page 38)
• TCP/IP Multiple Adapter (Page 40)
The setting applies to all other instances. The selected communication interface for starting
an instance is maintained until all instances are shut down.
When an instance is already started, it sets "its" communication interface as the default for
other instances.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 51
Simulating
5.1 Simulating a CPU

To change the communication interface, switch off all instances and enable the other
interface.

TCP/IP communication
After you select TCIP/IP Single Adapter or TCP/IP Multiple Adapter for the online access, you
can select a real network adapter from the drop-down list during operation. You thus activate
the S7‑PLCSIM Advanced Virtual Switch and establish TCP/IP communication between the
instances and the real network.
The <Local> setting deactivates the S7‑PLCSIM Advanced Virtual Switch and disconnects the
instances from the real network. Only local TCP/IP communication over the virtual adapter is
possible in this case.

Virtual time
You must enable the virtual time for each instance using the icon . Use the slider or the
mouse wheel to select the scaling factor for the virtual time.
The selected scaling factor applies to the instances for which the virtual time is enabled.
Clicking on "Off" restores the default (1) again. For more information see Virtual and Real
Time (Page 74).

Creating a local instance and starting it

To create an instance, enter a unique name under "Instance Name".
The following rules apply to the creation of an instance name:
• The minimum length of an instance name is 3 characters; the maximum length is 29
characters.
• The instance name must not start with a dot (.) or a space.
• The instance name can only contain the following:
– Uppercase letters from A to Z
– Lowercase letters from a to z
– Numbers from 0 to 9
– Special characters: Spaces ., _ - + @ ! ; # ~ ' ( ) [ ] { } ^ $ % &

NOTE
If the name already exists in the folder of the Virtual SIMATIC Memory Card, this already
existing instance is started.

In the "PLC family" drop-down list, you select a CPU family:

• S7-1500
• S7-1500R/H
• ET 200SP
• ET 200pro
• Software/Open controller
Create the instance with the "Start" button and start this instance.
The instance is initialized with the first download from the TIA Portal.

S7-PLCSIM Advanced
52 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.1 Simulating a CPU

Instance list
The list contains the instances that have been started and are available locally on the PC or
virtualization platform.
To change the operating mode, select one or more instances and click the "RUN" or "STOP"
button. To reset memory, select one or more instances and click the "MRES" button.
The LEDs correspond to hardware PLC LEDs and show the status and operating mode of each
instance.
You can "operate" the instance with these icons:
• Enable or disable the virtual time scaling factor
• Power on/off the instance
• Power off and unregister instance

Runtime Manager Port

A remote connection can be established to another Runtime Manager via the specified port.
The value must be greater than 1024.
If you select the check box, the port value is retained. You can use the remote connection
without having to make this setting every time you start the Control Panel. To use this
functionality, the Control Panel must be started and running in the background.

Virtual SIMATIC Memory Card

The user program, the hardware configuration, and the retentive data are stored on the
Virtual SIMATIC Memory Card. Use the buttons to adapt the path to the virtual memory card
or open the previously saved path in an Explorer window.

Showing notifications
Each time the Panel starts, help information and messages relating to the Control Panel are
displayed, for example, when changing the IP address or when a license is missing. Disable
"Show Notifications" if you do not need the messages.

Exit - Log off all instances

The command switches off all local instances on the PC or the virtual memory card, logs them
off from the Runtime Manager, and closes the Control Panel.
This command closes the Runtime Manager if there are no remote connections to other
Runtime Managers.
If the Runtime Manager has remote connections to instances on additional PCs, these
instances and the Runtime Manager continue to run.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 53
Simulating
5.1 Simulating a CPU

5.1.2.4 Importing instances

Requirement
If you start S7‑PLCSIM with "Run as administrator", you cannot import instances as described
below. To be able to import instances, do not select "Run as administrator" when starting the
control panel.

Importing instances
You can use the drag-and-drop function to import instances from a folder directly into the
instance list of the Control Panel.
1. Open a folder with instances, for example, using the "Virtual SIMATIC Memory Card"
button.
2. Select one or more instances from the folder and drag them to the "Drop Instances Here"
area.

S7-PLCSIM Advanced
54 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.1 Simulating a CPU

5.1.3 Downloading a STEP 7 project

Requirements
You can download the STEP 7 project to the simulated PLC instance when the following
conditions are met:
• The instance is created via the Control Panel.
• The check box "Support simulation during block compilation" is selected in STEP 7.

Selecting the communication interface

In the Download dialog box, select the PG/PC interface:
• "PLCSIM" for download via Softbus
• "Siemens PLCSIM Virtual Ethernet Adapter" for download via TCP/IP
• For distributed communication the real adapter that is connected to the network

Display in the download dialog

The dialog in STEP 7 at the first download of the CPU shows the compatible
S7‑PLCSIM Advanced instances.
If the instance has not yet been configured after the first download only one interface is
visible and it appears with the device type "CPU-1500 Simulation".
If the instance has been configured, the number of interfaces visible is determined by the
number the CPU type has.
The dialog shows the interfaces of an instance with their IP addresses.

Perform download
To download a project to the simulated PLC instance, follow these steps:
1. Select the PG/PC interface.
2. Click "Download".
→ In the "Load preview" window, STEP 7 shows the message "The downloads are
performed on a simulated CPU".
→ After the first download, the S7‑PLCSIM Advanced instance displays the CPU type.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 55
Simulating
5.1 Simulating a CPU

Figure 5-4 Example: Download via the "PLCSIM Virtual Ethernet Adapter" (TCP/IP) after naming

NOTE
Downloading to Software/Open controller
Do not select the W1 interface connection when downloading to Software/Open controller.
Additionally, if you change the firmware version of the Software/Open controller in the
STEP 7 project after your created a simulated Software/Open controller instance in
S7-PLCSIM Advanced , you must delete the simulated PLC instance and simulate a new PLC
instance for the changed version. You can then download from the TIA Portal to the new
instance.

S7-PLCSIM Advanced
56 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.1 Simulating a CPU

NOTE
Loading an additional CPU to one instance
Example in TIA Portal:
1. You assign an IO device (e.g. IM 153-4 PN) to a CPU (e.g. CPU 1518-4 PN/DP).
2. You add another CPU of the same product family (e.g. CPU 1511-1 PN) to your project.
3. You start the simulation with online access via PLCSIM Virtual Ethernet Adapter.
4. You load the configuration onto the CPU 1518-4 PN/DP with the assigned IO device (IM
153-4 PN) via the interface X1 with TCP/IP.
5. You load the configuration of the other CPU (CPU 1511-1 PN) using the same instance.
If you go online after this scenario and check the entries in the diagnostic buffer under
"Online & Diagnostics", the following message appears: "Error: Multi-interface mismatch -
Inconsistent parameterization for sending LLDP data)."
Solution:
To avoid this error scenario, use one of the following solutions
• Enable the button "Use IEC V2.2 LLDP mode" for the PROFINET interface [X1] for both
CPUs (CPU 1511-1 PN and CPU 1511-1 PN).
You will find the button in the "General" tab under PROFINET interface [X1] > Advanced
options > Interface options.
• After the second download, log out the instance and log it in again.
• Switch the instance off and on again.

5.1.4 Network addresses in the simulation

5.1.4.1 Siemens PLCSIM Virtual Ethernet Adapter

IP address
For the PLCSIM Virtual Ethernet Adapter (either TCP/IP Single Adapter or TCP/IP Multiple
Adapter (Page 49)), you assign a static IP address in the Windows network settings or obtain
an IP address via DHCP (default).

MAC address
The PLCSIM Virtual Ethernet Adapter (either TCP/IP Single Adapter or TCP/IP Multiple Adapter)
has its own MAC address.
S7‑PLCSIM Advanced only uses MAC addresses that are designated as "locally administered"
(bit 2 in LSB) (Page 58).
The Siemens-specific prefix is: 02-1B-1B. Three bytes follow, which are determined at
random.
Storage location
This MAC address is stored in the registry key "PlcsimvminiMacAddress". You can overwrite
this value.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 57
Simulating
5.1 Simulating a CPU

5.1.4.2 S7-PLCSIM Advanced instances

Detect CPUs and instances

If Ethernet interfaces of CPUs and S7‑PLCSIM Advanced instances are mixed in a network, the
instances are recognizable by the "PLCSIM" suffix of the device type during the search for
accessible nodes in STEP 7.

Figure 5-5 Search for the devices that are accessible in STEP 7

S7-PLCSIM Advanced
58 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.1 Simulating a CPU

Structure of the MAC address for an instance

The following figure shows the structure of the dynamically generated, locally managed MAC
address:

,3DGGUHVVYLUWXDODGDSWHU

%\WH %\WH %\WH %\WH %\WH %\WH

%LW 8QLTXHZRUOGZLGH
 0DQDJHGORFDOO\ 1XPEHURIWKH 1XPEHURIWKH
LQVWDQFH (WKHUQHW
LQWHUIDFH

The MAC address tells you the PC on which an S7‑PLCSIM Advanced instance has been
started.

Assignment of the Ethernet interfaces

Port configurations of the Ethernet interfaces cannot be simulated in S7‑PLCSIM Advanced.
Topological interconnection is not supported. A MAC address for a port is reserved internally
for each Ethernet interface.

Table 5-1 Assignment of the Ethernet interfaces, for example, for a CPU 1518‑4 PN/DP
Ethernet interface Last digit of the MAC Address
IE 1 0
IE 1 / Port 1 1
IE 2 2
IE 2 / Port 1 3
IE 3 4
IE 3 / Port 1 5

Example
02-C0-A8-00-83-10 means:
02 → locally managed MAC address of an S7‑PLCSIM Advanced instance
C0-A8-00-83 → IP of the Siemens PLCSIM Virtual Ethernet adapter = 192.168.0.131
1 → Instance 1
0 → Ethernet interface IE 1
If no Virtual SIMATIC Memory Card is loaded during startup of S7‑PLCSIM Advanced, the
interfaces of S7‑PLCSIM Advanced display instances with their locally managed MAC address.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 59
Simulating
5.1 Simulating a CPU

5.1.5 Simulate peripheral I/O

S7‑PLCSIM Advanced writes to and reads from a memory area. This memory is synchronized
with the internal process image of the virtual S7‑1500 controller at the cycle control point
and when calling cyclic and acyclic OBs (process image partitions, interrupts, events). The
direct I/O accesses are made to this memory area. Only one process can access this memory
at a given time.
The instance must be in RUN mode to apply changes made by the API.

NOTE
Precedence of write operations
If the STEP 7 user program is writing to a memory range at the same time an API application
is writing to the same memory range, the writes from the API application take precedence.
Writes from the API application override writes from the STEP 7 program to the simulated PLC
instance.

5.1.6 Simulate communication

5.1.6.1 Communication services that can be simulated

S7‑PLCSIM Advanced supports the following communication options:
Table 5-2 Supported communication options
Communications options Functionality / instructions
PG communication On commissioning, testing, diagnostics
Open communication using TCP/IP • TSEND_C / TRCV_C
• TSEND / TRCV
• TCON1
• T_DISCON
Secure Open user communication (secure TCP commu­ • TSEND_C / TRCV_C
nication) • TCON
Open communication using ISO-on-TCP • TSEND_C / TRCV_C
• TSEND / TRCV
• TCON
• T_DISCON
Open communication via UDP2 • TUSEND / TURCV
• TCON
• T_DISCON
Communication via Modbus TCP3 • MB_CLIENT
• MB_SERVER
E-mail2, 3 • TMAIL_C
1 When the online access is the "S7‑PLCSIM" (Softbus) interface, communication is performed internally via ISO-on-TCP.
2 Communication is only possible when the online access is TCP/IP Single Adapter or TCP/IP Multiple Adapter, collectively also
called the PLCSIM Virtual Ethernet Adapter.
3 "Access to PLC via communications module" is not supported.

S7-PLCSIM Advanced
60 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.1 Simulating a CPU

S7 communication • PUT / GET

• BSEND / BRCV
• USEND / URCV
OPC UA server2, 3 Secure data exchange with OPC UA clients
Web server2, 3 Data exchange via HTTP, HTTPS
1 When the online access is the "S7‑PLCSIM" (Softbus) interface, communication is performed internally via ISO-on-TCP.
2 Communication is only possible when the online access is TCP/IP Single Adapter or TCP/IP Multiple Adapter, collectively also
called the PLCSIM Virtual Ethernet Adapter.
3 "Access to PLC via communications module" is not supported.

Special conditions apply when communicating with TUSEND/TURCV, see Restrictions for
communications services (Page 79).

NOTE
Secure Communication
When simulating communication services, also consider the basics of secure data exchange
(Secure Communication). For detailed information on Secure Communication, refer to the
Communication (https://support.industry.siemens.com/cs/ww/en/view/59192925) function
manual.

Additional information
For more information on the various communication services, please refer to the Communic­
ation function manual (https://support.industry.siemens.com/cs/ww/en/view/59192925).

Restrictions for MODBUS communication via Softbus

For communication via Softbus, use the supported Modbus versions shown in the following
table or, alternatively, communication via TCP/IP.

Table 5-3 Modbus communication via Softbus

MODBUS TCP Lib MB_CLIENT MB_SERVER SOFTBUS
V6.0 V6.0 V5.3 ✓
V5.2 V5.2 V5.2 x
V5.1 V5.1 x
V5.0 V5.0 x
V4.2 V4.1 V4.2 x
V4.1 V4.1 x
V4.0 V4.0 ✓
✓ = Communication possible
x = Communication not possible

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 61
Simulating
5.1 Simulating a CPU

TMAIL_C
When the TMAIL_C instruction is used, the mail server might not be located on the same PC
as the S7‑PLCSIM Advanced instance.
Solution
Make the mail server available via a different PC in the network.

5.1.6.2 Communication between instances

S7‑PLCSIM Advanced supports communication between instances. An instance might be a
simulation in S7‑PLCSIM Advanced or a simulation in WinCC Runtime as of V14.
You can run two instances of S7‑PLCSIM Advanced, which then communicate with each
other. To enable instances to communicate with each other, they must have a unique IP
address.

Each simulated CPU requires a unique IP address

If the CPUs have the same IP address, you cannot run multiple simulations. Each simulated
CPU requires a unique IP address.
Make sure that the IP addresses in STEP 7 are unique before you start your simulations.

T-block instructions and UDP

S7‑PLCSIM Advanced simulates T-block connections for which the UDP protocol is configured
only using the TCP/IP Single Adapter or TCP/IP Multiple Adapter communication interface
(PLCSIM Virtual Ethernet Adapter).

T-block instructions and data segmentation

S7‑PLCSIM Advanced implements T-block instructions with a data segmentation of 4 KB. A
real CPU has data segmentation of 8192 bytes.
If you send more than 4 KB in a single TSEND instruction and receive data in ad hoc mode
with a TRCV instruction, the TRCV instruction generates new data with only 4 KB. You must
perform the TRCV instruction several times to receive additional bytes.

5.1.7 Provide project data offline for simulation

Simulations regardless of STEP 7

To perform simulations independent of STEP 7, you can save the user program and the
hardware configuration in STEP 7 in a folder.

S7-PLCSIM Advanced
62 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.1 Simulating a CPU

Saving retentive data securely

The retentive data is automatically saved when the simulated PLC instances are shut down.
To save the retentive data safely in the virtual SIMATIC Memory Card, you must log instances
off correctly. Use one of the following functions for this:
• Power on/off the instance
• Power off and unregister instance
• Exit function Power off and unregister all running instances

Provide project data offline

1. Create a "User-defined Card Reader" for your project data in the "Card Reader/USB storage"
folder in the project tree of STEP 7 for the CPU. Do not use Unicode characters in your card
reader name.
2. In the "Load preview" dialog for the target device, select "PLC Simulation Advanced" for the
target device.
→ The project is saved to the <Virtual Memory Card>\SIMATIC.S7S\OMSSTORE folder.

Figure 5-6 Preview of download dialog

3. Save the folder "\SIMATIC.S7S" with the project data to a medium of your choice.

Figure 5-7 Add card reader

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 63
Simulating
5.2 Simulating a CPU with ODK functionality

Provide project data for simulation

1. On the PC on which S7‑PLCSIM Advanced is installed, create the folder "\SIMATIC_MC" in
the folder in which the instance saves its data.
2. Move the "\SIMATIC.S7S" folder to the folder you have created.
The instances can be started with the project data.

5.2 Simulating a CPU with ODK functionality

Introduction
The ODK is an engineering tool that allows the creation of high-level language applications
for S7-1500 CPUs. You use it to generate function libraries that are used in the STEP 7 user
program.
The ODK for S7‑PLCSIM Advanced supports the C++ programming language.
You can find the description of the ODK in the Programming and Operating Manual "S7‑1500
Open Development Kit 1500S", as of V2.5 Edition 12/2017: SIMATIC STEP 7 (TIA Portal)
Options ODK 1500S (https://support.industry.siemens.com/cs/ww/en/ps/13914/man)
Section 6 "Development of a CPU function library for the real-time environment" is relevant
for ODK applications under S7‑PLCSIM Advanced.

Supported CPUs
S7‑PLCSIM Advanced supports the ODK functionality of the following controllers:
• CPU 1518(F)-4 PN/DP ODK
• CPU 1518(F)-4 PN/DP MFP
• CPU 150XS (P/T/F) (Software/Open Controller family)

5.2.1 Special features of ODK

Simulating CPU with ODK functionality with S7‑PLCSIM Advanced

The simulation of a CPU with ODK functionality requires a special start procedure.:
• From the PLC family dropdown list, select the CPU type. For example, for a CPU1518MFP,
select S7-1500. For a Software Controller or Open Controller, select Software/Open
Controller.
• Start the instances on the Virtual SIMATIC memory card that contain the project data for
the CPU with ODK functionality.
• After the first download from the TIA Portal, select the functions "Switch off instance"
and "Shutdown instance" in the Control Panel.

NOTE
When you perform the first download to a CPU of the "S7-1500" family, for example, via
the S7‑PLCSIM Advanced Control Panel, no ODK1500S folder is created on the virtual
SIMATIC Memory Card. The CPU cannot be switched to RUN. In this case, you will find
messages about missing ODK blocks (e.g. SFC 2013) in the diagnostics buffer.

S7-PLCSIM Advanced
64 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.2 Simulating a CPU with ODK functionality

Supported function libraries

S7‑PLCSIM Advanced supports the following function libraries for the real-time environment:
• CPU function library: Original Shared Object, SO file as for the hardware CPUs
• S7‑PLCSIM Advanced function library (Windows Sync):
– a 32-bit Windows DLL for ODK Runtime
– a 64-bit Windows DLL for ODK Runtime

NOTE
Do not mix function libraries
When simulating with S7‑PLCSIM Advanced, you cannot load 32-bit and 64-bit function
libraries simultaneously. If you want to use one function library, first remove the function
library of the other type.
If you want to use function libraries with a different binary format, all others must be
unloaded first.

NOTE
Limitations for the execution of CPU function libraries (Windows Sync) with an infinite
loop in the class constructor
When the CPU function library (DLL file) contains an object of a class in whose constructor an
infinite loop is programmed, the corresponding "ODK client" process gets permanently stuck
in this loop when instantiating the object.
Even after reaching the timeout, the infinite loop cannot be interrupted automatically. The
S7‑PLCSIM Advanced instance remains in RUN even though the entry "Time error - CPU
changes to STOP mode" is displayed in the diagnostics buffer.

NOTE
Limitations for traces in the execution of CPU function libraries (Windows Sync)
Avoid using traces when developing a CPU function library (DLL file) in the class constructor
(call of the "ODK_TRACE()" function) to prevent trace messages with faulty parameter values.

NOTE
Know-how protection
The SO files for ODK are not know-how-protected.

Debugging an S7‑PLCSIM Advanced function library (DLL file)

To debug a function library, attach the Visual Studio Debugger to the corresponding ODK
client process that has loaded the respective function library.
S7‑PLCSIM Advanced supports versions ≥ Visual Studio 2017.

Simulation of the ODK with S7‑PLCSIM Advanced

If you have loaded the TIA project on the S7‑PLCSIM Advanced and the instruction
"<STEP7Prefix>_Load" was called for the first time, each S7‑PLCSIM Advanced instance starts

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 65
Simulating
5.2 Simulating a CPU with ODK functionality

another Windows process ("ODK client") in which the ODK application is executed
synchronously with the STEP 7 user program.
Which ODK client is started depends on the function library to be loaded:
• "Siemens.Simatic.PlcSim.Vplc1500.ODKClient.so.exe" for an original Shared Object
• "Siemens.Simatic.PlcSim.Vplc1500.ODKClient.x86.exe" for a 32-bit application
• "Siemens.Simatic.PlcSim.Vplc1500.ODKClient.x64.exe" for a 64-bit application
The executable files of these processes are located in the same folders as those of the
S7‑PLCSIM Advanced Instances ("Siemens.SIMATIC.Simulation.Runtime.Instance.exe").

NOTE
S7‑PLCSIM Advanced does not support asynchronous ODK functions.

Error codes
The same error codes as described in the Programming and Operating Manual
"S7‑1500 Open Development Kit 1500S" apply to the instructions in the real-time
environment. Error codes are also available for S7‑PLCSIM Advanced because the ODK client
processes can be closed unexpectedly and therefore an error handling is required.

Restrictions for stack processing

NOTE
Limitations for stack processing in the version of CPU function libraries for real-time-
environment
S7‑PLCSIM Advanced ignores the stack size for a CPU function library that is adjusted via the
parameter <SyncCallStackSize>. S7‑PLCSIM Advanced always provides the maximum stack
size of 1 MB.
Additional information may be found in the programming and operating manual
S7‑1500 Open Development Kit 1500S
(https://support.industry.siemens.com/cs/ww/en/view/109783714) . Search for content about
CPU function libraries and SyncCallStackSize.

S7‑PLCSIM Advanced cannot catch any Exceptions of the type "Stack Overflow" while
CPU function libraries for the real-time environment (SO files) are being executed.
When developing a CPU function library (SO file), make sure that the maximum stack size of
1 MB is not exceeded. An overflow of the stack leads to an undefined behavior and can lead
to the termination of the ODK client process.

NOTE
Limitations for heap processing in the version of CPU function libraries (Windows Sync)
If a heap corruption occurs when executing a C/C++ function from a CPU function library (DLL
file), then this program error is first ignored and execution of the function continues. Only
after fully processing the function is the corresponding error code returned (0x8090).
When developing a CPU function library (DLL file), make sure to avoid heap corruption. This
way you ensure that after fully processing a C/C++ function no error code is returned.

S7-PLCSIM Advanced
66 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.2 Simulating a CPU with ODK functionality

5.2.2 Loading functions

Loading functions - Instruction "<STEP7Prefix>_Load"

If you have loaded the TIA project on the S7‑PLCSIM Advanced and the instruction
"<STEP7Prefix>_Load" was called for the first time, each S7‑PLCSIM Advanced instance starts
another Windows process. The ODK client then attempts to load the function library that is
specified in the SCL file. This is in the folder
"<storage path of the instance> \SIMATIC_MC\ODK1500S". The storage path of the instance is
the Virtual SIMATIC Memory Card location.
The ODK client process continues until the instruction "<STEP7Prefix>_Unload" is called to
unload the last loaded function library or until the process of the S7‑PLCSIM Advanced
instance ends.
The function call is synchronous and returns after completion of the operation. The output
parameter provides information on the progress status.

ODK error code for S7‑PLCSIM Advanced

The following table lists the error codes that apply in addition to the error codes that apply to
the CPU specifically for ODK applications with S7‑PLCSIM Advanced:
Table 5-4 ODK: Output parameter - Load functions
DONE BUSY ERROR STATUS Description
0 0 1 0x80A4 • The ODK client process cannot be started.
= -32604 • A connection to the ODK client cannot be established or has been inter­
rupted.
0 0 1 0x8095 The ODK client process that is currently running expects a function library
= -32619 with a different binary format.

5.2.3 Calling functions

Call functions - Instruction "<STEP7Prefix>SampleFunction"

When calling ODK functions, data is exchanged between the simulated PLC instance and the
function library.
The execution of a single function can be interrupted by the execution of higher prioritized
OBs.
Technically, the execution of a function is an asynchronous instruction because it is executed
in another process. However, the processes are synchronized in the simulated PLC instance.
This means that the function call does not return before the function returns or the ODK
client process is closed during the execution.

ODK error code for S7‑PLCSIM Advanced

The following table lists the error codes that apply in addition to the error codes that apply to
the CPU specifically for ODK applications with S7‑PLCSIM Advanced:
Table 5-5 ODK: Output parameter - Call functions
DONE BUSY ERROR STATUS Description
0 0 1 0x80A4 The connection to the ODK client was interrupted.
= -32604

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 67
Simulating
5.2 Simulating a CPU with ODK functionality

5.2.4 Unloading functions

Unload functions - Instruction "<STEP7Prefix>_Unload"

The CPU function library is unloaded by calling the instruction "<STEP7Prefix>_Unload". If no
other function library is loaded or if the process of the S7‑PLCSIM Advanced instance is
closed, then the ODK client process is shut down.
The function call is asynchronous, the call returns immediately. The output parameter
informs about the progress status.

Restrictions
S7‑PLCSIM Advanced simulates the real CPU but not configured, connected technology
modules or other I/O devices.
It is possible to download a STEP 7 project with technology modules for operation of motion
control. However, the built-in logic of the technology modules is not part of the simulation.
Therefore, the corresponding motion control instructions are not supported.
In contrast to a real CPU, S7‑PLCSIM Advanced does not support isochronous mode for
centralized I/O in S7-1500 with local send clock.

OB MC-Servo [OB91] and OB MC-Interpolator [OB 92]

If you convert a motion control project that contains OB 91 and OB 92 from STEP 7 V13, then
you cannot load this project to a S7‑PLCSIM Advanced.
Solution
Delete OB 91 and OB 92 in the project and recompile the project.
The OBs are then created again with the simulation support required for
S7‑PLCSIM Advanced.
Compilation resets the properties of the blocks to the default values.
Restore the required settings in the properties.

Diagnostic buffer message "Overflow" for OB MC servo [OB91]

If there are overflows of the OB MC-Servo [OB91] in the diagnostic buffer, the time for the
application cycle (ms) has been exceeded, because the calculation of this application cycle
could not be completed within the required time.
Solution
The overflows of OB MC-Servo [OB91] in the diagnostic buffer decrease under these
conditions:
• When fewer additional Windows processes are executed
• When the computing power of the CPU is higher

S7-PLCSIM Advanced
68 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.2 Simulating a CPU with ODK functionality

Overflow detection is activated for S7‑PLCSIM Advanced as of V3.0 for exact simulation of the
technology objects. If diagnostic buffer overflows occur on your PC for OB MC-Servo [OB91]
and your instance goes into the STOP operating state, the following solutions are available to
you:
• Use the virtual time of S7‑PLCSIM Advanced and start with the lowest possible scaling
factor for the virtual clock. Increase the value step-by-step until the first overflows occur in
the diagnostic buffer. Repeat this procedure until you have determined the maximum
scaling factor for which you do not yet get any overflows in the diagnostic buffer.
Information on the scaling factor can be found in section Speed up and slow down
simulation (Page 75).
• Set a longer application cycle (ms) for the OB MC-Servo [OB91] in STEP 7.

NOTE
Load on an S7‑PLCSIM Advanced instance is too high
If the load on an S7‑PLCSIM Advanced instance becomes too large, the instance may no
longer switch to the STOP operating state despite numerous diagnostic buffer overflows.
In such a case, shut down the S7‑PLCSIM Advanced instance and follow the workarounds
described above.

Simulation with external simulation software

NOTE
In a simulated PLC instance, the technology objects are connected to the process image.
Simulation software can thus access the process image and simulate the behavior of the
other connected axes.

The simulation mode in STEP 7 is a standard function of the technology objects and is
independent of S7‑PLCSIM Advanced.
If you want to move an axis in simulation mode, select the "Activate simulation" check box in
STEP 7 under "Technology Object > Configuration> Basic Parameters > Simulation". No
additional setting is required for a virtual axis.

Feedback of the axis position

The speed setpoint of the simulated drive is integrated into the actual position value with a
time delay (PT1). The result of this calculation is returned to the technology object as position
actual value of the axis.

Reference point approach of the axis

If you selected "Use zero mark via PROFIdrive frame" in STEP 7 for the reference point
approach, S7‑PLCSIM Advanced responds immediately to any active (mode 2, 3, 8) or passive
(mode 4, 5) reference point approach command (MC_Home). The actual position is
predefined as the reference point.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 69
Simulating
5.4 Simulating the SIMATIC Drive Controller

More information
You can find information on the technology functions of the CPU in the S7-1500/S7-1500T
Motion Control (https://support.industry.siemens.com/cs/ww/en/view/109751049) function
manuals.
For more information, refer to the manuals of the supported SIMATIC controllers.
(https://support.industry.siemens.com/cs/ww/en/view/109744173)

5.4 Simulating the SIMATIC Drive Controller

Introduction
The SIMATIC Drive Controller is a drive-based controller in the SIMATIC S7-1500 range.
A SIMATIC Drive Controller combines the following functionalities in a SINAMICS S120
Booksize Compact housing:
• Fail-safe SIMATIC S7-1500 technology CPU with integrated technology I/Os
• SINAMICS S120 drive control
Both components are called "CPU" and "SINAMICS Integrated" in the documentation.
The SIMATIC Drive Controller supports PROFINET and PROFIBUS DP communication.

Supported SIMATIC Drive Controllers

S7‑PLCSIM Advanced supports the SIMATIC Drive Controllers as of firmware version V2.9:
• CPU 1504D TF (6ES7615-4DF10-0AB0)
• CPU 1507D TF (6ES7615-7DF10-0AB0)

Special features
Unlike other SIMATIC S7-1500 technology CPUs, the SIMATIC Drive Controllers also have:
• Integrated inputs/outputs (onboard I/O)
• Integrated drive control SINAMICS Integrated

Restrictions
S7‑PLCSIM Advanced only simulates the standard CPU functionality of the SIMATIC Drive
Controller.
Not simulated are:
• the technology functions of the onboard I/O
• the SINAMICS Integrated
• PROFINET IO
• PROFIBUS DP
The integrated inputs/outputs of the X122, X132 and X142 interfaces can only be simulated
as binary inputs/outputs.
Technological functions are not simulated, for example, Timer DI/DQ, Oversampling DI/DQ.
Channel parameter assignments, such as signal inversion, input delay and edge detection are
not possible.

S7-PLCSIM Advanced
70 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.5 Simulating a redundant S7-1500R/H system

The functionality of the SINAMICS Integrated is not simulated – but the SINAMICS Integrated
is shown as a valid node.
Simulations are possible as with SINAMICS S120 CU320-2 based on the drive telegrams (e.g.
by reading and forcing the telegram addresses).
Coupled isochronous mode
In coupled isochronous mode, the relevant clock systems use a shared system clock, for
example, from PROFINET IO or the local send clock of the technology I/Os. The leading clock
system provides its own system clock to the other clock systems.

NOTE
Leading clock system
Clock synchronization with technology I/Os X142 (local send clock) as leading clock system is
not possible with S7‑PLCSIM Advanced. In this case, you configure the PROFINET IO interface
X150 as leading clock system.

The information provided in the section Simulation of Motion Control (Page 68) still applies.

Additional information
The SIMATIC Drive Controller system manual
(https://support.industry.siemens.com/cs/ww/en/view/109766665) describes in detail the
configuration, installation, wiring and commissioning of the SIMATIC Drive Controller. The
STEP 7 online help supports you in the configuration and programming.
The SIMATIC Drive Controller equipment manual
(https://support.industry.siemens.com/cs/ww/en/view/109766666) contains a compact
description of the module-specific information, such as properties, wiring diagrams,
characteristics and technical specifications.

5.5 Simulating a redundant S7-1500R/H system

Introduction
In a redundant S7-1500R/H system, the CPUs are duplicated, in other words, redundant. The
two CPUs process the same project data and the same user program in parallel. The two CPUs
are synchronized over two redundancy connections. If one CPU fails, the other CPU maintains
control of the process.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 71
Simulating
5.5 Simulating a redundant S7-1500R/H system

Supported CPUs
S7‑PLCSIM Advanced supports the R/H CPUs of the redundant S7-1500R/H system as of
firmware version V2.9 with the following functional restrictions:
CPU Article number
CPU 1513R-1 PN 6ES7513-1RL00-0AB0
CPU 1513R-1 PN 6ES7513-1RM03-0AB0
CPU 1515R-2 PN 6ES7515-2RM00-0AB0
CPU 1515R-2 PN 6ES7515-2RN03-0AB0
CPU 1515R-2 PN SIPLUS RAIL 6AG2 515-2RN03-4AB0
CPU 1515R-2 PN SIPLUS 6AG1 515-2RN03-7AB0
CPU 1515R-2 PN SIPLUS RAIL 6AG2 515-2RM00-4AB0
CPU 1515R-2 PN SIPLUS 6AG1 515-2RM00-7AB0
CPU 1517H-3 PN 6ES7517-3HP00-0AB0
CPU 1517H-3 PN SIPLUS 6AG1 517-3HP00-4AB0
CPU 1518HF-4 PN 6ES7518-4JP00-0AB0

Supported operating and system states

Like standard S7-1500 CPUs, the S7-1500R/H CPUs have the operating states STOP, STARTUP
and RUN. For operation as a redundant system, one of the two CPUs can take on an additional
operating state, SYNCUP, for synchronizing the two subsystems. The RUN operating state is
divided into the following states for redundant systems:
• RUN
• RUN-Syncup
• RUN-Redundant
The system states of the redundant S7-1500R/H system result from the combination of the
operating states of the individual CPUs as follows:
• STOP
• STARTUP
• RUN-Solo
• SYNCUP
• RUN-Redundant

NOTE
RUN-Solo system state is supported by S7‑PLCSIM Advanced
The simulation of a redundant S7-1500R/H system is possible in the RUN-Solo system state
(RUN operating state of the CPU). In the RUN operating state, the (leading) primary CPU
behaves just like an S7-1500 standard CPU. The MAINT LED on the CPU is always yellow
(maintenance request) because no partner CPU was found for redundant operation.
No simulation is possible with S7‑PLCSIM Advanced in redundant system operation.

S7-PLCSIM Advanced
72 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Simulating
5.5 Simulating a redundant S7-1500R/H system

Unsupported events
The following event is not supported by the R/H CPUs of the redundant S7-1500R/H system:
RackOrStationFault

NOTE
The occurrence of a RackOrStationFault event does not trigger an OnLedChanged event for
R/H CPUs. The ERROR LED is not flashing even though a corresponding device fault message is
displayed in the diagnostic buffer.

Supported functions as of firmware version V3.0

As of FW version V3.0, the S7-1500H redundant system supports PROFINET system
redundancy R1 with the following devices:
• ET 200SP IM 155-6 PN R1
(6ES7155-6AU00-0HM0)
• ET 200SP HA IM 155-6 PN HA
(6DL1155-6AU00-0PM0)
• ET 200iSP IM 152-1 PN
(6ES7152-1BA00-0AB0)
R1 devices are equipped with two interface modules compared to S2 devices. If one interface
module fails, the R1 device can still be reached by the H-CPUs via the second interface
module.
The redundant S7-1500H system thus supports the following additional setup variants:
• Configuration of PROFINET rings with R1 devices
• Line topology configuration with R1 devices, S2 devices, switched S1 devices
• Combined topology configuration with R1 devices and S2 devices
You can load projects consisting of R1 and/or S2 devices in S7‑PLCSIM Advanced and simulate
them. Reading and writing input and output values of simulated R1 and S2 devices works in
the same way as for other simulated IO devices. The simulated R1 and S2 devices support
simulation of external events, such as failure of a redundancy connection. Note the removal
and insertion of R1 devices is not supported by S7‑PLCSIM Advanced.

More information
The Redundant system S7-1500R/H System Manual
(https://support.industry.siemens.com/cs/ww/en/view/109754833) describes in detail the
configuration, installation, wiring and commissioning of the redundant S7-1500R/H system.
The STEP 7 online help supports you in the configuration and programming.
The equipment manuals of the R-, H- and HF-CPUs contain a compact description of the
module-specific information, such as properties, wiring diagrams, characteristics and
technical specifications of the CPUs.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 73
Virtual time response 6
The simulated PLC instance uses two types of internal clocks for the simulation: A virtual clock
and a real clock. The virtual clock is always the basis for the user program. It is used by
components that are relevant for running the STEP 7 user program, such as cyclic OBs, cycle
time monitoring, minimum cycle time, virtual system time and time calculations. Also, the
time between two cycle control or single step control points is measured in virtual time.
The virtual time can be accelerated or slowed for simulation and optimization purposes.
The real clock always runs unchanged. It is used by components that are not subject to
control processes, for example, communication with STEP 7.

Interruption of the process

Since S7‑PLCSIM Advanced runs in a Windows environment, Windows might temporarily
suspend the simulated PLC instance process. In such a case, both the virtual and the real clock
stop in the simulated PLC instance. They only continue to run when Windows resumes
processing.

Virtual system time

When you start S7‑PLCSIM Advanced, the virtual system time of the instance starts with the
system time of Windows.
The virtual system time is based on the virtual clock. If a scaling factor is used, the system
time runs correspondingly faster or slower.
All events from the simulated PLC instance provide a time stamp based on the system time.

NOTE
Difference between system time and local time
• System time: UTC ± 0 with daylight saving / standard time
• Local time: UTC ± time zone with daylight saving time / standard time

Time offset

NOTE
Keep in mind that the time information of virtual system time and real local time differs by
the time offset that is formed in addition to the selected scaling factor from the time zone
offset and the daylight saving time/standard time offset.

Scaling factor
Using a scaling factor, you can speed up or slow down the virtual clock of the simulated PLC
instance for simulations.

S7-PLCSIM Advanced
74 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Virtual time response
6.1 Speed up and slow down simulation

To set the required scaling factor, enable the grayed out icon on the control panel to the
right of your S7‑PLCSIM Advanced instance. The symbol then becomes active and you can
use the scaling function.
• The default setting is 1, i.e. the virtual time passes the same as the real time.
• Fast forward: A scaling factor greater than 1 accelerates the virtual clock.
Example: Scaling factor 2.0 → The virtual time is running twice as fast.
• Slow motion: A scaling factor less than 1 decelerates the virtual clock.
Example: Scaling factor 0.5 → The progress of the virtual time slows down to 50%.

6.1 Speed up and slow down simulation

Influence of fast forward and slow motion

Simulations can be accelerated and slowed down. Fast forward and slow motion only affect
time-based components, for example, cyclic OBs. Compared to the real time, they are
performed more frequently with fast forward and less frequently with slow motion.
Fast forward and slow motion do not change the execution speed of the CPU machine codes.
For example, the speed at which all operations of an OB1 cycle are executed does not
change. The execution speed depends on the processor of the PC on which the simulated PLC
instance is running. If you change the scaling factor, more or fewer cycle control points are
reached in a given period of virtual time.

NOTE
Performance
The performance depends on the size of your project, among other things.
If the scaling factor is too high and the cycle-time monitoring indicates that the PC was
incapable of calculating the OB1 or cyclic OBs in the specified time, the simulated PLC
instance goes to STOP.
Recommendation: To avoid this, start with a small scaling factor and gradually increase it
step-by-step while keeping the simulated PLC instance in RUN.

If an overflow of events occurs, slow down the speed of the simulation. See Monitoring
overflow (Page 83).

Fast forward
To speed up the virtual time, select a scaling factor greater than 1.

Slow motion
To slow down the virtual time, select a scaling factor less than 1.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 75
Restrictions, messages, and solution 7
Certain actions or events can lead to behavior in S7‑PLCSIM Advanced or in STEP 7 that
deviates from a hardware CPU. Differences, messages, and possible solutions can be found in
this chapter on restrictions.

7.1 OPC UA server

With OPC UA, data exchange is performed through an open, standardized and manufacturer-
independent communication protocol. The CPU as OPC UA server can communicate with OPC
UA clients, for example, with HMI panels and SCADA systems.

Configuring an OPC UA server

In S7‑PLCSIM Advanced, start the simulated PLC instances via one of the TCIP/IP adapter
online access points, also known as the PLCSIM Virtual Ethernet Adapter".
The OPC UA server functionality is not available if communication takes place via the PLCSIM
online access point (Softbus).

User authorization for OPC UA

The S7‑PLCSIM Advanced license also contains the user authorization for OPC UA.
The user authorization applies for two simulated PLC instances.

7.2 Web server

The web server integrated in a CPU enables authorized users to monitor and manage the CPU
via a network. This permits evaluation and diagnostics over long distances.
Each S7‑PLCSIM Advanced instance can simulate its own Web server.
The simulation of the Web server is restricted under S7‑PLCSIM Advanced. The freeze state of
a simulated PLC instance is not shown as an internal operating state.

Configuring the Web server

In S7‑PLCSIM Advanced, start the simulated PLC instances via one of the TCIP/IP adapter
online access points, also known as the PLCSIM Virtual Ethernet Adapter".
The Web server functionality is not available if the communication is performed via the
PLCSIM online access point (Softbus).
In STEP 7, configure the Web server in the CPU properties.

S7-PLCSIM Advanced
76 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Restrictions, messages, and solution
7.4 Loading project data of an F-CPU to a standard CPU

Restricted Web server functionality

The following Web server features are restricted as follows:
• The information may not be fully displayed on some websites due to different data
handling.
• There is no topology information.
• FW updates are not supported.

7.3 Backing up and restoring the configuration of an

S7-PLCSIM Advanced instance

Backing up and restoring the configuration

You can backup and restore an S7‑PLCSIM Advanced instance.
You can create as many backups as you want and store a variety of configurations for an
S7‑PLCSIM Advanced instance.
You perform the backup and restore in the TIA Portal as you would in a real CPU.
S7‑PLCSIM Advanced supports backup and restore via web servers.
A backup that was created with S7‑PLCSIM Advanced can only be used with
S7‑PLCSIM Advanced.
It is not possible to restore the configuration of a real CPU with a backup from
S7‑PLCSIM Advanced.

Requirements
• The configuration of an S7‑PLCSIM Advanced instance is backed up and restored over the
TCP/IP protocol. Softbus is not supported.
• It is only possible to restore the configuration of an S7‑PLCSIM Advanced instance with the
corresponding backup from S7‑PLCSIM Advanced.

7.4 Loading project data of an F-CPU to a standard CPU

You have created an instance using the Control Panel. You have not assigned a password to
protect confidential configuration data in STEP 7.
In addition to a standard CPU, you also want to load an F-CPU via Softbus or TCP/IP to an
instance.
When you load project data of an F-CPU to a standard CPU, a window is displayed in the "Load
preview" dialog with the query of a password for access to the CPU.

NOTE
Loading the project data of an F-CPU to a standard CPU
Loading project data of an F-CPU to a standard CPU is not possible.
To download project data to an F-CPU, you have the following options:
• Select an unspecified CPU as a new device.
• Start a new instance with an F-CPU.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 77
Restrictions, messages, and solution
7.6 Restrictions for storage paths

7.5 Update of a TIA Portal project to a new CPU firmware

NOTE
Password encryption in case of updates
When a TIA Portal project is updated from CPU firmware version < V2.0 to CPU firmware
version ≥ V2.0, the following error message is displayed during a download of the project to
S7‑PLCSIM Advanced ≥ V4.0:
"Loading of hardware configuration failed (0020 -3 2 0). Please check the diagnostic buffer of
the target hardware."
To successfully download such a project to SIMATIC S7‑PLCSIM Advanced ≥ V4.0, click the
"Update password encryption" button while updating the project. If the "Update password
encryption" button is not visible in the settings for the CPU's Protection & Security > Access
control, collapse the pane on the right side to make the button visible

7.6 Restrictions for storage paths

Synchronization of the storage path in cloud memory

If the Persistence folder (<...\Persistence\<Instance Name>) is in a path that is synchronized to
a cloud storage, this can lead to the following undesirable behavior:
• Instability or disconnection of active TIA Portal online connections
• Problems with TIA Portal downloads
To prevent this behavior from occurring, you have the following options:
• Do not place the folder of the Virtual SIMATIC Memory Card in a path that is synchronized
to a memory on the cloud.
• Turn off the synchronization of such a folder.

Inaccessible storage path

If the folder of the Virtual SIMATIC Memory Card is on removable media and you remove the
media, S7‑PLCSIM Advanced cannot create an instance on the virtual memory card. It also
cannot access a runtime instance at that location. The Control Panel displays a notification if
it cannot access the path. To correct, replace the media or select a different path for the
Virtual SIMATIC Memory Card from the control panel.

Character restrictions
Storage paths must not include Unicode characters.

S7-PLCSIM Advanced
78 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Restrictions, messages, and solution
7.10 Restrictions to local communication via Softbus

7.7 Restrictions for instance names

Instance names must not include Unicode characters.

7.8 Restrictions for communications services

TUSEND / TURCV
When you run the UDP blocks TUSEND and TURCV via the "PLCSIM" online access (Page 49)
(Softbus), you get error code 0x80C4 at the transmission end and receiving end:
Temporary communications error. The specified connection is temporarily down.
Solution
Set TCP/IP Single Adapter or TCP/IP Multiple Adapter as the online access in
S7‑PLCSIM Advanced.

7.9 Restrictions for instructions

S7‑PLCSIM Advanced simulates instructions for CPUs S7‑1500 and ET 200SP as close to reality
as possible. S7‑PLCSIM Advanced checks the input parameters for validity and returns outputs
that are valid but do not necessarily correspond to those that a real CPU with physical
inputs/outputs would return.

Instructions not supported

Unsupported instructions are treated as non-operational. The value of unsupported
instructions is always "OK". S7‑PLCSIM Advanced does not support the following instructions:
• DP_TOPOL
• PORT_CFG

T_CONFIG instruction
The instruction T_CONFIG works in S7‑PLCSIM Advanced via TCP/IP, but not via Softbus.

7.10 Restrictions to local communication via Softbus

Identical IP addresses for instances

If you are using the "PLCSIM" (Softbus) communication interface when you create instances
through the Control Panel, they all have the same default IP address.
STEP 7, therefore, displays only one instance in the download dialog.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 79
Restrictions, messages, and solution
7.12 Messages for communication via TCP/IP

Working with multiple instances

When you are working with instances without unique IP addresses, note the following
procedure for downloading from TIA Portal via "PLCSIM" (Softbus):

1. Start only one instance with the symbol in the Control Panel.
2. In TIA Portal, download the CPU with its specific IP address to this instance.
3. Repeat the steps until you have created all instances and downloaded all projects.

Online and diagnostics

If the "PLCSIM" (Softbus) communication interface is set, no details are displayed for the
"Online and Diagnostics" function under the PROFINET interface (IP address, MAC address,
etc.).

7.11 Unknown data records

Support of unknown data records

The S7-1500 hardware CPUs return an error code in case of an unknown data record. The
behavior of S7‑PLCSIM Advanced differs from the behavior of an S7-1500 hardware CPU. To
enable simulation of the program flow, S7‑PLCSIM Advanced does not return an error code
for an unknown data record (e.g. ID 0x9999), but acknowledges the unknown data record
with "OK".

7.12 Messages for communication via TCP/IP

Error codes
If an error occurs, an ID with error designation appears in the notification area of the taskbar.
You will find an overview of possible error messages and their associated error codes in the
API manual in the topic ERuntimeErrorCode in the Enumerations chapter.

Figure 7-1 Example: Error code -66

S7-PLCSIM Advanced
80 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Restrictions, messages, and solution
7.12 Messages for communication via TCP/IP

Messages and remedy

The messages related to TCP/IP communication (Page 49) and corresponding remedies are
listed below:
Message
"Siemens PLCSIM Virtual Ethernet Adapter was not found. Please reinstall
S7‑PLCSIM Advanced."
Remedy
The PLCSIM Virtual Ethernet Adapter cannot be found on the system.
Run the S7‑PLCSIM Advanced setup again:
1. Double-click the download package or insert the installation medium into the drive. The
setup program starts up automatically, provided you have not disabled the Autostart
function on the computer. If the setup program does not start up automatically, start it
manually by double-clicking the "Start.exe" file.
2. Follow the prompts until you reach the "Configuration" window. Select the "Repair" check
box.
3. Follow the remaining prompts to repair your installation.
4. Complete the repair operation by restarting your computer.

Message
"Siemens PLCSIM Virtual Ethernet Adapter is disabled. Please enable it."
Remedy
The PLCSIM Virtual Ethernet Adapter is deactivated on the system. In the Control Panel, under
"Network and Sharing Center" > "Change Adapter Settings" and activate the network adapter.

Message
"Npcap service is not running. When installed start it from elevated command prompt with
'net start npcap'."
Remedy
The Npcap is not active on the system. Open a command line in administrator mode and
enter the command "net start npcap".

Message
"You have to set a valid IP address for the Siemens PLCSIM Virtual Ethernet Adapter."
Remedy
Assign a static IP address to the Siemens PLCSIM Virtual Ethernet Adapter or obtain an IP
address via DHCP (default setting).

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 81
Restrictions, messages, and solution
7.14 Restrictions of security with VMware vSphere Hypervisor (ESXi)

7.13 Time synchronization via NTP mode

Time synchronization via NTP mode with S7‑PLCSIM Advanced

You can simulate time synchronization using NTP methods.

7.14 Restrictions of security with VMware vSphere Hypervisor (ESXi)

The following information is only important if you want to communicate with the "outside
world". This means when you access a VM on which the TIA Portal is running from another
virtualization platform on which an instance is running. The following changes are only
necessary if you are not using TCP/IP on the local PC.
• When you use the virtualization platform VMware vSphere Hypervisor (ESXi), you must
change the policy exception to communicate over TCP/IP.
• Accept the "Promiscuous mode" and "Forged transmit" options for the Virtual Switch of the
ESXi.
Promiscuous mode
In promiscuous mode, the network adapter reads all incoming telegrams, including those
that are not intended for the network adapter, and forwards the data to the operating system
for processing.
The promiscuous mode is necessary for the simulation with S7‑PLCSIM Advanced so that
telegrams can be forwarded by the Ethernet adapter to the PC or the VM for processing, for
example, data for additional S7‑PLCSIM Advanced instances in the network.

NOTICE
Restrictions of security
For security reasons, Promiscuous mode is disabled by default.
If you accept the Promiscuous mode, the real Ethernet adapter even receives telegrams that
are not addressed to it.

The following figure shows the "Security" category for selecting the security settings for the
virtual switch in VMware vSphere Hypervisor (ESXi).

Figure 7-2 Policy exceptions for VMware vSphere Hypervisor (ESXi)

S7-PLCSIM Advanced
82 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Restrictions, messages, and solution
7.17 Monitoring overflow

7.15 Restrictions for Hyper-V

The following information is only important if you want to communicate with the "outside
world". Communication with the "outside world" means that you access another VM running
TIA Portal from a virtualization platform running an instance. When you are using TCP/IP on
the local PC, the following settings are not necessary.
When you use the virtualization platform Hyper-V, you must change the following setting to
be able to use the communication over TCP/IP.
1. In the Hyper-V Manager, select the Hyper-V server.
2. Select the VM and its settings via "Settings...".
3. In the "Extended Functions", select "MAC Address Spoofing".
This setting is necessary for the simulation with S7‑PLCSIM Advanced so that telegrams can
be forwarded by the Ethernet adapter to the PC or the VM for processing, for example, data
for additional S7‑PLCSIM Advanced instances in the network.

NOTICE
Restrictions of security
For security reasons, Promiscuous mode is disabled by default.
If you accept the Promiscuous mode, the real Ethernet adapter even receives telegrams that
are not addressed to it.

7.16 Restrictions for AWS Cloud

The AWS Cloud Connector does not support Layer2 Communication. S7‑PLCSIM Advanced
does not fully support cloud-based server use cases within Layer2 communication. Therefore,
the TIA Portal cannot find the simulated PLC instance by ARP Request. As a workaround, set
the IP Address of the instance before starting the download.
If you use TCP/IP Multiple Adapter network mode, you must map network adapters to CPU
interfaces. In case of only the X1 interface, you can use the Control Panel to set the Interface
association to the appropriate network adapter.
If you need to adapt additional interfaces, use the API. Refer to the SetNetInterfaceMapping()
method in the API Function Manual, section "Interfaces for IInstances".
For a successful download from the TIA Portal, you need to set only the IP address of the
simulated PLC instance interface (for example, X1) to which you are downloading.

7.17 Monitoring overflow

Monitoring of main cycle

The maximum cycle time monitoring for S7‑PLCSIM Advanced is one minute.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 83
Restrictions, messages, and solution
7.21 Simulation in standby mode

Monitoring of cyclical events

If your simulation contains cyclic interrupts, the queue of S7‑PLCSIM Advanced can overflow
for cyclic events. Due to the runtime speed of S7‑PLCSIM Advanced compared to real
hardware, the time needed to create the diagnostic buffer entry might be longer than the
time until the next cyclic interrupt.
In this case, an additional entry is placed in the queue, causing another overflow. In the event
of an overflow, S7‑PLCSIM Advanced provides diagnostics buffer messages and a red error
icon in the project tree in STEP 7.

7.18 Deviating I/O values in the STEP 7 user program

Updated values
Each value that a STEP 7 user program changes in the I/O address ranges receives the
updated value in the cycle control point that was written via the API functions Write...
(). The API functions Read...() only return this updated value and not the value from
STEP 7 for the input range.
Non-updated values
If the value was not updated via the API functions Write...(), the API functions
Read...() return the value from STEP 7 for the output range.

7.19 Multiple simulations and possible collision of IP addresses

You can simultaneously simulate multiple CPUs, but each simulated CPU interface requires a
unique IP address.
Make sure your CPUs have different IP addresses before starting the simulation.

7.20 Lacking access to an IP address

Special feature of distributed communication

If you use multiple network nodes on the same subnet through different virtual or real
adapters, the operating system may search for the node on the wrong adapter.
Remedy
Repeat your requests or enter "arp ‑d <IP address>" in the command line editor of Windows.

7.21 Simulation in standby mode

When your computer or programming device goes into standby or sleep mode, the
simulation may stop. In this case, communication between STEP 7 and S7‑PLCSIM Advanced
is stopped. When your computer or programming device starts up again, the communication
may need to be reestablished. In some cases, it may also be necessary to open the simulation
project again.
To prevent this situation, disable the standby mode on your computer or programming
device.

S7-PLCSIM Advanced
84 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Restrictions, messages, and solution
7.24 Known restrictions when operating with a co-simulation, for example, SIMIT

7.22 Time response of S7‑PLCSIM Advanced in connection with I/O

systems
The SingleStep_P operating mode triggers a SyncPointReached event for each imported
process image partition and I/O system.
Example:
If you have defined a process image partition consisting of input addresses of a centralized
and distributed I/O system, the firmware reads the process image partition of the inputs for
each I/O system and sends a SyncPointReached event each time.
The number of SyncPointReached events sent for a process image partition thus depends
on how many different I/O systems the process image partition contains.

7.23 Simulation start of SIMIT with S7-PLCSIM Advanced

Error message during simulation start of SIMIT with S7‑PLCSIM Advanced

You have configured an S7‑PLCSIM Advanced connection in SIMIT. When starting the
simulation, SIMIT aborts and the following error message is returned: "-14
InstanceNotRunning"
When the error has occurred, you can also no longer open the S7‑PLCSIM Advanced instance
using TCP/IP Single Adapter or TCP/IP Multiple Adapter (the PLCSIM Virtual Ethernet Adapter).
Solution
You have the following solution options:
• Repair your S7‑PLCSIM Advanced installation.
• Install S7‑PLCSIM Advanced once again.
The procedures are described in the section Installing (Page 27).
A repair or new installation will install the Npcap program library once again, which solves
the problem.

7.24 Known restrictions when operating with a co-simulation, for

example, SIMIT
In case of a simulation in S7‑PLCSIM Advanced in connection with SIMIT, a TIA Portal
download in RUN may result in an MC error (MC message 431: Communication to the device
under logical address [...] is disturbed. Sign of life of drive faulty).
This error can occur with the following project settings:
• Bus-synchronous operating mode in SIMIT or event-synchronous operating mode to MC
servo process image partition (PIP)
• the S7‑PLCSIM Advanced feature "Strict Motion Timing" = true
The error causes the activated axes to be switched off. You can acknowledge the error via an
MC_Reset or via the TIA Portal. After that, the axis can be switched on again.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 85
Restrictions, messages, and solution
7.26 Installing SIMATIC NET

7.25 ET 200SP CPUs: Use of BusAdapters with fiber-optic interface

ET 200SP CPUs: Use of BusAdapters with fiber-optic interface

If you use BusAdapters with fiber-optic interface for connecting fiber-optic cables (e.g. BA
2xLC), then download via TCP/IP is not possible.
Remedy
Use the communication interface "S7‑PLCSIM" (Softbus) in S7‑PLCSIM Advanced.

7.26 Installing SIMATIC NET

Problems after installing SIMATIC NET PC software products

If you are using one of the following operating systems with S7‑PLCSIM Advanced on your PC,
problems may arise with the S7‑PLCSIM Advanced instances via TCP/IP if you have installed
SIMATIC NET PC software products on your PC:
• Windows 10 Pro, Version 1809
• Windows Server 2019
After installing the SIMATIC NET PC software products, you may no longer be able to start the
S7‑PLCSIM Advanced instances via TCP/IP.
Remedy
Update the operating system on your PC:
• Windows 10, Version ≥ 1903 or
• Windows Server version > 2019

S7-PLCSIM Advanced
86 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
 Restrictions, messages, and solution
7.28 Restrictions for RT_INFO

7.27 No simulation for configuration control

S7‑PLCSIM Advanced does not simulate configuration control, which is also known as option
handling. Refer to the TIA Portal information system for details about configuration control.

7.28 Restrictions for RT_INFO

S7‑PLCSIM Advanced does not support the following RT_INFO reset modes:
• MODE 40: Reset all OB statistics
• MODE 42 to 44: Reset runtime statistics
RT_INFO does not perform the reset operations and does not return the following values:
MODE Description Note Value at OB Data type of Available as of
(decimal) parameter INFO CPU version
40 Reset all OB statist­ "All OB statistics" is understood Not relevant Not relevant S7-1500 V3.1
ics to mean the current, maximum
and minimum runtime of an
OB, see MODE 1 to 3.
42 Reset of longest The longest cycle time can be Not relevant Not relevant S7-1500 V3.1
cycle time read with MODE 23.
43 Reset of shortest The shortest cycle time can be Not relevant Not relevant S7-1500 V3.1
cycle time read with MODE 24.
44 Reset of longest The longest cycle time can be Not relevant Not relevant S7-1500 V3.1
cycle time and read with MODE 23, the
shortest cycle time shortest cycle time with MODE
24.

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 87
Restrictions, messages, and solution
7.33 Axis control panel functionality

7.29 Communication interface is not updated on the control panel

when using an older API
If you are using an S7-PLCSIM Advanced API version older than V6.0, the communicaton
interface might not display correctly on the S7-PLCSIM Advanced V6.0 Control Panel.

7.30 Trace jobs with duplicate timestamps for motion OBs

A trace for an isochronous OB, for example, MC Servo, could sporadically have two values
with the same timestamp.

7.31 The control panel shows VPNs

When using TCP/IP Single Adapter for online access, the list of adapters can include VPNs. You
cannot use these VPNs as network adapters.

7.32 Downloading a central CP with S7-1500R/H CPU family using

TCP/IP
If a central CP exists next to an S7-1500R/H CPU and you start download from STEP 7 to a
simulated PLC instance with an ISO IP (0.0.0.0) in TCP/IP communication, the download fails.
To prevent a failed download, define the IP address of the instance before the download.
If you have already attempted a download, download a second time. The second download
will be successful.

7.33 Axis control panel functionality

If you add a large quantity of axis related Technology objects to your TIA Portal project and
attempt to simulate the PLC with S7-PLCSIM Advanced, you might encounter issues during
commissioning. If you are unable to select "Activate" under Master control or "Enable" under
Axis in the Axis control panel, do one or more of the following:
• Increase the cycle time of the MC-Servo OB
• Lower the virtual time scaling of the S7-PLCSIM Advanced instance
Setting a scaling factor less than 1 scales the virtual time proportionately. For example, a
scale factor of 0.25 means the virtual time is 4 times slower than the system time.
• Use a higher performance PC

S7-PLCSIM Advanced
88 Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG
List of abbreviations A
Abbreviation Term
ALM Automation License Manager
Tool for managing license keys in STEP 7
API Application Programming Interface
arp Address resolution protocol
BCD Binary Coded Decimal
CPU Central Processing Unit (Synonym for PLC)
DLL Dynamic Link Library
HMI Human Machine Interface user interface
I-device Intelligent IO device
IE Industrial Ethernet
GUI Graphical User Interface
LAN Local Area Network
Computer network that is limited to a local area.
MFP Multifunctional platform
MRES Memory Reset
OB Organization Block
ODK Open Development Kit
OPC UA Open Platform Communications Unified Architecture
PA Process image output (PIQ)
PE Process image input (PII)
PG Programming device
PLC Programmable Logic Controller
PN PROFINET
RAM Random Access Memory
RT Runtime
SO Shared Object
TCP/IP Transmission Control Protocol/Internet Protocol
TIA Totally Integrated Automation
PIP Process Image Partition
UTC Coordinated Universal Time
VM Virtual Machine
WinCC Windows Control Center

S7-PLCSIM Advanced
Function Manual, V6.0 UPD1, 03/2024, A5E37039512-AG 89