Presentation of the different devices in PLC-Lab (PLCSIM S7-1200/1500/300/400, Grafcet-Studio, WinSPS-S7, etc.)

PLC-Lab can interact with various PLCs and programming systems. The structure of a system is identical for all target systems, but the operands may be different depending on the device. In the following chapters, a distinction is made between the individual devices.

PLC-Lab supports the following devices in the highest configuration level:

  • PLCSIM S7-1200 as of TIA V13 or higher
  • PLCSIM S7-1500 as of TIA V13 or higher
  • PLCSIM S7-300 as of TIA V13 or higher
  • PLCSIM S7-400 as of TIA V13 or higher
  • PLCSIM S7-300 as of Simatic-Manager V5.5 or higher
  • PLCSIM S7-400 as of Simatic-Manager V5.5 or higher
  • PLCSIM ADVANCED V2.0 SP1 or higher (as of PLC-Lab V1.5.3)
  • Grafcet-Studio
  • WinSPS-S7 V6
  • Real Siemens S7-1200 via Ethernet/Profinet
  • Real Siemens S7-1500 via Ethernet/Profinet
  • Real Siemens S7-300 or compatible via Ethernet/Profinet, NetLink PRO TCP/IP, Simatic-Net
  • Real Siemens S7-400 via Ethernet/Profinet, NetLink PRO TCP/IP, Simatic-Net
  • Real Siemens LOGO! (0BA7, 0BA8 or higher) via Ethernet

If a system is created for a specific device, the system can also be used with another device by rewiring the operands to another device. The prerequisite is that the operands are also present in the new target device. This means that a system for the PLCSIM of the S7-1500 can, for example, also be used for the PLCSIM of the S7-300/400.

Below the different devices in PLC-Lab are named; they are referenced in the sections with examples and additional explanations.

The device with the designation "IM" is the internal memory of PLC-Lab. This memory has a size of 64 kBytes and can be addressed both read and write with bit, byte, word, and double word operands. It only knows the operand type "M" (flag) and has a byte-oriented structure. Operand Example Comment
Bit operand IM.M10.3 At byte address 10 bit 3 is addressed
Byte operand IM.MB100 The byte address 100 is addressed
Word operand IM.MW100 The word 100 is addressed and thus the bytes MB100 and MB101. MB100 is the HiByte.
Double word operand IM.MD100 The double word 100 is addressed and thus the bytes MB100, MB101, MB102, and MB103 are addressed. The MB100 is the HiByte.

Note In the symbol table, the operands are specified without the device name (e.g. only via MB100). The examples in the table above are the operand specifications within the properties of an object (e.g. switches). Typically, operands should be provided with symbols and these should then be used within the properties of the objects.

The operands in the IM device can be used for internal purposes in PLC-Lab, e.g. to store intermediate results or to trigger reactions within the virtual system.

The byte MB65534 of the IM device is designed as a clock memory byte. This means that the individual bits toggle with different frequencies in the RUN state. These bits can then be used, for example, to realize a flashing indication. The table shows the frequencies of the individual bits.

Bit Frequency in Hz
0 10
1 5
2 2.5
3 2
4 1.25
5 1
6 0.625
7 0.5

The device with the designation "PLCSim" is to be used if operands of PLCSIM S7-1200/1500 are to be addressed in the TIA Portal as of V13. The inputs of the PLCSIM are read and the status of the outputs is written.

Note: If the TIA Portal was started as administrator, PLC-Lab must also be started as administrator. The two programs must therefore have both the same access rights.

In the device settings you can define whether the PLCSIM of the S7-1200 or the S7-1500 is to be addressed.

If, for example, the S7-1500 is selected, PLC-Lab tries to establish a connection to the PLCSIM of the S7-1500 when switching to RUN. The setting must be correct: If the PLCSim S7-1200 is started and a search is made for the PLCSim of the S7-1500, no communication will be established.

In addition, the dialog can be used to preset which TIA version is used. If the correct TIA version is selected, the first detection of the PLCSim will be accelerated significantly. The "Universal" setting should be selected if, for example, no connection could be established between PLC-Lab and PLCSim during the exact setting of the TIA Portal. With this setting, the first communication setup will take up most of the time. When the communication between PLC-Lab and PLCSim has been established once, subsequent RUN switching to PLC-Lab will be much faster. Only when the PLCSim has been closed and restarted in the TIA, a completely new communication setup between PLC-Lab and PLCSim must take place. Below you can see the setting where the TIA version V15 is selected:

If the connection between PLC-Lab and PLCSim has to be established for the first time (after restarting the PC, after closing and restarting PLCSim, etc.), then the communication setup takes a few seconds. If no communication has been established within the default time out and all other possible errors have been excluded, the time out duration can be extended accordingly.

At this point we want to refer again to the hardware system requirements of the TIA Portal. Slightly older PC systems or notebooks with power-saving processors are too slow for the TIA Portal.

For the TIA V15, for example, we recommend:

  • Core i5-6440EQ, 3.4 GHz
  • RAM 16 GB
  • SSD with at least 50GB free disk space

Inputs and outputs are supported as operands. The inputs in the virtual system should be written by PLC-Lab and the outputs should be read.

Supported operand bytes when using PLCSIM S7-1500

PLCSIM S7-1500 supports the input bytes IB0 to IB462. The bytes QB0 to QB510 can be used as output bytes.

Prohibited operand bytes when using PLCSIM S7-1500

The following operands must not be used in the PLC program if the PLCSIM S7-1500 is used:

  • All input bytes starting at IB463 and higher.
  • All output bytes starting at QB511 and higher.

Supported operand bytes when using PLCSIM S7-1200

PLCSIM S7-1200 supports the input bytes IB0 to IB510. The bytes QB0 to QB510 can be used as output bytes.

Prohibited operand bytes when using PLCSIM S7-1200

The following operands must not be used in the PLC program if the PLCSIM S7-1200 is used:

  • All input bytes starting at IB511 and higher.
  • All output bytes starting at QB511 and higher.

The inputs and outputs can be addressed as bit, byte, word, or double word operands.

Operand Example Comment
Bit operand PLCSim.I10.3 At the byte address 10 bit 3 is addressed
Byte operand PLCSim.IB100 Byte address 100 is addressed
Word operand PLCSim.IW100 The word 100 is addressed and thus the bytes IB100 and IB101. IB100 is the HiByte.
Double word operand PLCSim.ID100 The double word 100 is addressed and thus the bytes IB100, IB101, IB102, and IB103 are addressed. The IB100 is the HiByte.

Note In the symbol table, the operands are specified without the device name (e.g. only via IB100). The examples in the table above are the operand specifications within the properties of an object (e.g. switches). Typically, operands should be provided with symbols and these should then be used within the properties of the objects.

The following steps are necessary if you want to create a new S7-1200/1500 project in the TIA Portal and test the PLC program using PLCSim S7-1200/1500 and a virtual system in PLC-Lab.

  1. Open the PLC-Lab template project from the directory "...\Automation\PLC-Lab-Editor\" in your files. You must use the template for the S7-1200 or S7-1500 respectively. Depending on the TIA version, the project is upgraded when it is opened.
  2. Save the project under a different name: After opening the template project, the TIA switches to the project view. You can then execute the menu item "Project->Save as". Then save the project under a new name in any directory.
  3. Now you can start creating your own PLC program. In OB1, the call of the function "MHJ-PLC-Lab-Function-S71500" or "MHJ-PLC-Lab-Function-S71200" in network 1 must be retained. You start with your own PLC program from network 2 of OB1.
  4. If you want to test the PLC program in PLCSim, select the menu item "Online->Simulation->Start" or press the corresponding mouse button. If PLCSim is in Run mode, PLC-Lab can also be set to Run mode.
  5. Now you can view the blocks in TIA in observe mode and simultaneously operate the virtual system in PLC-Lab.

If in an existing PLC project the hardware configuration is changed according to the specification and the function "MHJ-PLC-Lab-Function-S71500" or "MHJ-PLC-Lab-Function-S71200" is called in network 1 of OB1, then the PLC program can also be tested with PLC-Lab.

  1. Open the existing project in the TIA Portal, select the project view and double-click on the device configuration within the existing PLC station.
  2. Set the minimum cycle time of the CPU to 5 ms. This is necessary because the PLCSim otherwise generates a high PC CPU load. This is independent of the use of PLC-Lab.
  3. Place a DI16 module on a free slot and assign the start address 512. Then switch off the updating function of the process image for this module.
  4. Display the task card "Reference projects" via the menu item "View->Reference projects".
  5. In the task card "Reference projects", the PLC-Lab S7-1500 Advanced template project from the directory "...\Automation\PLC-Lab-Editor\" is now opened within your own files.
  6. Copy the function "MHJ-PLC-Lab-Function-S71500" from the PLC-Lab Advanced template project for the S7-1500 into the project. To do this, copy the function to the program blocks of the existing TIA project in the reference project within the program blocks using drag & drop.
  7. The function "MHJ-PLC-Lab-Function-S71500" is called in the network 1 of OB1. The minimum and maximum input byte addresses to be addressed from PLC-Lab must be specified at the parameters "MinDiByte" and "MaxDiByte". In the call shown below, for example, the input bytes IB0 to IB15 can be written via objects in PLC-Lab.

Make sure that these addresses are occupied by input modules and that the process image of these modules is switched off.

Now the existing TIA project can be simulated with PLC-Lab.

As of version 1.5.0.4 of PLC-Lab, the function "MHJ-PLC-Lab-Function-S71500-NextInputArea" is also included in the advanced template project for the S7-1500. The call of this function can be attached to the ENO output of the function "MHJ-PLC-Lab-Function-S71500" in network 1 of OB1.

This allows several input ranges to be defined, which can be influenced from PLC-Lab. This is particularly interesting if there are large gaps between individual input ranges and there are no input modules in the hardware configuration for these gaps. The following is an example where the input ranges IB0 to IB10, IB50 to IB60 and IB90 to IB100 are available as modules.

Additional calls of the FC "MHJ-PLC-Lab-Function-S71500-NextInputArea" can follow.

In contrast to the input modules of the central periphery, the updating of the process image of the input modules that are available decentrally (e.g. on Profinet IO devices) must not be switched off. This is true for the PLCSim of the TIA versions V13, V14, V15, and V15.1.

  1. Open the existing project in the TIA Portal, select the project view and double-click on the device configuration within the existing PLC station.
  2. Selecting the CPU and the digital inputs. With the digital inputs, the process image must be set to "None".

The same applies to analog inputs: You must also make this setting there!

  1. Set the minimum cycle time of the CPU to 30 ms. This is necessary because the PLCSim otherwise generates a high PC CPU load. This is independent of the use of PLC-Lab.
  2. If the PLC has additional input modules, you must also set the process image for these to "None".
  3. Copy the function "MHJ-PLC-Lab-Function-S71200" from the PLC-Lab template project for the S7-1200 into the project and call it in network 1 of OB1. To do this, open the PLC-Lab template project for the S7-1200 from the directory "...\Automation\PLC-Lab-Editor\" in the task card "Reference projects" and copy the function there.
  4. Now the project can be used for simulations in PLCSim and PLC-Lab.

Tip: You can leave the PLC-Lab template projects for the S7-1200 and S7-1500 open in the reference projects. These are then available for all projects, even if the TIA is closed and reopened.

In the following section you will find an example showing the interaction between PLC-Lab and the PLCSIM S7-1200/1500 of the TIA Portal. The PLC-Lab template project is used for this purpose: PLCSIM S7-1200/1500 in the Siemens TIA Portal

The device with the designation "PLCSim300" is to be used if operands of PLCSIM S7-300/400 in the TIA Portal as of V13 or the Simatic Manager as of V5.5 are to be addressed.

Inputs, outputs, flags, and data from data blocks are supported as operands. The inputs in the virtual system should be written by PLC-Lab and the outputs should be read.

The inputs, outputs, and flags can be addressed as bit, byte, word, or double word operands.

Operand Example Comment
Bit operand PLCSim300.I10.3 Bit 3 is addressed at the byte address 10
Byte operand PLCSim300.IB100 Byte address 100 is addressed
Word operand PLCSim300.IW100 The word 100 is addressed and thus the bytes IB100 and IB101. IB100 is the HiByte.
Double word operand PLCSim300.ID100 The double word 100 is addressed and thus the bytes IB100, IB101, IB102 and IB103. The IB100 is the HiByte.

Note: In the symbol table, the operands are specified without the device name (e.g. only via IB100). The examples in the table above are the operand specifications within the properties of an object (e.g. switches). Typically, operands should be provided with symbols and these should then be used within the properties of the objects.

For inputs and outputs it must be noted that only operands within the process image can be addressed. If, for example, a CPU 314 PN/DP is used and the analog I/Os with the standard addresses 800 or higher are addressed, then the PAE/PAA of the CPU in the hardware configuration must be set to, for example, 1024 bytes. This setting is made on the dialog of the CPU in the register "Cycle/Clock memory byte" of the hardware configurator.

The data of data blocks can be addressed as bit, byte, word, or double word operands. In addition to the operand, the data block itself must also be specified. A prerequisite for the use of DB data is that the DB is located in the CPU (or in the PLCSIM) and the corresponding addresses are present in the DB.

Operand Example Comment
Bit operand PLCSim300.DB31.DBX10.3 Within the data block DB31, bit 3 is addressed at byte address 10
Byte operand PLCSim300.DB31.DBB100 Within the data block DB31, the byte address 100 is addressed
Word operand PLCSim300.DB31.DBW100 Within the data block DB31, the word 100 is addressed and thus the bytes DBB100 and DBB101. DBB100 is the HiByte.
Double word operand PLCSim300.DB31.DBD100 Within the data block DB31, the double word 100 is addressed and thus the bytes DBB100, DBB101, DBB102 and DBB103. DBB100 is the HiByte.

Note: In the symbol table, the operands are specified without the device name (e.g. only via DB31.DBX100.2). The examples in the table above are the operand specifications within the properties of an object (e.g. switches). Typically, operands should be provided with symbols and these should then be used within the properties of the objects.

In the following section you will find an example showing the interaction between PLC-Lab and the PLCSIM S7-300/400 of the TIA Portal or the Simatic Manager.

Example for PLCSIM S7-300/400 in the TIA Portal: PLCSIM S7-300/400 in the Siemens TIA Portal

Example for PLCSIM S7-300/400 in the Simatic Manager: PLCSIM S7-300/400 in the Siemens Simatic Manager

With the PLCSIM Advanced, Siemens offers an extended simulation for the S7-1500. PLCSIM Advanced is not included in the TIA Portal, but can be purchased separately. It offers numerous advantages over the PLCSIM that is integrated in the TIA Portal. For example, more than one instance and thus more than one simulation PLC can be created on one PC. The instances can communicate with each other, as is the case with the real S7-1500. Furthermore, a real HMI can access such an instance via Ethernet, which is not possible with the PLCSIM of the TIA Portal. In other words, PLCSIM Advanced can be used to start and simulate several S7-1500s on one PC.

PLC-Lab (as of V1.5.3) supports PLCSIM Advanced as of version 2.0 SP1. You can access different instances of PLC-SIM Advanced from a PLC-Lab project. The instance is identified by the instance name, which must be specified on the PLCSIM Advanced Control Panel for each instance.

Below you can see the PLCSIM Advanced Control Panel, where two instances with the designations "Instance1" and "Instance2" have been started.

To address the PLC with the designation "Instance1" from PLC-Lab, proceed as follows.

First, click on the icon for creating a new device in the symbol table of an open PLC-Lab project.

Now the dialog "Create a new device respectively connection" appears. Select "PLCSIM Advanced" as the device type and enter a name for the new device. In the example we use the name "PlcSimAdv01".

Click OK to confirm the settings. The dialog "PLCSIM Advanced settings" appears. Here you have to specify the name of the instance with which the data is to be exchanged. In the example, the instance with the name "Instance1" is to be used for the exchange, which is why you have to enter this name.

When you confirm this dialog, the newly created device is added to the list of available devices. You can then create symbols for the device. In the image three operands were created for the device.

When the operands are used in objects of the PLC system, a connection to this instance is established at the start of the simulation and the data is exchanged.

Make sure that the input and output modules for the inputs and outputs used in PLC-Lab are available in the hardware configuration of the S7-1500. Otherwise PLCSIM Advanced will not synchronize them correctly with the process image.

Inputs, outputs, and flags are supported as operands. The inputs in the virtual system should be written by PLC-Lab and the outputs should be read.

The inputs, outputs, and flags can be addressed as bit, byte, word, or double word operands. In the table the operands are assigned to the device with the name "PlcSimAdv01".

Operand Example Comment
Bit operand PLCSimAdv01.I10.3 Bit 3 is addressed at the byte address 10
Byte operand PLCSimAdv01.IB100 Byte address 100 is addressed
Word operand PLCSimAdv01.IW100 The word 100 is addressed and thus the bytes IB100 and IB101. IB100 is the HiByte.
Double word operand PLCSimAdv01.ID100 The double word 100 is addressed and thus the bytes IB100, IB101, IB102 and IB103. The IB100 is the HiByte.

Note: In the symbol table, the operands are specified without the device name (e.g. only via IB100). The examples in the table above are the operand specifications within the properties of an object (e.g. switches). Typically, operands should be provided with symbols and these should then be used within the properties of the objects.

Make sure that the input and output modules for the inputs and outputs used in PLC-Lab are available in the hardware configuration of the S7-1500. Otherwise PLCSIM Advanced will not synchronize them correctly with the process image.

Example for PLCSIM Advanced: Siemens PLCSIM Advanced

The device with the designation "Sim" is to be used if PLC-Lab is used together with Grafcet-Studio or WinSPS-S7 V6. In WinSPS-S7 V6, you must set the target "Simulator".

Inputs, outputs, flags, and data from data blocks are supported as operands. The inputs in the virtual system should be written by PLC-Lab and the outputs should be read.

The inputs, outputs, and flags can be addressed as bit, byte, word, or double word operands. If PLC-Lab is used together with Grafcet-Studio, it does not make sense to use flags.

Operand Example Comment
Bit operand Sim.E10.3 At byte address 10 bit 3 is addressed
Byte operand Sim.IB100 Byte address 100 is addressed
Word operand Sim.IW100 The word 100 is addressed and thus the bytes IB100 and IB101. IB100 is the HiByte.
Double word operand Sim.ID100 The double word 100 is addressed and thus the bytes IB100, IB101, IB102, and IB103 are addressed. The IB100 is the HiByte.

Note: In the symbol table, the operands are specified without the device name (e.g. only via IB100). The examples in the table above are the operand specifications within the properties of an object (e.g. switches). Typically, operands should be provided with symbols and these should then be used within the properties of the objects.

The data of data blocks can be addressed as bit, byte, word, or double word operands. In addition to the operand, the data block itself must also be specified. A prerequisite for the use of DB data is that the DB is located in the CPU (or in the simulator of the WinSPS-S7 V6) and the corresponding addresses are present in the DB. If PLC-Lab is used together with Grafcet-Studio, it does not make sense to use DBs.

Operand Example Comment
Bit operand Sim300.DB31.DBX10.3 Within the data block DB31, bit 3 is addressed at byte address 10
Byte operand Sim300.DB31.DBB100 Within the data block DB31, the byte address 100 is addressed
Word operand Sim300.DB31.DBW100 Within the data block DB31, the word 100 is addressed and thus the bytes DBB100 and DBB101. DBB100 is the HiByte.
Double word operand Sim300.DB31.DBD100 Within the data block DB31, the double word 100 is addressed and thus the bytes DBB100, DBB101, DBB102 and DBB103. DBB100 is the HiByte.

Note: In the symbol table, the operands are specified without the device name (e.g. only via DB31.DBX100.2). The examples in the table above are the operand specifications within the properties of an object (e.g. switches). Typically, operands should be provided with symbols and these should then be used within the properties of the objects.

In the following section you will find an example showing the interaction between PLC-Lab and WinSPS-S7 V6 or Grafcet-Studio

Example for WinSPS-S7 V6: PLC-Lab and WinSPS-S7 V6

Example for Grafcet-Studio: PLC-Lab and Grafcet-Studio

If the PLC-Lab edition supports this, PLC-Lab can be connected to a real Siemens S7-300 or S7-400. The connection to systems compatible with S7-300 from VIPA (SPEED7, Slio or Micro) is also possible. If the CPU has a Profinet or Ethernet interface, the connection can be established between the network card of the PC running PLC-Lab and the interface of the CPU using an Ethernet cable.

Furthermore, it is possible to establish a connection between the PC and a MPI or DP interface with the help of a NetLink Pro adapter.

The third option is Simatic Net. This is only available if the driver is installed on the PC. This is always the case if either the Simatic Manager or the TIA Portal is installed. In this case, the Siemens MPI adapters (e.g., CP5711 or USB MPI adapter) can also be used.

In the following section you will find an example which shows the cooperation between PLC-Lab and a real CPU of the families S7-300/400 or compatible ones. The operands that can be used are also named.

PLC-Lab and real S7-300/400 from Siemens or compatible

If the PLC-Lab edition supports this, PLC-Lab can be connected to a real Siemens S7-1200 or S7-1500. Because these CPUs always have a Profinet interface, the connection can be established between the network card of the PC running PLC-Lab and the interface of the CPU using an Ethernet cable.

In the following section you will find an example which shows the interaction between PLC-Lab and a real CPU of the Siemens S7-1200/1500 families. The operands that can be used are also named.

Example with PLC-Lab and a real Siemens S7-1200: PLC-Lab and real Siemens S7-1200

Example with PLC-Lab and a real Siemens S7-1500: PLC-Lab and real Siemens S7-1500

If this is supported by the PLC-Lab edition, PLC-Lab can be used with a real LOGO! 0BA7, 0BA8 or newer. Because these LOGOs always have an Ethernet interface, the connection can be established using an Ethernet cable between the network card of the PC running PLC-Lab and the LOGO interface.

In the following section you will find an example which shows the interaction between PLC-Lab and a real Siemens LOGO!. The operands that can be used are also named.

Example with PLC-Lab and a real Siemens LOGO!: [PLC-Lab and real Siemens LOGO!] (device-logo-von-siemens)