EcoStruxure Control Expert

PLC Simulator
Original instructions

EIO0000001714.09
01/2023

www.se.com
Legal Information
The Schneider Electric brand and any trademarks of Schneider Electric SE and its
subsidiaries referred to in this guide are the property of Schneider Electric SE or its
subsidiaries. All other brands may be trademarks of their respective owners.
This guide and its content are protected under applicable copyright laws and furnished for
informational use only. No part of this guide may be reproduced or transmitted in any form or
by any means (electronic, mechanical, photocopying, recording, or otherwise), for any
purpose, without the prior written permission of Schneider Electric.
Schneider Electric does not grant any right or license for commercial use of the guide or its
content, except for a non-exclusive and personal license to consult it on an "as is" basis.
Schneider Electric products and equipment should be installed, operated, serviced, and
maintained only by qualified personnel.
As standards, specifications, and designs change from time to time, information contained in
this guide may be subject to change without notice.
To the extent permitted by applicable law, no responsibility or liability is assumed by
Schneider Electric and its subsidiaries for any errors or omissions in the informational
content of this material or consequences arising out of or resulting from the use of the
information contained herein.

As part of a group of responsible, inclusive companies, we are updating our communications

that contain non-inclusive terminology. Until we complete this process, however, our content
may still contain standardized industry terms that may be deemed inappropriate by our
customers.

© 2023 – Schneider Electric. All rights reserved

Table of Contents
Safety Information ....................................................................................................5
Before You Begin .....................................................................................................6
Start-up and Test......................................................................................................7
Operation and Adjustments.......................................................................................8
About the Book .........................................................................................................9
Simulating a Controller ..........................................................................................14
Introduction............................................................................................................14
PLC Simulator Cyber Security .................................................................................15
Loading a Project in PLC Simulator..........................................................................16
PLC Simulator Icon in the Toolbar............................................................................20
Differences Between the PLC Simulator and a Physical Controller................23
Limitations of the PLC Simulator..............................................................................23
IP Address and Communication Port Simulation .......................................................26
System Bits and System Words...............................................................................28
Menu Commands and Dialog Boxes in the PLC Simulator ..............................29
Simulator Control ...................................................................................................29
Simulator Control for Unknown CPU ........................................................................29
Simulator Control for Modicon M580 CPU ................................................................32
Simulator Control for Modicon M580 Safety CPU......................................................35
Memory Card for Modicon M580 CPU......................................................................38
Simulator Control for Modicon Quantum CPU...........................................................42
Simulator Control for Modicon Quantum Safety CPU ................................................45
Simulator Control for Modicon Premium CPU ...........................................................49
Simulator Control for Modicon M340 CPU ................................................................51
Memory Card for Modicon M340 CPU......................................................................54
Simulator Control for Modicon Momentum CPU........................................................58
Event Dialog ..........................................................................................................60
Clear .....................................................................................................................62
Reset ....................................................................................................................62
Power Cycle ..........................................................................................................62
Simulator Panel Options ......................................................................................63
Timing (simulator) ..................................................................................................65

EIO0000001714.09 3
 Processor Load......................................................................................................66
Priority of the Simulator...........................................................................................68
Data in the User Task .............................................................................................69
Minimum Sleep Time ..............................................................................................71
Info .......................................................................................................................72
Help ......................................................................................................................72
Ending the Simulation.............................................................................................72
Index .........................................................................................................................73

4 EIO0000001714.09
Safety Information

Safety Information
Important Information
Read these instructions carefully, and look at the equipment to become familiar with the
device before trying to install, operate, service, or maintain it. The following special
messages may appear throughout this documentation or on the equipment to warn of
potential hazards or to call attention to information that clarifies or simplifies a procedure.

The addition of this symbol to a “Danger” or “Warning” safety label indicates that an
electrical hazard exists which will result in personal injury if the instructions are not
followed.

This is the safety alert symbol. It is used to alert you to potential personal injury
hazards. Obey all safety messages that follow this symbol to avoid possible injury or
death.

! DANGER
DANGER indicates a hazardous situation which, if not avoided, will result in death or serious
injury.

! WARNING
WARNING indicates a hazardous situation which, if not avoided, could result in death or
serious injury.

! CAUTION
CAUTION indicates a hazardous situation which, if not avoided, could result in minor or
moderate injury.

NOTICE
NOTICE is used to address practices not related to physical injury.

EIO0000001714.09 5
 Safety Information

Please Note
Electrical equipment should be installed, operated, serviced, and maintained only by
qualified personnel. No responsibility is assumed by Schneider Electric for any
consequences arising out of the use of this material.
A qualified person is one who has skills and knowledge related to the construction and
operation of electrical equipment and its installation, and has received safety training to
recognize and avoid the hazards involved.

Before You Begin

Do not use this product on machinery lacking effective point-of-operation guarding. Lack of
effective point-of-operation guarding on a machine can result in serious injury to the
operator of that machine.

WARNING
UNGUARDED EQUIPMENT
• Do not use this software and related automation equipment on equipment which does
not have point-of-operation protection.
• Do not reach into machinery during operation.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.

This automation equipment and related software is used to control a variety of industrial
processes. The type or model of automation equipment suitable for each application will
vary depending on factors such as the control function required, degree of protection
required, production methods, unusual conditions, government regulations, etc. In some
applications, more than one processor may be required, as when backup redundancy is
needed.
Only you, the user, machine builder or system integrator can be aware of all the conditions
and factors present during setup, operation, and maintenance of the machine and,
therefore, can determine the automation equipment and the related safeties and interlocks
which can be properly used. When selecting automation and control equipment and related
software for a particular application, you should refer to the applicable local and national
standards and regulations. The National Safety Council's Accident Prevention Manual
(nationally recognized in the United States of America) also provides much useful
information.
In some applications, such as packaging machinery, additional operator protection such as
point-of-operation guarding must be provided. This is necessary if the operator's hands and

6 EIO0000001714.09
Safety Information

other parts of the body are free to enter the pinch points or other hazardous areas and
serious injury can occur. Software products alone cannot protect an operator from injury. For
this reason the software cannot be substituted for or take the place of point-of-operation
protection.
Ensure that appropriate safeties and mechanical/electrical interlocks related to point-of-
operation protection have been installed and are operational before placing the equipment
into service. All interlocks and safeties related to point-of-operation protection must be
coordinated with the related automation equipment and software programming.
NOTE: Coordination of safeties and mechanical/electrical interlocks for point-of-
operation protection is outside the scope of the Function Block Library, System User
Guide, or other implementation referenced in this documentation.

Start-up and Test

Before using electrical control and automation equipment for regular operation after
installation, the system should be given a start-up test by qualified personnel to verify
correct operation of the equipment. It is important that arrangements for such a check are
made and that enough time is allowed to perform complete and satisfactory testing.

WARNING
EQUIPMENT OPERATION HAZARD
• Verify that all installation and set up procedures have been completed.
• Before operational tests are performed, remove all blocks or other temporary holding
means used for shipment from all component devices.
• Remove tools, meters, and debris from equipment.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.

Follow all start-up tests recommended in the equipment documentation. Store all equipment
documentation for future references.
Software testing must be done in both simulated and real environments.
Verify that the completed system is free from all short circuits and temporary grounds that
are not installed according to local regulations (according to the National Electrical Code in
the U.S.A, for instance). If high-potential voltage testing is necessary, follow
recommendations in equipment documentation to prevent accidental equipment damage.
Before energizing equipment:
• Remove tools, meters, and debris from equipment.

EIO0000001714.09 7
 Safety Information

• Close the equipment enclosure door.

• Remove all temporary grounds from incoming power lines.
• Perform all start-up tests recommended by the manufacturer.

Operation and Adjustments

The following precautions are from the NEMA Standards Publication ICS 7.1-1995:
(In case of divergence or contradiction between any translation and the English original, the
original text in the English language will prevail.)
• Regardless of the care exercised in the design and manufacture of equipment or in the
selection and ratings of components, there are hazards that can be encountered if such
equipment is improperly operated.
• It is sometimes possible to misadjust the equipment and thus produce unsatisfactory or
unsafe operation. Always use the manufacturer’s instructions as a guide for functional
adjustments. Personnel who have access to these adjustments should be familiar with
the equipment manufacturer’s instructions and the machinery used with the electrical
equipment.
• Only those operational adjustments required by the operator should be accessible to
the operator. Access to other controls should be restricted to prevent unauthorized
changes in operating characteristics.

8 EIO0000001714.09
About the Book

About the Book

Document Scope
This document describes the PLC Simulator tool for EcoStruxureTM™ Control Expert.
It is referred to as “PLC Simulator” in the rest of the document.

Validity Note
This document has been updated for the release of EcoStruxure™ Control Expert 15.3.
The technical characteristics of the devices described in the present document also appear
online. To access the information online, go to the Schneider Electric home page www.se.
com/ww/en/download/.
The characteristics that are described in the present document should be the same as those
characteristics that appear online. In line with our policy of constant improvement, we may
revise content over time to improve clarity and accuracy. If you see a difference between the
document and online information, use the online information as your reference.

Related Documents
Title of documentation Reference number
EcoStruxure™ Control Expert, System Bits and Words, EIO0000002135 (ENG)
Reference Manual EIO0000002136 (FRE)
EIO0000002137 (GER)
EIO0000002139 (SPA)
EIO0000002138 (ITA)
EIO0000002140 (CHS)

EcoStruxure™ Control Expert, Program Languages 33002539 (ENG)

and Structure, Reference Manual 35006145 (FRE)
35006146 (GER)
35006147 (SPA)
35013361 (ITA)
35013362 (CHS)

Modicon M580, Safety System Planning Guide QGH60283 (ENG)

QGH60284 (FRE)
QGH60285 (GER)
QGH60287 (SPA)
QGH60286 (ITA)
QGH60288 (CHS)

EIO0000001714.09 9
 About the Book

Title of documentation Reference number

EcoStruxure™ Control Expert, Operating Modes 33003101 (ENG)
33003102 (FRE)
33003103 (GER)
33003104 (SPA)
33003696 (ITA)
33003697 (CHS)

EcoStruxure™ Control Expert, System, Block Library 33002539 (ENG)

33002540 (FRE)
33002541 (GER)
33002542 (SPA)
33003688 (ITA)
33003689 (CHS)

Product Related Information

WARNING
LOSS OF CONTROL
• Perform a Failure Mode and Effects Analysis (FMEA), or equivalent risk analysis, of
your application, and apply preventive and detective controls before implementation.
• Provide a fallback state for undesired control events or sequences.
• Provide separate or redundant control paths wherever required.
• Supply appropriate parameters, particularly for limits.
• Review the implications of transmission delays and take actions to mitigate them.
• Review the implications of communication link interruptions and take actions to
mitigate them.
• Provide independent paths for control functions (for example, emergency stop, over-
limit conditions, and error conditions) according to your risk assessment, and
applicable codes and regulations.
• Apply local accident prevention and safety regulations and guidelines.1
• Test each implementation of a system for proper operation before placing it into
service.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.

1 For additional information, refer to NEMA ICS 1.1 (latest edition), Safety Guidelines for the
Application, Installation, and Maintenance of Solid State Control and to NEMA ICS 7.1
(latest edition), Safety Standards for Construction and Guide for Selection, Installation and
Operation of Adjustable-Speed Drive Systems or their equivalent governing your particular
location.

10 EIO0000001714.09
About the Book

WARNING
UNINTENDED EQUIPMENT OPERATION
• Only use software approved by Schneider Electric for use with this equipment.
• Update your application program every time you change the physical hardware
configuration.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.

Terminology Derived from Standards

The technical terms, terminology, symbols and the corresponding descriptions in this
manual, or that appear in or on the products themselves, are generally derived from the
terms or definitions of international standards.
In the area of functional safety systems, drives and general automation, this may include,
but is not limited to, terms such as safety, safety function, safe state, fault, fault reset,
malfunction, failure, error, error message, dangerous, etc.

EIO0000001714.09 11
 About the Book

Among others, these standards include:

Standard Description

IEC 61131-2:2007 Programmable controllers, part 2: Equipment requirements and tests.

ISO 13849-1:2015 Safety of machinery: Safety related parts of control systems.

General principles for design.

EN 61496-1:2013 Safety of machinery: Electro-sensitive protective equipment.

Part 1: General requirements and tests.

ISO 12100:2010 Safety of machinery - General principles for design - Risk assessment and risk
reduction
EN 60204-1:2006 Safety of machinery - Electrical equipment of machines - Part 1: General requirements

ISO 14119:2013 Safety of machinery - Interlocking devices associated with guards - Principles for
design and selection

ISO 13850:2015 Safety of machinery - Emergency stop - Principles for design

IEC 62061:2015 Safety of machinery - Functional safety of safety-related electrical, electronic, and
electronic programmable control systems

IEC 61508-1:2010 Functional safety of electrical/electronic/programmable electronic safety-related

systems: General requirements.

IEC 61508-2:2010 Functional safety of electrical/electronic/programmable electronic safety-related

systems: Requirements for electrical/electronic/programmable electronic safety-related
systems.

IEC 61508-3:2010 Functional safety of electrical/electronic/programmable electronic safety-related

systems: Software requirements.

IEC 61784-3:2016 Industrial communication networks - Profiles - Part 3: Functional safety fieldbuses -
General rules and profile definitions.

2006/42/EC Machinery Directive

2014/30/EU Electromagnetic Compatibility Directive

2014/35/EU Low Voltage Directive

12 EIO0000001714.09
About the Book

In addition, terms used in the present document may tangentially be used as they are
derived from other standards such as:

Standard Description

IEC 60034 series Rotating electrical machines

IEC 61800 series Adjustable speed electrical power drive systems

IEC 61158 series Digital data communications for measurement and control – Fieldbus for use in
industrial control systems

Finally, the term zone of operation may be used in conjunction with the description of
specific hazards, and is defined as it is for a hazard zone or danger zone in the Machinery
Directive (2006/42/EC) and ISO 12100:2010.
NOTE: The aforementioned standards may or may not apply to the specific products
cited in the present documentation. For more information concerning the individual
standards applicable to the products described herein, see the characteristics tables for
those product references.

EIO0000001714.09 13
 Simulating a Controller

Simulating a Controller
Overview
This chapter describes simulating a controller.

Introduction
General Description
PLC Simulator is supplied prior to a physical controller deployment for test purposes only. It
does not replace the physical controller and the application based only on simulation cannot
be used in a production environment without physically testing and commissioning that
application, nor can you use the PLC Simulator as a virtual controller.

Installation
PLC Simulator is automatically installed with Control Expert (PLC Simulation functionality).
It is located in the Control Expert repository.
Refer to Differences Between the PLC Simulator and a Physical Controller, page 23 of this
guide for further information.

Area of Use
PLC Simulator allows you to simulate a controller.
The use of Breakpoints, Stepping and the GoTo function enable you to test your program in
the simulated controller.

Structure of the PLC Simulator

The Simulator Dialog box, page 29 provides the following indications:
• Type of simulated controller.

14 EIO0000001714.09
Simulating a Controller

• Status of the simulated controller.

• Name of the loaded project.
• IP address and DNS name of the host PC for PLC Simulator.
• IP addresses and DNS names of connected client PCs.
• Dialog box to simulate IO events.
• Reset button to simulate a cold start.
• Power Cycle button to simulate a warm start.
• Shortcut menu (right mouse button) to control PLC Simulator.
The PLC Simulator symbol shown in the task bar offers the following features:
• Display of the status of the simulated controller, page 20.
• QuickInfo (Tooltips) shows the IP address of the host PC for PLC Simulator, the port
number used and the name of the loaded project.
• Shortcut menu (right mouse button) to control PLC Simulator.

PLC Simulator Cyber Security

At a Glance
Refer to the Simulator Panel Options, page 63 chapter to get the list of Cyber Security
settings to apply while using PLC Simulator. PLC Simulator does not embed the same level
of protection as that of Control Expert software programming a physical controller.
The following rules are applied to PLC Simulator:
• PLC Simulator only starts with a loaded application.
• PLC Simulator does not allow the upload of a password-protected application in
monitoring mode.

PLC Simulator Only Starts with a Loaded Application

The Simulator Panel Options supplies a new check box Use default application to start
simulator (enforce security) and a new field to give the application path:
• If the Use default application to start simulator (enforce security) box is selected,
an application with a password is accessible by the path given in the field.
It is the default option.

EIO0000001714.09 15
 Simulating a Controller

• If the Use default application to start simulator (enforce security) box is cleared, a
message is displayed to inform that the PLC Simulator use is not secured on its 502
Port.
At first start of PLC Simulator, the box is selected but the path is empty. A popup message
informs that:
• A valid Control Expert application is mandatory to start PLC Simulator.
• To help enforce security, it is necessary to use an Application Password.
NOTE: A password-protected application is necessary to help enforce security on
Ethernet port of your computer which is by default port 502.
When PLC Simulator is started from Control Expert (the menu PLC > Connect) or from
Windows menus with Use default application to start simulator (enforce security) box
selected:
• If there is no application with a password in the PLC Simulator or the application path is
not valid, the Simulator Panel Options window appear and PLC Simulator does not
start unless a valid path is set or the option is cleared.
• If the application path is valid, the PLC Simulator starts.

No Upload of a Password-Protected Application in

Monitoring Mode
In Monitoring mode, the PLC > Transfer Project from PLC option is grayed for password-
protected application. The related icon is also grayed.
As a result, the PLC Project from PLC Simulator cannot be uploaded.

Loading a Project in PLC Simulator

Introduction
The process for loading a project to PLC Simulator is identical in principle to loading a
project on a physical PLC.

Loading a Project
Loading a project in PLC Simulator

16 EIO0000001714.09
Simulating a Controller

Step Action

1 In Control Expert, enable the simulator mode using the menu command PLC > Simulation mode

or the following symbol on the toolbar:

2 Execute the menu command Rebuild > Rebuild All Project.

3 Create a connection to PLC Simulator using the menu command PLC > Connect, see also
Creating a Connection, page 18 for creating a remote connection.

Result:
• The PLC Simulator icon, page 20 appears in the toolbar:

• see also Possible Error Messages, page 19

NOTE: Usually, PLC Simulator is installed on the same PC as Control Expert (Local Host).
The project can also be loaded on PLC Simulator on another PC via a TCP/IP connection.

4 Execute the menu command PLC > Transfer project to PLC.

Result: A transfer dialog box appears.

5 Press the Transfer button.

Result: The project is loaded on PLC Simulator and the PLC Simulator icon looks as follows in the
toolbar:

6 Select the menu command PLC > Start.

Result: The project is launched on PLC Simulator and PLC Simulator icon looks as follows in the
toolbar:

EIO0000001714.09 17
 Simulating a Controller

Using an Application Password

PLC Simulator and a physical controller behave the same way relative to security with
projects protected with an application password.
Connecting Control Expert to PLC Simulator, downloading, or uploading such projects from
or to Control Expert requires to enter the application password.
NOTE: If you want to download a non-protected project to PLC Simulator which is
already loaded with a project protected with an application password, you need to enter
the password at the connection step, or clear PLC Simulator before the connection step.
See Clear, page 62
For further information on password protection of projects, refer to the chapter Application
Protection (see EcoStruxure™ Control Expert, Operating Modes).

Creating a Connection
Usually, PLC Simulator is installed on the same PC as Control Expert (Local Host). When
the menu command PLC > Connect is selected, a connection to the Local Host PC on the
default port 502 (Schneider Port) is automatically created. The project can also be loaded on
PLC Simulator on another PC via a TCP/IP connection or on PLC Simulator running on a
different port.
In this case you must specify the TCP/IP address and port number of the target PC when
following the Loading a project procedure before carrying out Step 3 in the step-action table
above (creating a connection). See Loading a Project, page 16.
Then select the Control Expert menu command PLC > Set Address, and in the Address
text box of the Simulator options, enter the TCP/IP address and the optional port number of
the target PC (for example: 139.158.106.127:123 where 123 is the port number). After
that, continue with Step 3 in the step-action table above.
If you want to load the project in the Local Host PC PLC Simulator running on the default
port 502 (Control Expert and simulator on the same PC), you do not have to carry out this
step as the Local Host PC address and the port number are automatically entered.

18 EIO0000001714.09
Simulating a Controller

Representation of the default dialog box:

Multiple Instances
As of Control Expert version 15.0, multiple instances of PLC Simulator on the same Local
Host PC are supported. However, each PLC Simulator instance on the same Local Host PC
connects to a unique port number. If one instance is already running with the default port
502, start a new instance with a different port number. For example, enter 127.0.0.1:503
as a port number for the port 503 in the Address text box of the Simulator options.

Staring PLC Simulator with Command Line

To start an instance of PLC Simulator with a specific port number, you can execute the
command start sim /PORT<port number> in the Command Prompt console from the
PLC Simulator installation folder. For example, start sim /PORT503 for the port 503.
The default destination directory of the PLC Simulator at Control Expert software installation
is C:\Program Files (x86)\Schneider Electric\Control Expert ••.•\PLC_
Simulator\

Possible Error Messages

The following error messages can occur when launching PLC Simulator:

EIO0000001714.09 19
 Simulating a Controller

Error message Cause Solution

Can't register Simulator. One active PLC Simulator Acknowledge the error message with
Already running! instance use the same port than OK and set another port than the PLC
the PLC Simulator instance you Simulator instances already active.
are trying to activate.

Version information from xxx invalid file in the PLC Simulator Reinstall Control Expert after
cannot be read (err=0)! directory uninstalling it.

The DLL xxx is incompatible invalid file in the PLC Simulator Reinstall Control Expert after
(...)! directory uninstalling it.

At least one Simulator DLL is invalid file in the PLC Simulator Reinstall Control Expert after
incompatible. Simulation not directory uninstalling it.
possible!

Exiting PLC Simulator

The procedure for exiting PLC Simulator is as follows:

Step Action

1 Call the menu command Exit Simulation from the shortcut menu for the PLC Simulator icon in the
toolbar or the PLC Simulator dialog box.

Result: PLC Simulator is closed.

PLC Simulator Icon in the Toolbar

Introduction
After launching the PLC Simulator instance(s), the PLC Simulator icon(s) appear(s) in the
toolbar. The icon(s) identify(ies) the active PLC Simulator and display(s) the different states
of the simulated controller(s).

General Structure
The PLC Simulator icon is composed according to the following rules.
The background color represents the operational state.

20 EIO0000001714.09
Simulating a Controller

Example Color Description

green normal operation

yellow controller in HALT state

red controller in ERROR state

A frame around the icon shows the active debug mode

Example Color Description

blue Debug mode is active, for example at least one breakpoint is

set in the project, or there is at least one user task in debug
mode.

The inner symbol shows the controller state, such as NOCONF, IDLE, STOPPED, RUN.

Symbol The simulated controller is in Description

state...
NOCONF (no configuration) No user project loaded or the loaded project is invalid or
removed with the Clear command.

IDLE The project loaded on the controller has not been started or
reset with the Reset command button.

STOPPED No project is running.

RUN A project with at least one task is running.

The color of the inner symbol shows the connection state.

Example Color Description

black No TCP/IP client is connected.

red At least one TCP/IP client is connected.

EIO0000001714.09 21
 Simulating a Controller

Error States
Meaning of the symbols

Symbol The simulated controller is in Description

state...
HALT An error has occurred in the project. The simulated controller
must be re-initialized or reset using the Reset command
button.
ERROR An unrecoverable error is detected in the project. This means
communication is no longer possible. The simulated
controller must be reset using the Reset command button.

Internal States
The following symbols represent internal exception states. It is not possible to recover from
these states, so the PLC Simulator must be closed and restarted again.

Symbol The simulated controller is in Description

state...
POWER OFF An internal error has occurred during the simulation
of a controller reset or power cycle.

INIT An internal error has occurred during the

initialization of PLC Simulator.

UNKNOWN PLC Simulator has entered an indeterminable state.

22 EIO0000001714.09
Differences Between the PLC Simulator and a
Physical Controller

Differences Between the PLC Simulator and a

Physical Controller
Overview
This chapter describes the difference between PLC Simulator and a physical controller.

Limitations of the PLC Simulator

General
General limitations
• The PLC simulator allows to test a complete project with its user tasks through a CPU
simulation. However, the runtime behavior of the simulator cannot be compared to that
of a real PLC and cannot be used to draw conclusions about the behavior of a real PLC.
This includes Multitasking behavior and time information.
• The PLC Simulator does not support any form of I/O. Although the simulation contains
project components for I/Os, they are not processed by the PLC simulator. Inputs and
outputs can only be accessed via the project or via the Control Expert online functions
(read, write, force, animate, ...).
• With the PLC simulator I/O events can not be triggered by setting/forcing %I bits.
• For limitations concerning the memory card please refer to Memory Card for Modicon
M580 CPU, page 38 and Memory Card for Modicon M340 CPU, page 54.
• The PLC Simulator does not support any Hot Standby feature.
• The PLC Simulator does not embeds the same level of protection as that of the
standard Control Expert software.

PLC OS System Services

The PLC simulator supports the most PLC OS system services on a variety of platforms.
These services are only implemented as dummy services.
This means that functions and function blocks can be used in the loaded project, but they do
not work as expected and/or they return an error message.

EIO0000001714.09 23
 Differences Between the PLC Simulator and a
Physical Controller

This mainly affects functions and function blocks that accessed special platforms, such as I/
O blocks, communication and hardware specific functions.
The following PLC OS system services are supported:
• diagnostics functions
• functions to read the date and time
• propagation delay time
• object access (except network variables)
• Premium DFBs
• SFC
The following PLC OS system services are not supported:
• closed loop control (CLC)
• Fip IO
• BusX IO
• Quantum IO
• configuration
• communication
• functions to set the date and time

Memory Structure
The different PLC families vary in memory structure.
NOTE: It is possible that the alignment of data are not the same when the projects is
transferred from the PLC simulator to a Modicon M340, M580, or Momentum PLC. So
check the structure of the data of the project.
For detailed information about memory alignment refer to chapter DDT: Mapping rules (see
EcoStruxure™ Control Expert, Program Languages and Structure, Reference Manual).
For detailed information about storage principles and memory structure refer to chapter
Application Memory Structure (see EcoStruxure™ Control Expert, Program Languages and
Structure, Reference Manual).

Communication
Communication limitations

24 EIO0000001714.09
Differences Between the PLC Simulator and a
Physical Controller

• The PLC simulator only supports TCP/IP based communication (Schneider Port 502).
In other cases a Modbus exception code is returned.
• Modbus, Modbus Plus or Uni-TE are not supported by the PLC simulator.
• For Control Expert V14.1 and earlier the PLC simulator does not support
communication to other PCs or PLC simulators, neither remote nor local.
• For Control Expert V14.1 and earlier, the PLC simulator has no communication timeout.
• Communication network, such as Uni-Telway, Ethway, Fipway, Modbus, Modbus Plus,
etc., are not supported by the PLC simulator.
NOTE: Communication function blocks that require PLC client and PLC server are
supported with multiple instances of PLC simulator, for details, refer to IP Address and
Communication Port Simulation, page 26.
The PLC simulator supports the following native Modbus commands:

Function Code (in hex) Description

01 Read Coil Status (0x)

02 Read Input Status (1x)

03 Read Holding Registers (4x)

04 Read Input Registers (3x)

05 Force Single Coil (0x)

06 Preset Single Register (4x)

0F Force Multiple Coils (0x)

10 Preset Multiple Registers (4x)

16 Mask Write Registers (4x)

Mapping a %MW to a Boolean Element

Regarding the use of %MW mapped on a boolean element in structured data type, the PLC
simulator and a real PLC behave different.
When a %MW is mapped on a boolean element in structured data type, only the first row is
animated by the PLC simulator. On a real PLC both rows (zero and one) are animated. Row
one is used to get the information about the history value.

EIO0000001714.09 25
 Differences Between the PLC Simulator and a
Physical Controller

M580 Safety Project Limitations

The PLC simulator has no double code execution of the logic and comparison of the results.
It only simulates the logic but not the safety behavior of the PLC.

Debugging Limitations
The PLC simulator could enter HALT state when executing the Step Info or Step Over
debugging command in textual languages.
If the current element is a complex instruction (i.e. copying a huge array from one variable to
another), the execution of this instruction takes a very long time, because it will be executed
in single step mode on the PLC simulator.
Setting a breakpoint on the next instruction and executing the Go command avoids this
problem.

IP Address and Communication Port Simulation

Overview
The following communication function blocks require a PLC client and a PLC server:
• READ_REMOTE and WRITE_REMOTE
• DATA_EXCH
• READ_VAR and WRITE_VAR
The multiple instances capability of PLC simulator on the same Local Host PC allows to
simulate the PLC client and PLC server.

Principle
In PLC application (client), the targeted PLC (server) is addressed using its IP address as
input parameter IN of ADDM function block. In these function blocks, the communication
port is not defined as in the PLC, only the port 502 is always used.
After loading PLC application (client) in a first PLC simulator instance of the Local Host PC,
to simulate the targeted PLC (server) in a second PLC simulator instance, it could only be
addressed through another TCP/IP communication port. See Staring PLC Simulator with
Command Line, page 19.

26 EIO0000001714.09
Differences Between the PLC Simulator and a
Physical Controller

Instead of rewriting the IP address of the targeted PLC (server) in the PLC application
(client) the PLC simulator instance can substitute IP address of the targeted PLC (server)
with a TCP/IP communication port provided in a port simulation file. This file contains a
correspondence between the IP address and the Local Host TCP/IP communication port.
As illustrated below, when the PLC application (client) calls a targeted PLC (server) using
the {IPB} IP address, the PLC simulator instance A substitutes the {IPB} address with
{localHostIP:PortB} address corresponding to the PLC simulator instance B connection.

EIO0000001714.09 27
 Differences Between the PLC Simulator and a
Physical Controller

Port Simulation File

The correspondences between an IP address and a communication port to simulate is
provided in a port simulation file (*.xml) with the following syntax:
<EquiList>
<PLCAdressSim Address="172.168.12.0" Port="503"></PLCAdressSim>
<PLCAdressSim Address="192.168.0.2" Port="504"></PLCAdressSim>
</EquiList>
Where Address is the IP address in ADDM block and Port is the simulator port to use for
simulation.
NOTE: Provide that the port simulation file is unique for one PC.
You can change the location and the name of the file in the Options, page 63 Dialog Box.
In the input parameter syntax of the ADDM function block, the IP address is prefixed by the
communication port topological location, that is 0.0.3{168.127.0.1} for M580 CPU port.
This typical syntax is ignored and not checked by the simulator.
If an IP address in the ADDM function block is not found in the port simulation file, there is
no substitution and the IP address is used by the PLC simulator. It allows to test real PLC
server.

Limitation
The use of READ_VAR, WRITE_VAR, or DATA_EXCH by the PLC simulator requires Libset
version 15.0 or any subsequent supporting version.

System Bits and System Words

PLC Simulator supports subsets of %S system bits and %SW system words (see
EcoStruxure™ Control Expert, System Bits and Words, Reference Manual).

28 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Menu Commands and Dialog Boxes in the

PLC Simulator
Overview
This chapter describes the menu commands and dialog boxes in the PLC simulator.

Simulator Control
Description
You can open and close the simulator dialog using:
• The menu command Simulator Control in the context menu of the simulator symbol in
the task bar or the simulator symbol.
• A double-click with the left mouse button on the simulator symbol in the task bar.
One of the following dialog boxes is open or closed depending on the project loaded:
• Unknown CPU, page 29
• Modicon M580 CPU, page 32
• Modicon Quantum CPU, page 42
• Modicon Quantum Safety CPU, page 45
• Modicon Premium CPU, page 49
• Modicon M340 CPU, page 51
• Modicon Momentum CPU, page 58

Simulator Control for Unknown CPU

Introduction
This dialog box is shown if the simulator does not know which CPU type should be
simulated.
This is the case for example in the following situations:

EIO0000001714.09 29
 Menu Commands and Dialog Boxes in the PLC
Simulator

• Directly after the simulator is started and before a project is loaded.

• If the simulated CPU is in NOCONF state (in other words a valid project is not loaded in
the simulator).
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU and the project in a two line
display.
The first line shows the current state of the CPU and can contain the following texts:

Text in the first line The simulated CPU Meaning

is in state...
NOCONF NOCONF (no No user project loaded or the loaded project is invalid.
configuration)

IDLE IDLE The project loaded on the CPU has not been started or reset
with the Reset button.
STOP STOPPED No project is running. However, the loaded project was in RUN
state at least once.
RUN RUN A project with at least one task is running.

30 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Text in the first line The simulated CPU Meaning

is in state...
HALT HALT An error has occurred in the project. The simulated CPU must
be reinitialized or reset using the Reset button.

ERROR ERROR An unrecoverable detected error has occurred in the project.

This means communication is no longer possible. The
simulated CPU must be reset using the Reset button.

The second line shows the current state of the project and can contain the following texts:

Text in the Second Meaning

Line
INVALID No user project loaded or the loaded project is invalid.

CHECKED The project was checked formally and found to be valid. However, the CPU has not
been configured using this project.

CONF The project was checked formally and found to be valid. The CPU has been configured
using this project.

Events
With this button, you can open and close the event dialog box, page 60.
The button is shown if I/O events are defined in the project currently loaded (if the project
uses event tasks).

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the
CPU (the connection between Control Expert and the simulator is broken, project variables
are reset).
This button corresponds to the reset button on a real CPU.

Power Cycle
With this button, you simulate a warm start of the CPU. It means that the connection
between Control Expert and the simulator is broken, the current project variables remain
and the simulator goes into the state RUN (autostart active) or STOP (autostart
deactivated).

EIO0000001714.09 31
 Menu Commands and Dialog Boxes in the PLC
Simulator

A power cycle corresponds to a power off and power on of a real power supply.

Simulation
Dialog box fields:

Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.

Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.

Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP
with the host PC of the simulator, page 18). The DNS name and TCP/IP address are shown
for each client.

Simulator Control for Modicon M580 CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon M580 family.

32 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a multi-line display using
combinations of the RUN and ERR LEDs:

RUN LED ERR LED The simulated Meaning

CPU is in state...
– – NOCONF The LED display is replaced with NOCONF - INVALID display.

No user project loaded or the loaded project is invalid.

flashing off STOP The project loaded on the PLC has not been started or has been
reset with the Reset button.
on off RUN A project with at least one task is running.

flashing flashing HALT A detected error has occurred in the project. The simulated CPU
must be reinitialized or reset using the Reset button.

off on – An unrecoverable detected error has occurred in the project. This

means communication is no longer possible. The simulated CPU
must be reset using the Reset button.

The BACKUP LED is on if a problem occurs during simulated card access or if the
simulated memory card is removed.
The I/O, DL, ETH MS, ETH NS, and FORCED I/O LEDs are not supported by the simulator.

EIO0000001714.09 33
 Menu Commands and Dialog Boxes in the PLC
Simulator

Card Acc
The Card Acc LED is on when the card is accessible.

Memory Card
Simulated features of a memory card for the Modicon M580 CPU, page 38:
• Files on the memory card generated by the data storage function blocks.
• Remove/insert memory card.
• Memory card full.
• Write protection.

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the
CPU where the connection between Control Expert and the simulator is broken, project
variables are reset and the simulator goes in RUN (if auto start is activated) or in STOP (if
auto start is deactivated)).

Power Cycle
With this button, you execute a power cycle (power off/ power on) for the simulated CPU.
This corresponds to a warm start of the CPU (the connection between Control Expert and
the simulator is broken and the current project variables remain).
A power cycle corresponds to a power off and power on of a real power supply.

Simulation
Dialog box fields:

Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.

Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.

Project name: Name of the project loaded in the simulator.

34 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP
with the host PC of the simulator, page 18). The DNS name and TCP/IP address are shown
for each client.

Simulator Control for Modicon M580 Safety CPU

Introduction
The dialog box is shown if the simulator is simulating a Modicon M580 Safety CPU.
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a multi-line display using
combinations of the RUN and ERR LEDs:

EIO0000001714.09 35
 Menu Commands and Dialog Boxes in the PLC
Simulator

LEDs The simulated Meaning

CPU is in state...
RUN ERR SRUN S M
– – – – – NOCONF The LED display is
replaced with
NOCONF - INVALID
display.

No user project
loaded or the loaded
project is invalid.

flashing off on: SAFE on: off STOP The project loaded
task running Safety on the PLC has not
mode been started or has
off: SAFE been reset with the
task stopped. off flashing: Reset button.
Mainte-
nance mode
on off on: SAFE on: off RUN A project with at least
task running Safety one task is running.
mode
off: SAFE
task stopped. off flashing:
Mainte-
nance mode
flashing flashing on: SAFE on: off HALT A detected error has
task running Safety occurred in the
mode project.
off: SAFE
task stopped. off flashing: Reinitialize the
Mainte- simulated CPU or
nance mode reset it using the
Reset button.
off on off off off SAFE An unrecoverable
detected error has
occurred in the
project. This means
communication is no
longer possible.

Reset the simulated

CPU using the Reset
button.

The BACKUP LED is on if a problem occurs during simulated card access or if the
simulated memory card is removed.
The I/O, DL, ETH MS, ETH NS, and FORCED I/O LEDs are not supported by the simulator.

36 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Card Acc
The Card Acc LED is on when the card is accessible.

Memory Card
Simulated features of a memory card for the Modicon M580 CPU, page 38:
• Files on the memory card generated by the data storage function blocks.
• Remove/insert memory card.
• Memory card full.
• Write protection.

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the
CPU where the connection between Control Expert and the simulator is broken, project
variables are reset and the simulator goes in RUN (if auto start is activated) or in STOP (if
auto start is deactivated)).

Power Cycle
With this button, you execute a power cycle (power off/ power on) for the simulated CPU.
This corresponds to a warm start of the CPU (the connection between Control Expert and
the simulator is broken and the current project variables remain).
A power cycle corresponds to a power off and power on of a real power supply.

Simulation
Dialog box fields:

Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.

Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.

Project name: Name of the project loaded in the simulator.

EIO0000001714.09 37
 Menu Commands and Dialog Boxes in the PLC
Simulator

Connected Clients
The list shows current clients connected with the PC (PCs which are connected via TCP/IP
with the host PC of the simulator, page 18). The DNS name and TCP/IP address are shown
for each client.

Memory Card for Modicon M580 CPU

Overview
The Modicon M580 PLC simulator panel displays a memory card in the bottom left corner of
the virtual front plate, for both M580 PLCs and M580 Safety PLCs. See, for example,
Simulator control for Modicon M580 CPU, page 32.
The memory card is inserted by default after the startup of the PLC Simulator.

No Backup/Restore
On a real Modicon M580 CPU, the memory card is separated in 2 parts:
• A part for the OS, where the application is stored persistent (backup/restore
mechanism).
• A part for the application, where the application can store data by using data storage
function blocks.
NOTE: The simulator does not simulate the backup/restore part of the memory card.

Not Simulated Features of a Memory Card

The following features of a real memory card are not supported:
• Backup/restore to/from memory card.
• Operating modes for memory cards.
• %S66 (APPLIBCK).

38 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Simulated Features of a Memory Card

The following features of a memory card can be simulated for the Modicon M580 CPU:
• Files on the memory card generated by the data storage function blocks.
• Remove/insert memory card.
• Memory card full.
• Write protection.

File Management Function Blocks

The simulator supports the file management function blocks and simulates the generation of
the files on the PC.
A directory on the PC simulates the file management part of the memory card. In this
directory, the files created by the user application are stored.
The directory used for memory card simulation is either the default one (C:\Documents and
Settings\USERNAME\Local Settings\Temp\DataStorage) or the directory used during the
last simulation. The last used directory is stored persistent in the registry.
The files written by the application can be accessed by normal tools like an editor or Office
tools.
The simulator never deletes the application written files. If an application needs to have a
blank empty memory card, the system word %SW93 (Memory Card File System Format)
has to be used in STOP state of the CPU.
NOTE: There is no tracking of the size and number of files written into the memory card.

Limitations for File Management Function Blocks

• Error codes generated by these functions/function blocks may be different between
PLC simulator and a real CPU.
• With the PLC simulator, it is not possible to delete a file that is opened (neither with the
DELETE_FILE function, nor by FTP command).
It is mandatory to close the file before deleting it, in order to delete the file descriptor.
Trying to delete a file that is opened generates a general error code (-1).
• The SET_FILE_ATTRIBUTES function is not supported by the PLC simulator.
Trying to call this function generates a general error (-1).

EIO0000001714.09 39
 Menu Commands and Dialog Boxes in the PLC
Simulator

For detailed information about the file management functions/function blocks please refer to
the System Block Library documentation.

Remove Memory Card

By default the memory card is inserted at simulator start.
The procedure for removing the memory card is as follows:

Step Action

1 Set the system bit %S65 (CARDIS).

Result: After a potential card access has finished the Card Acc LED goes out.

2 Open the context menu by clicking the memory card with the right mouse button.

3 Select Remove Memory Card....

Result: The virtual front plate shows an empty memory card slot and the CARDERR LED is on.

NOTE: Removing the memory card has no influence on the used directory and the files,
but the access to the files is disabled inside the simulator.

Insert Memory Card

The procedure for inserting the memory card is as follows:

Step Action

1 Open the context menu by clicking the memory card with the right mouse button.

2 Select Insert Memory Card....

Result: A Windows standard file selection dialog opens. The selection is pre-initialized with the last
used memory card directory.

Note: The file selection box also has a Write protected check box to insert a write protected virtual
memory card.

40 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Step Action

3 Proceed with one of the 2 following possibilities:

• Use the preinitialized directory.
Result: The last removed memory card is inserted.
• Select another directory.
Result: Another memory card (for example different in content or empty) is inserted.
Result: The CARDERR LED turns off.
4 Reset the system bit %S65 (CARDIS).

Result: The virtual front plate shows a memory card and the Card Acc LED goes on.

Since a directory and its content represent the memory card, exchanging the content of the
directory can simulate the exchange of a memory card. This can be done by normal
Windows means (cut/copy/paste of files or renaming/moving folders).

Memory Card Full

By default the memory card is not full at simulator start.
Since there is no size tracking, at any time it is possible to simulate that the memory card is
full.
This is done by opening the context menu (right-click the memory card) and selecting the
menu command Memory Card Full.
After this menu command is selected:
• New data writing is not possible.
• Read accesses are possible.
• Overwrite actions are possible.
This state is indicated by the check mark in the context menu command.

Write Protection
By default the memory card is not write protected at simulator start.
At any time, it is possible to simulate that the memory card is write protected.
This is done by opening the context menu (right-click the memory card) and selecting the
menu command Write Protection.
After this menu command is selected:

EIO0000001714.09 41
 Menu Commands and Dialog Boxes in the PLC
Simulator

• Data writing is not possible.

• Read accesses are possible.
This state is indicated by the check mark in the context menu command.
Control Expert adds some restrictions linked with the memory card (for example program
modification is forbidden if the card is write protected). The simulator supports these
restrictions too.
To simulate the write protection feature the following system bits and words are supported
by the simulator:
• %S65 (CARDIS)
• %S96 (BACKUPPROGOK)
• %SW97 (CARDSTS)
NOTE: It is not possible to access the files via an FTP client through the simulator since
the files are directly accessible by Windows features.

Simulator Control for Modicon Quantum CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon Quantum
family.

42 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a one line display:

Text in the display The simulated CPU Meaning

is in state...
Init INIT (Initialization) This display is shown for a very short time while the simulator
is starting. It is quickly replaced by one of the following
displays.

UnCfg NOCONF (no No user project loaded or the loaded project is invalid.
configuration)

Idle IDLE The project loaded on the CPU has not been started or reset
with the Reset button.
Stop STOPPED No project is running. However, the loaded project was in RUN
state at least once.
Run RUN A project with at least one task is running.

Halt HALT An error has occurred in the project. The simulated CPU must
be reinitialized or reset using the Reset button.

Err ERROR An unrecoverable detected error has occurred in the project.

This means communication is no longer possible. The
simulated CPU must be reset using the Reset button.

EIO0000001714.09 43
 Menu Commands and Dialog Boxes in the PLC
Simulator

Key Switch
By clicking the switch symbol, various switch positions can be simulated:

Switch position Switch position on Meaning

real CPU
Start CPU unlocked:
• Project can be loaded.
• CPU can be started or stopped.

Mem Prt CPU locked:

• Project cannot be loaded.
• As opposed to the key switch on a real CPU, the CPU can be
started or stopped in this position.

- Stop This switch position of a real CPU is not supported by the

simulator.

Events
With this button, you can open and close the event dialog box, page 60.
The button is shown if I/O events are defined in the project currently loaded (if the project
uses event tasks).

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the
CPU (the connection between Control Expert and the simulator is broken, project variables
are reset and the simulator goes in RUN (if auto start is activated) or in STOP (if auto start is
deactivated)).
Reset corresponds to the reset button on a real CPU.

Power Cycle
With this button, you execute a power cycle (power off / power on) for the simulated CPU.
This corresponds to a warm start of the CPU (the connection between Control Expert and
the simulator is broken and the current project variables remain).
A power cycle corresponds to a power off and power on of a real power supply.

44 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Simulation
Dialog box fields:

Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.

Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.

Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP
with the host PC of the simulator, page 18). The DNS name and TCP/IP address are shown
for each client.

Simulator Control for Modicon Quantum Safety

CPU
Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon Quantum
safety family.

EIO0000001714.09 45
 Menu Commands and Dialog Boxes in the PLC
Simulator

Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the safety CPU in a display:

Text in the The simulated Meaning

display CPU is in state...

Init INIT This display is shown for a very short time while the simulator is
(Initialization) starting. It is quickly replaced by one of the following displays.

UnCfg NOCONF (no No user project loaded or the loaded project is invalid.
configuration)

Idle IDLE The project loaded on the CPU has not been started or reset with the
Reset command button.
Stop STOPPED No project is running. However, the loaded project was in RUN state
at least once.
Run RUN A project with at least one task is running.

Halt HALT An error has occurred in the project. The simulated CPU must be
reinitialized or reset using the Reset command button.

Err ERROR An unrecoverable detected error has occurred in the project. This
means communication is no longer possible. The simulated CPU must
be reset using the Reset command button.

46 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Text in the The simulated Meaning

display CPU is in state...

S Safety Mode The project is running in safety mode.

For further information on the different modes please refer to the Unity
Pro XLS Software Specifics manual.

M Maintenance The project is running in maintenance mode.

Mode
For further information on the different modes please refer to the Unity
Pro XLS Software Specifics manual.

Safety/Maintenance Mode (Safety Projects)

For switching between safety and maintenance mode please pay attention to the following
special features:
• Switching from safety to maintenance mode in Control Expert XLS Software is only
possible, if the simulator key switch is unlocked (see table below).
• Switching from maintenance to safety mode can be done by setting the key switch
position of the simulator to locked.
• If the simulator is in maintenance mode and Control Expert XLS Software is
disconnected from the simulator, it is automatically set to safety mode.
NOTE: The CPU simulator has no double code execution of the logic and comparison of
the results. Therefore the execution behaves the same in safety and maintenance
mode.
For further information on the different modes please refer to the Unity Pro XLS Software
Specifics manual.

Key Switch
By clicking the switch symbol, various switch positions can be simulated:

EIO0000001714.09 47
 Menu Commands and Dialog Boxes in the PLC
Simulator

Switch Switch position Meaning

position on real CPU

Start CPU unlocked:

• Project can be loaded.
• CPU can be started or stopped.

Mem Prt CPU locked:

• Project can not be loaded.
• As opposed to the key switch on a real CPU, the CPU can be started
or stopped in this position.

- Stop This switch position of a real CPU is not supported by the simulator.

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the
CPU (the connection between the Control Expert and the simulator is broken, project
variables are reset).
This command button corresponds to the reset button on a real CPU.

Power Cycle
With this button, you simulate a cold start of the CPU as a safety CPU does not support
warm start. The connection between Control Expert and the simulator is broken, the
simulator goes into the state RUN (autostart active) or STOP (autostart deactivated).
This command button corresponds to the power off and power on of a real power supply.

Simulation
Dialog box fields:

Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.

Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.

Project name: Name of the project loaded in the simulator.

48 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP
with the host PC of the simulator, page 18). The DNS name and TCP/IP address are shown
for each client.

Simulator Control for Modicon Premium CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon Premium
family.
Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a multi-line display using
combinations of the RUN and ERR LEDs:

EIO0000001714.09 49
 Menu Commands and Dialog Boxes in the PLC
Simulator

RUN LED ERR The simulated Meaning

LED CPU is in state...
off flashing NOCONF (no No user project loaded or the loaded project is invalid.
configuration)

flashing off IDLE The project loaded on the CPU has not been started or reset
with the Reset button.
flashing off STOPPED No project is running. However, the loaded project was in RUN
state at least once.
on off RUN A project with at least one task is running.

off flashing HALT An error has occurred in the project. The simulated CPU must
be reinitialized or reset using the Reset button.

off on ERROR An unrecoverable detected error has occurred in the project.

This means communication is no longer possible. The
simulated CPU must be reset using the Reset button.

When data is being exchanged between Control Expert and the simulator, the TER LED is
flashing.
The CH0, CH1, CH2, CH3, I/O, and FIP LEDs are no supported by the simulator.

Events
With this button, you can open and close the event dialog box, page 60.
The button is shown if I/O events are defined in the project currently loaded (if the project
uses event tasks).

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the
CPU where the connection between Control Expert and the simulator is broken, project
variables are reset and the simulator goes in RUN (if auto start is activated) or in STOP (if
auto start is deactivated)).
Reset corresponds to the reset button on a real CPU.

50 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Power Cycle
With this button, you execute a power cycle (power off/ power on) for the simulated CPU.
This corresponds to a warm start of the CPU (the connection between Control Expert and
the simulator is broken and the current project variables remain).
A power cycle corresponds to a power off and power on (or pressing the reset button) of a
real power supply.

Simulation
Dialog box fields:

Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.

Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.

Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP
with the host PC of the simulator, page 18). The DNS name and TCP/IP address are shown
for each client.

Simulator Control for Modicon M340 CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon M340 family.

EIO0000001714.09 51
 Menu Commands and Dialog Boxes in the PLC
Simulator

Representation of the dialog box:

CPU Front Plate

The virtual CPU front plate shows the current state of the CPU in a multi-line display using
combinations of the RUN and ERR LEDs:

RUN ERR The simulated Meaning

LED LED CPU is in state...
off flashing NOCONF (no No user project loaded or the loaded project is invalid.
configuration)

flashing off IDLE The project loaded on the CPU has not been started or reset with
the Reset button.
flashing off STOPPED No project is running. However, the loaded project was in RUN
state at least once.
on off RUN A project with at least one task is running.

off flashing HALT An error has occurred in the project. The simulated CPU must be
reinitialized or reset using the Reset button.

off on ERROR An unrecoverable detected error has occurred in the project. This
means communication is no longer possible. The simulated CPU
must be reset using the Reset button.

When data is being exchanged between Control Expert (or other clients) and the simulator,
the SER COM LED is flashing.

52 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

The CARDERR LED is ON if a problem occurs during card access or if the memory card is
removed.
The I/O, CAN RUN, CAN ERR, ETH ACT, ETH STS, and 10/100 LEDs are not supported
by the simulator.

Card Acc
The Card Acc LED is on when the card is accessible.

Memory Card
The following features of a memory card can be simulated for the Modicon M340 CPU, page
54:
• Files on the memory card generated by the data storage function blocks.
• Remove/insert memory card.
• Memory card full.
• Write protection.

Reset
With this button, you can reset the simulated CPU. This corresponds to a cold start of the
CPU where the connection between Control Expert and the simulator is broken, project
variables are reset and the simulator goes in RUN (if auto start is activated) or in STOP (if
auto start is deactivated)).

Power Cycle
With this button, you execute a power cycle (power off/ power on) for the simulated CPU.
This corresponds to a warm start of the CPU (the connection between Control Expert and
the simulator is broken and the current project variables remain).
A power cycle corresponds to a power off and power on of a real power supply.

EIO0000001714.09 53
 Menu Commands and Dialog Boxes in the PLC
Simulator

Simulation
Dialog box fields:

Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.

Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.

Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP
with the host PC of the simulator, page 18). The DNS name and TCP/IP address are shown
for each client.

Memory Card for Modicon M340 CPU

Overview
The Modicon M340 PLC simulator panel displays a memory card in the bottom left corner of
the virtual front plate. See Simulator Control for Modicon M340 CPU, page 51.
The memory card is inserted by default after the startup of the PLC Simulator.

No Backup/Restore
On a real Modicon M340 CPU, the memory card is separated in 2 parts:
• A part for the OS, where the application is stored persistent (backup/restore
mechanism).
• A part for the application, where the application can store data by using data storage
function blocks.
NOTE: The simulator does not simulate the backup/restore part of the memory card.

54 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Not Simulated Features of a Memory Card

The following features of a real memory card are not supported:
• Backup/restore to/from memory card.
• Operating modes for memory cards.
• %S66 (APPLIBCK).

Simulated Features of a Memory Card

The following features of a memory card can be simulated for the Modicon M340 CPU:
• Files on the memory card generated by the data storage function blocks.
• Remove/insert memory card.
• Memory card full.
• Write protection.

File Management Function Blocks

The simulator supports the file management function blocks and simulates the generation of
the files on the PC.
A directory on the PC simulates the file management part of the memory card. In this
directory, the files created by the user application are stored.
The directory used for memory card simulation is either the default one (C:\Documents and
Settings\USERNAME\Local Settings\Temp\DataStorage) or the directory used during the
last simulation. The last used directory is stored persistent in the registry.
The files written by the application can be accessed by normal tools like an editor or Office
tools.
The simulator never deletes the application written files. If an application needs to have a
blank empty memory card, the system word %SW93 (Memory Card File System Erasing)
has to be used in STOP state of the CPU.
NOTE: There is no tracking of the size and number of files written into the memory card.

EIO0000001714.09 55
 Menu Commands and Dialog Boxes in the PLC
Simulator

Limitations for File Management Function Blocks

• Error codes generated by these functions/function blocks may be different between
PLC simulator and a real CPU.
• With the PLC simulator, it is not possible to delete a file that is opened (neither with the
DELETE_FILE function, nor by FTP command).
It is mandatory to close the file before deleting it, in order to delete the file descriptor.
Trying to delete a file that is opened generates a general error code (-1).
• The SET_FILE_ATTRIBUTES function is not supported by the PLC simulator.
Trying to call this function generates a general error (-1).
For detailed information about the file management functions/function blocks please refer to
the EcoStruxure™ Control Expert, System, Block Library documentation.

Remove Memory Card

By default the memory card is inserted at simulator start.
The procedure for removing the memory card is as follows:

Step Action

1 Set the system bit %S65 (CARDIS).

Result: After a potential card access has finished the Card Acc LED goes out.

2 Open the context menu by clicking the memory card with the right mouse button.

3 Select Remove Memory Card....

Result: The virtual front plate shows an empty memory card slot and the CARDERR LED is on.

NOTE: Removing the memory card has no influence on the used directory and the files,
but the access to the files is disabled inside the simulator.

Insert Memory Card

The procedure for inserting the memory card is as follows:

Step Action

1 Open the context menu by clicking the memory card with the right mouse button.

2 Select Insert Memory Card....

56 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Step Action

Result: A Windows standard file selection dialog opens. The selection is pre-initialized with the last
used memory card directory.

Note: The file selection box also has a Write protected check box to insert a write protected virtual
memory card.

3 Proceed with one of the 2 following possibilities:

• Use the preinitialized directory.
Result: The last removed memory card is inserted.
• Select another directory.
Result: Another memory card (for example different in content or empty) is inserted.
Result: The CARDERR LED turns off.
4 Reset the system bit %S65 (CARDIS).

Result: The virtual front plate shows a memory card and the Card Acc LED goes on.

Since a directory and its content represent the memory card, exchanging the content of the
directory can simulate the exchange of a memory card. This can be done by normal
Windows means (cut/copy/paste of files or renaming/moving folders).

Memory Card Full

By default the memory card is not full at simulator start.
Since there is no size tracking, at any time it is possible to simulate that the memory card is
full.
This is done by opening the context menu (right-click the memory card) and selecting the
menu command Memory Card Full.
After this menu command is selected:
• New data writing is not possible.
• Read accesses are possible.
• Overwrite actions are possible.
This state is indicated by the check mark in the context menu command.

Write Protection
By default the memory card is not write protected at simulator start.

EIO0000001714.09 57
 Menu Commands and Dialog Boxes in the PLC
Simulator

At any time, it is possible to simulate that the memory card is write protected.
This is done by opening the context menu (right-click the memory card) and selecting the
menu command Write Protection.
After this menu command is selected:
• Data writing is not possible.
• Read accesses are possible.
This state is indicated by the check mark in the context menu command.
Control Expert adds some restrictions linked with the memory card (for example program
modification is forbidden if the card is write protected). The simulator supports these
restrictions too.
To simulate the write protection feature the following system bits and words are supported
by the simulator:
• %S65 (CARDIS)
• %S96 (BACKUPPROGOK)
• %SW97 (CARDSTS)
NOTE: It is not possible to access the files via an FTP client through the simulator since
the files are directly accessible by Windows features.

Simulator Control for Modicon Momentum CPU

Introduction
The dialog box is shown if the simulator is simulating a CPU from the Modicon Momentum
family.

58 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Representation of the dialog box:

CPU Front Plate

The RUN display is always on, green when a project is loaded in the simulator.
The SER COM display is flashing yellow when data is exchanged between Control Expert
(or other clients) and the simulator.
The other grayed displays of the front plate are not supported by the simulator.

Card Acc and Memory Card

The Card Acc and memory card are represented but they do not concern Modicon
Momentum CPUs.

Reset
The Reset button is represented but it does not concern Modicon Momentum CPUs.

EIO0000001714.09 59
 Menu Commands and Dialog Boxes in the PLC
Simulator

Power Cycle
With this button, you simulate a warm start of the CPU. It means that the connection
between Control Expert and the simulator is broken, the current project variables remain
and the simulator goes into the state RUN (autostart active) or STOP (autostart
deactivated).
A power cycle corresponds to a power off and power on of a real power supply.

Simulation
Dialog box fields:

Host PC name: DNS name of the host PC for the simulator. If the PC has multiple network cards,
only the first is shown.

Host IP address: TCP/IP address of the host PC for the simulator. If the PC has multiple network
cards, only the first is shown.

Project name: Name of the project loaded in the simulator.

Clients Connected
The list shows current clients connected with the PC (PCs which are connected via TCP/IP
with the host PC of the simulator, page 18). The DNS name and TCP/IP address are shown
for each client.

Event Dialog
Introduction
You can open and close the event dialog with
• the menu command Event dialog in the context menu of the simulator symbol in the
task bar or the simulator symbol
• the command button Events in the simulator dialog (only open)
This dialog is not available for safety PLCs.

60 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Selection Condition
The menu command and the command button are enabled if IO events are defined in the
project currently loaded, i.e. if the project uses event tasks.

Representation
Event dialog:

EVT0 Event
Possible events for the EVT0 task are shown here. This user task has the highest priority in
the system and can only contain one IO event.
If this task is part of the project, the event command button is enabled.

EVTi IO Event
Possible events for the EVTi IO task are shown here. The maximum number of tasks
depends on the PLC simulated.
The event command buttons are enabled according to the number of events defined in the
project.

EIO0000001714.09 61
 Menu Commands and Dialog Boxes in the PLC
Simulator

Clear
Introduction
With Clear, you can remove the currently loaded project from the simulator memory and put
the simulated PLC (and the simulator) into NOCONF status.
This corresponds to a cold start of the PLC without valid project loaded (the connection
between Control Expert and the simulator is broken).
You can execute Clear with the menu command Clear in the context menu of the simulator
symbol in the task bar.

Reset
Introduction
With Reset, you can reset the simulated PLC (and the simulator). This corresponds to a cold
start of the PLC (the connection between Control Expert, the simulator is broken, project
variables are reset and the simulator goes in RUN (if auto start is activated) or in STOP (if
auto start is deactivated)).
Reset corresponds to the reset button on a real CPU.
You can execute reset with
• the menu command Reset in the context menu of the simulator symbol in the task bar
or the simulator symbol
• the command button Reset in the simulator dialog.
NOTE: %S0 is not set to 1 using Reset with the PLC simulator (in contrast to a real
PLC).

Power Cycle
Introduction
With Power Cycle, you execute a power cycle (power off/ power on) for the simulated PLC
(and the simulator). This corresponds to a warm start of the PLC (the connection between
Control Expert and simulator is broken and the current project variables remain).

62 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

A power cycle corresponds to the reset button of a Premium power supply or the unplugging
and plugging in of a power supply.
You can execute a power cycle with
• the menu command Power Cycle in the context menu of the simulator symbol in the
task bar or the simulator symbol
• the command button Power Cycle in the simulator dialog
NOTE: In case of a safety PLC, power cycle simulates a cold start. Project variables are
reset.

Simulator Panel Options

Introduction
This chapter provides information on special settings for the PLC Simulator, including cyber
security settings.

Description
In this dialog box, you can define special settings for PLC Simulator.
You can open the dialog box with the menu command Options in the context menu of the
PLC Simulator symbol in the task bar or the PLC Simulator icon.

EIO0000001714.09 63
 Menu Commands and Dialog Boxes in the PLC
Simulator

Representation

Always on top
If you activate this check box, the PLC Simulator control window is always on top of other
dialog boxes and windows.

Only PLC front

If you activate this check box, the PLC Simulator control window is minimized and only the
front plate of simulated controller is shown.

Sound
If you activate this check box, PLC Simulator plays a sound in the following situations:
• Starting and exiting PLC Simulator.
• Error in project.

64 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Use default application to start simulator (enforce

security)
If you activate this check box, the PLC Simulator needs an application with password to
start, page 15.
NOTE: To help enforce security, you must select this checkbox. Otherwise, you may be
vulnerable to cyber security issues.

Starting application with password

Path and name of the application with password used to start PLC Simulator.
NOTE: If you enter a path and application name, and the application does not contain a
password, the PLC Simulator will not start.

IP Address <-> Port simulation file

Path and name of the port simulation file (*.xml) used to substitute IP address with port
communication in a PLC Simulator instance, page 26.

Listening IP Address
When PLC Simulator runs on the same PC as the Control Expert instance, you should limit,
for security reasons, to the following IP address: 127.0.0.1.
Use a Listening IP address of 0.0.0.0 to set PLC Simulator to listen to another Control
Expert instance or controller on the network.

Timing (simulator)
Description
With this menu command, you can open and close the timing dialog box. This dialog box
shows simulator statistics for CPU use, process priority and user scan time. Additionally, you
can change the priority and the sleep time in this dialog box, to optimize simulator timing and
adjust the PC load.

EIO0000001714.09 65
 Menu Commands and Dialog Boxes in the PLC
Simulator

Representation of the dialog box

The dialog box consists of 4 main areas:

• Processor Load, page 66
• Priority of the Simulator, page 68
• Data in the User Task, page 69
• Minimum Sleep Time, page 71

Processor Load
Introduction
The processor load (on the PC) caused by the entire simulation and the individual user tasks
is shown here.

66 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Process
This bar graph shows the actual processor load caused by the simulator process in percent.
Unlike the display in the Windows task manager which only indicates the current value, this
bar graph indicates the average value over the time shown at the end of the bar graph.
The time entry at the end of the bar graph is the time that has passed since the simulator
was started or since the last time reset was pressed.

Overhead
This bar graph shows the average processor load caused by the simulator process
overhead in percent.
The overhead is calculated as follows:
load caused by the entire process - load caused by the user tasks
This can be an absolute or relative value for the processor load caused by the simulator.
This setting can be made in the Display area.
The time entry at the end of the bar graph is the time that has passed since the simulator
was started or since the last time Reset was pressed.

Mast ... Ev1T, Safe

The bar graph shows the average processor load caused by the individual user tasks in
percent.
These can be absolute or relative values for the processor load caused by the simulator.
The representation method can be set in the Display area.
The option button at the beginning of the bar graph can be used to select a user task. The
details for this user task will be displayed in the User Task Data area.
The time entry at the end of the bar graph is the time that has passed since the individual
tasks were started or since the last time Reset was pressed.
NOTE: In case of a safety PLC, only the Mast and Safe tasks are enabled

EIO0000001714.09 67
 Menu Commands and Dialog Boxes in the PLC
Simulator

Display: Absolute
If you activate this option button, the actual value is shown in the bar graph. This is shown
as a percentage of the entire processor load for the PC.

Display: Relative
If you activate this option button, the relative processor load is shown in the bar graph. This
is shown as a percentage of the processor load caused by the simulator.

Reset
If you press this command button, time measurements in this area are reset.
This is required to achieve a consistent representation of the times which have passed
because the individual times are not started simultaneously when opening the simulator.

Priority of the Simulator

Introduction
In this area, you can define the priority of the simulator process.
It may be necessary to assign a high priority to the simulator because the cycle times of the
individual user tasks can deviate greatly if there is a heavy load on the PC. These deviations
are directly caused by the Windows operating system and can reach 100 ms with Normal
priority. In most cases, the watchdog timer is also affected. In this case, setting the simulator
priority higher can prevent the watchdog from being triggered.

Real-time
In this priority, user task cycle times only deviate by a few milliseconds.
NOTE: This priority should be used with care because the simulator has the highest
possible priority in this case and interrupts the Windows system. If you use this priority
with a very small sleep time and a cyclic user task, the PC may cease proper operation.

68 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

High
In this priority, user task cycle times normally do not deviate by more than 10 ms.

Normal
In this priority, user task cycle times can deviate up to several 100 ms.

Low
This priority quickly causes the watchdog to be triggered and should only be used on a PC
with nearly no load.

Apply
If you press this command button, settings in this area are applied and used immediately.

Data in the User Task

Introduction
2 histograms are shown in this area
• the cycle time histogram for the selected user task
• the sleep time histogram for the selected user task

Structure of the Histograms

The histograms automatically adjust their ranges to the current values.
The percent scale (y-axis) is adjusted to the maximum percent value.
If a new value is not in the range for the time scale (x-axis), the range is increased by a
factor of 2 until the new value is in the range. In this case, the previous values are
recalculated for the new range.

EIO0000001714.09 69
 Menu Commands and Dialog Boxes in the PLC
Simulator

If a value occurs so seldom that it does not create a peak in the histogram, then a one pixel
peak is created so that the value can be seen.

Cycle time
This histogram shows the relative frequency of cycle time values in the user task currently
selected. See also Minimum Sleep Time, page 71
The counter to the left under the histogram counts the number of cycles in RUN mode
represented in this histogram.

Sleep time
This histogram shows the relative frequency of sleep time values in the user task currently
selected. See also Minimum Sleep Time, page 71
For cycle tasks, normally a single value is shown with 100 %. This is the minimum sleep
time for user tasks. If you change the value for the minimum sample time, a second peak is
created for the new value.
User tasks cycles are included in this histogram (regardless of the PLC mode).

Cycle Counter
The counter to the left under the histogram counts the number of cycles in RUN mode
represented in the cycle time histogram.
This counter has no meaning for the sleep time histogram because cycles are included
there (regardless of the PLC mode).

Reset
If you press this command button, the histograms for the user task currently selected is reset
and a new statistic is started.

70 EIO0000001714.09
Menu Commands and Dialog Boxes in the PLC
Simulator

Minimum Sleep Time

Description
The simulator is not the only thing running on the PC, therefore the other programs must be
given a chance to be executed. Therefore the user task is assigned a fixed sleep time.
The sample time is calculated according to the following formula:
Sample Time = Cycle Time + Sleep Time.
Time of the user task

Legend

Time Meaning

Sample time Time which is made available for running the user task.

Cycle time Time which is actually required for running the user task.

Sleep time Time in which the other programs on the PC can be executed.

Minimum sleep time (ms)

A minimum sleep time of 10 to 100 ms can be set.

Apply
If you press this command button, the minimum sleep time is applied to the selected user
task and used immediately.

EIO0000001714.09 71
 Menu Commands and Dialog Boxes in the PLC
Simulator

Info
Description
With this menu command, you can open and close the info dialog box. This dialog box
shows the current version of the simulator and its components.

Help
Description
With this menu command, you can open the online help for the simulator.

Ending the Simulation

Description
With this menu command, you can exit the simulator.

72 EIO0000001714.09
Index
D
dialog boxes ..............................................29

M
menu commands .......................................29

S
simulating a controller.................................14
simulation ..................................................14

EIO0000001714.09 73
Schneider Electric
35 rue Joseph Monier
92500 Rueil Malmaison
France
+ 33 (0) 1 41 29 70 00
www.se.com

As standards, specifications, and design change from time to

time, please ask for confirmation of the information given in
this publication.

© 2023 Schneider Electric. All rights reserved.

EIO0000001714.09