PLC simulator software: which one runs your real project, and when the free clock stops

"Which PLC simulator software is free?" I get asked that more than anything else about testing without hardware, and it is the wrong first question. The first question is which controller the project was written for. An emulator runs one family and nothing else. So the free option for your brand may not exist, and a free one for somebody else's brand won't even open your file.

Here is what each package actually runs, how long the free or trial version keeps going before it stops, and the handful of things no emulator will ever tell you about your program.

Trainer, emulator, soft PLC: three different jobs

Everything in this space gets sold as PLC simulator software, which is exactly how people end up with the wrong one. There are really three kinds, and they don't stand in for each other.

Trainers look like a PLC. They run ladder against virtual pushbuttons and lamps, usually in a browser, and they're good for learning what a seal-in rung does. None of them will open your project, because none of them is anybody's firmware.

An emulator is a different animal. It runs your actual project file against a software copy of one controller family: FactoryTalk Logix Echo, S7-PLCSIM and RSLogix Emulate all work this way. The weak word in that sentence is "one."

Then the soft PLCs, which aren't imitating anything. TwinCAT, CODESYS and B&R put the control runtime itself on your PC, so what you test is what runs.

On top of any of those you can hang a 3D plant model like Factory I/O or ProtoTwin. It feeds sensor signals to the logic and moves when the outputs fire. That's the piece that makes it feel like a machine instead of a tag table.

Three kinds of PLC simulator software, sorted by what you actually need to test. The 3D model is an add-on to the middle column, not a replacement for it.

How long the free version runs, package by package

Here's the PLC simulator software I'd actually consider, what each one covers, and where the free part ends.

 

The Rockwell rows are the expensive ones, and they're also where picking wrong costs the most. Down in the soft PLC rows is the only place "free" means months of learning instead of days. And one mix-up worth killing right now: the two-hour cutoff belongs to CODESYS. TwinCAT 3 doesn't work that way.

Rockwell: the catalog number on the controller picks the emulator

With Allen-Bradley the choice of PLC simulator software is made before you open a browser. Read the front of the controller.

Left, a 1756-L73 from the ControlLogix 5570 family, which Studio 5000 Logix Emulate covers. Right, a 1756-L85E from the 5580 family, which needs FactoryTalk Logix Echo

A 1756-L7x is a ControlLogix 5570, and that's Studio 5000 Logix Emulate territory. Emulate comes with Studio 5000 Professional, but it's its own install with its own download entry. It doesn't always show up in the download list for your serial number, either. Hit Show All and search for Studio 5000 Emulate before you decide you don't own it.

Anything from the 5580 generation on, meaning a 1756-L8x, a CompactLogix 5380 or a ControlLogix 5590, needs FactoryTalk Logix Echo. Rockwell put Echo out in July 2021 as the successor to Emulate, and the big change is that the project goes in unmodified. No Change Controller, no converted copy, and the I/O configuration comes along as it is. The minimum Logix Designer version depends on the family: 33 for ControlLogix 5580, 35 for GuardLogix 5580, 36 for CompactLogix and Compact GuardLogix 5380, 38 for ControlLogix 5590.

Emulate can't do that. It runs 5570-family projects, so an L8x program has to be converted in a copy first, and everything you test after that is the copy, not the file you'll download. On a small project that's an annoyance. On a big one with a full I/O tree it's the reason to budget for Echo.

Echo is sold as a subscription with one running instance per license. The license only counts while a controller is switched on, so turn them all off when you walk away from it.

What Echo will do, and what it won't

 

The blocking is deliberate. Echo drops outgoing Class 3 and Class 0/1 traffic on its Ethernet port so a test controller can't start driving a real machine by accident. I'd rather have it that way, frankly.

Two setup problems that eat the first afternoon

Port 44818. Echo wants it, and so does the "Listen on EtherNet/IP encapsulation ports" setting that FactoryTalk Linx turns on by default. Open FactoryTalk Linx Browser, go to Configure Drivers, edit the emulate driver and clear that box on the Advanced tab. Other software on the PC that leaned on that setting may stop working afterward, so check before you shrug it off.

Then the loopback address. By default Echo offers 127.0.0.1, which is fine for one controller and Logix Designer on the same PC. It stops being fine when a second controller has to produce or consume with it, or an HMI on another machine has to reach it. Add a real IP to the network card under Advanced TCP/IP in Windows (admin rights needed) and give the emulated controller that address instead.

And pick the firmware revision carefully when you add the controller. You can't change it later.

The older and smaller Rockwell options

RSLogix Emulate 500 is a free download with no trial clock, and it emulates SLC 500-family logic. The free Micro Starter Lite editor that sits next to it only programs the MicroLogix 1000 and 1100. Rockwell is clear that Emulate alone isn't final checkout, and I wouldn't count on PID or MSG instructions behaving there the way they do in a real processor.

For Micro800 there's the simulator in Connected Components Workbench. The free Standard edition gives you a ten-minute runtime demo of it; the full simulator comes with Developer.

Siemens: PLCSIM or PLCSIM Advanced

Siemens gives you two pieces of PLC simulator software inside TIA Portal, and which one you need comes down to one question. Does anything outside TIA Portal have to talk to the virtual CPU?

 

If it's just you, TIA Portal and a simulated HMI on one laptop, basic PLCSIM covers it. The moment a real panel, a third-party OPC UA client or a plant model on another PC needs in, you're in Advanced territory.

Two things trip people on the first download. Advanced won't take an S7-1200 at all: try it and you get "Loading of hardware configuration failed (0020 -3 2 0)." And the project needs "Support simulation during block compilation" ticked on its Protection tab. Know-how protected blocks have to be unlocked with their password and marked as simulatable, or they stay out.

Advanced simulates the CPU, not the rack. PROFINET IO and PROFIBUS DP aren't simulated, configured I/O modules aren't either, CMs and CPs aren't supported, and you're working against the process image. Siemens also wants one free CPU core per instance to get anything close to deterministic timing, which matters more than people expect on a laptop that's running TIA Portal at the same time.

One small thing that saves an hour. A High_Speed_Counter on a TM Count module throws 16#80C7 in simulation because it's waiting for the module's STS_READY bit, and the simulator never sets it. That bit sits at offset 13.4 in the module's input area, so with the input area starting at %I32 it's %I45.4. Set it yourself and the counter settles down.

With Advanced, real SIMATIC HMI panels connect from version 14 on. Anything older needs updating first.

TwinCAT, CODESYS and B&R: the runtime is on your laptop

This is the corner of the PLC simulator software world I send people to when they want to learn properly, because nothing is faked. You're running the real runtime.

TwinCAT 3 engineering is a free download. The runtime licenses are 7-day trial licenses, and you can generate them as often as you like, offline. Activate a configuration and XAE notices the missing licenses and offers to generate trial ones, so just say yes. You can also make them by hand: open License in the project tree, go to the Order Information (Runtime) tab and hit 7 Days Trial License. Two limits. Trial licenses can't go on a TwinCAT license dongle, and you can't create them from the runtime (XAR) alone, you need XAE.

With CODESYS you register, then download the whole Development System at no cost. The SoftPLC is the part with the clock: with no license it runs in demo mode and shuts itself off after two hours. That's plenty for learning, and CODESYS sits under a lot of other brands' controllers, AutomationDirect's ProductivityCODESYS line included, so what you learn carries over. There's a CODESYS Control build for the Raspberry Pi too, if you want real I/O on the cheap.

B&R's evaluation license is the most generous clock here: 90 days of unrestricted use, no commercial work, and Automation Studio itself downloads free. Simulation runs in ARsim on the same PC. It's a deep package with a real learning curve, and ninety days goes faster than you'd think.

AutomationDirect and Schneider: the simulator is already in the box

Productivity Suite and Do-more Designer both have the simulator built into the programming package. Free, nothing extra to install. Do-more Designer covers the BRX, H2 and T1H Do-more CPUs.

The Productivity simulator session times out after roughly two hours. Plan on it and restart. It also won't simulate intelligent modules like a high-speed counter, which is one more argument for the in-program simulation further down. A C-more panel can talk to the simulator if its project points at the PC's IP address rather than the PLC's.

Schneider installs its PLC Simulator along with EcoStruxure Control Expert, so if Control Expert is on the machine, you already have it.

Browser trainers and 3D scenes

Browser trainers like PLC Fiddle are free PLC simulator software in the purest sense: open a page, drop contacts and coils, flip virtual switches. Ladder only, digital I/O, a trimmed instruction set. Right for somebody deciding whether controls is the job for them, or a maintenance tech learning to read ladder on a tablet. Wrong for anything you plan to download.

OpenPLC is a step up. It's an open-source IEC 61131-3 editor with a simulator built in, and the runtime also runs on real low-cost hardware. The project now sits under Autonomy, which added a browser IDE, but the classic OpenPLC IDE is still a download you can run offline. It talks Modbus/TCP to a SCADA or HMI package, which makes a decent free lab.

Factory I/O is where it starts to look like a machine. It has drivers for Logix5000, Micro800, MicroLogix, SLC 5/05, S7-1200/1500 and S7-PLCSIM, plus Modbus TCP and OPC UA client connections; CODESYS and PLCSIM Advanced pair with it too, through OPC UA or Modbus rather than a dedicated driver. The 30-day trial is the full Ultimate edition. Pairing it with CODESYS? Use OPC UA rather than Modbus as soon as analog tags show up. OPC UA carries the real data types and complains when a tag doesn't match the sensor. Modbus just moves registers and lets you find out later. For a classroom, floating licenses need a permanent internet connection, and a license from a crashed session comes back to the pool after 10 minutes.

ProtoTwin runs a physics-based digital twin in the browser. PLC connectivity lives only in the Connect tier, $3,000 a year, which talks Siemens S7, EtherNet/IP, Beckhoff ADS, OPC UA, Mitsubishi MELSEC, Omron FINS, Modbus TCP, MQTT and OpenPLC through a desktop app, since browsers aren't allowed onto your local network. Schools, colleges and universities get it free.

What talks to what in a typical co-simulation. The emulator reaches HMIs and plant models; real I/O and drives stay out of reach on purpose.

No license at all: build the simulation into the program

Some of the most useful testing I do needs no PLC simulator software license at all, and it works on every platform above, including a real controller on a bench with nothing wired to it. You write a small simulation routine into the program itself.

The trick is buffering the I/O. Physical inputs get copied into internal tags once per scan, the machine logic only ever reads those internal tags, and outputs go the same way in reverse. Now a single bit decides where the inputs come from: the real card, or a routine that fakes them from your own outputs.

One bit decides whether the machine logic sees the real input card or the simulation routine. The logic itself never changes.

Say a sequence extends a cylinder and waits for the extended switch before it closes a clamp. In IEC 61131-3 structured text, CODESYS or TwinCAT syntax, the fake cylinder is two timers:

(* Sim routine: only called while SIM_Enable = TRUE *)

tonExtend(IN := Out_CylExtend, PT := T#1500MS);

tonRetract(IN := NOT Out_CylExtend, PT := T#1500MS);

Sim_CylExtended  := tonExtend.Q;

Sim_CylRetracted := tonRetract.Q;

And the input map picks the source:

IF SIM_Enable THEN

    In_CylExtended  := Sim_CylExtended;

    In_CylRetracted := Sim_CylRetracted;

ELSE

    In_CylExtended  := DI_CylExtended;    (* real input card *)

    In_CylRetracted := DI_CylRetracted;

END_IF

The retracted switch drops the instant the valve fires, and the extended switch makes 1.5 seconds later, which is how a real cylinder behaves. Stretch the timer to test your timeout alarm. Add a fault bit that holds Sim_CylExtended off and you've tested the stuck-cylinder fault without bending a bracket. In ladder it's the same two timers.

On a Logix emulator, where the I/O modules sit faulted anyway, this is the easiest way to give the logic something to work against. Just make it impossible to ship with SIM_Enable on. I clear it on first scan and put a banner on the HMI whenever it's set.

What no PLC simulator software will tell you

Timing, first. Every one of these runs on Windows alongside everything else on the PC. Scan times on the emulator won't match the hardware, fast timers drift, and a sequence that's tight on a real controller can pass on the laptop for the wrong reason. Echo and PLCSIM Advanced both have a virtual time mode, which is handy for staying in step with a plant model and useless for proving real timing.

Then the I/O and the network. The emulators simulate the CPU. They don't simulate the fieldbus, the adapters, the comm modules, or the fault an adapter throws when somebody bumps a cable. MSG instructions to real devices go nowhere. Anything that depends on a module's own status bits, like that TM Count example, has to be faked by hand.

And safety. Echo will take a GuardLogix project and generate an imitated safety signature for it, and with Partner available ticked it emulates only the presence of the safety partner. That's fine for testing the standard logic around the safety task. It proves nothing about the safety system.

So the emulator is the step that gets you to where the only surprises left are hardware surprises. Final checkout still happens on a real processor with real I/O.

Frequently asked questions

Is there free PLC simulator software for Studio 5000?

Not really. Studio 5000 Logix Emulate is bundled with Studio 5000 Professional and covers ControlLogix 5570 projects. FactoryTalk Logix Echo, for the 5580, 5380 and 5590 families, is a paid subscription and isn't part of any Studio 5000 edition. The free Rockwell options are RSLogix Emulate 500 for SLC 500-family logic and the ten-minute Micro800 simulator demo in Connected Components Workbench Standard.

Can PLC simulator software connect to a real HMI panel?

Some of it can. S7-PLCSIM Advanced connects to real SIMATIC HMI panels, version 14 and later, over TCP/IP; basic PLCSIM doesn't. Echo talks to HMIs over EtherNet/IP, but give the emulated controller a real IP on the PC's network card if the panel sits on another machine. On AutomationDirect, point the C-more project at the PC's IP address.

Does S7-PLCSIM Advanced simulate an S7-1200?

No. For S7-1200 projects use the S7-PLCSIM that comes with STEP 7. Advanced covers the S7-1500 family and ET 200SP CPUs.

How long does the free TwinCAT 3 trial last?

Seven days per trial license, and you can generate a new one as many times as you want, offline. It can't be stored on a license dongle.

What is the best PLC simulator software for learning PLC programming?

For IEC 61131-3 and structured text, CODESYS or TwinCAT 3, because you're running a real runtime for free. If the job you're after is Allen-Bradley ladder, Micro Starter Lite with Emulate 500 or the Micro800 simulator gets you going, as long as you know Studio 5000 is a different animal. A browser trainer is fine for the first evening.

When the emulator has told you all it can

At some point the only thing left to test is the hardware, usually the same week somebody needs a controller on the bench by Friday. Whatever PLC simulator software got you this far, IQElectro stocks the processors it stands in for: ControlLogix 5580 like the 1756-L83E, ControlLogix 5570 like the 1756-L73, CompactLogix 5380 like the 5069-L320ER, the Siemens S7-1500 6ES7515-2AM02-0AB0 and the S7-1200 6ES7214-1AG40-0XB0, plus the MicroLogix 1100 1763-L16BWA, the SLC 5/04 1747-L542 and the Micro850 2080-LC50-24QWB. All tested, all with a 2-year warranty. Send the catalog number off your drawing and we'll tell you what's on the shelf.