Five protocols, five simulators
Pick a protocol and run it now
Four of the five start the simulator for you the moment you press Connect, and stop it again when you disconnect. For those, the whole evaluation is opening a project file.
OPC UA
IEC 62541
A bottling line with tags that misbehave
A Python server models a filler, capper, pasteuriser and utilities: typed tags, a six-element float array, string status tags, engineering units and ranges, and a sensor that reports a Bad status for five seconds out of every ten. Browse the address space, tick the Plant folder, and generate the dashboard from the selection.
$ pip install asyncua
$ python "examples/OPC UA PLC Simulator/opcua_plc_simulator.py"
# then press Discover at opc.tcp://127.0.0.1:4840
- Browse and subscribe exactly as you would against a real server
FaultySensor holds its last good value through the fault
- Flags reproduce the awkward cases:
--no-subscriptions, --drop-after, --secure-only
Modbus
TCP / RTU
A hydraulic test stand that fails on purpose
A physics-based simulator acts as a Modbus TCP server and drives a realistic hydraulic stand through six states, including pump cavitation, emergency stop and a controlled restart. Serial Studio launches it for you when you connect.
$ pip install pymodbus
# open "Modbus PLC Simulator.ssproj" and press Connect
- Holding registers mapped straight onto gauges and trends
- A failure and recovery sequence you can sit and watch
- Raise
FAILURE_PROBABILITY to make alarms fire on demand
Siemens S7
ISO-on-TCP
S7comm without a Siemens CPU
An ISO-on-TCP simulator that speaks S7comm well enough for a real session: connect confirm, PDU length negotiation, and read requests served out of a drifting DB1. It needs the Python standard library only, with no snap7 and no vendor DLL, and the same read service runs against it as against an S7-1500 in a cabinet.
# Windows: open the project and press Connect
# macOS and Linux, because port 102 is privileged:
$ sudo python3 "examples/S7 PLC Example/s7_plc_simulator.py"
- Absolute addressing exactly as documented:
DB5.DBD20:REAL, MW10:INT
- A declared type that does not fit its address is refused, not read wrong
- Generates a project from the variable list, one group per data block
IEC 60870-5-104
Port 2404
A substation link on a laptop
A simulated station served over IEC 60870-5-104: the STARTDT handshake, a full station interrogation, short-float measurands and single points, spontaneous updates afterwards, and honest k and w sequence-number accounting. Standard library only, and port 2404 needs no elevated privileges, so this is the one that simply runs.
# open "IEC 104 Station.ssproj" and press Connect
# or drive it from another client:
$ python3 "examples/IEC 104 Example/iec104_server.py"
- Points are discovered by the interrogation, not typed in beforehand
- Quality is kept per point: invalid, not topical, substituted, blocked, overflow
- An invalid point keeps its last good value instead of drawing a fake number
Sparkplug B
over MQTT
An edge node with a real birth certificate
A Sparkplug edge node that publishes an aliased birth certificate, alias-only NDATA afterwards, an NDEATH last will, and answers a rebirth command. Serial Studio's MQTT driver decodes it in Sparkplug mode. The node is started for you; the broker is the one piece that is not, so Mosquitto has to be listening first.
$ pip install paho-mqtt
# a broker must be up on 127.0.0.1:1883, then
# open the project and press Connect
- Birth, data, death and rebirth, the parts integrations actually get wrong
- Aliases resolved against the birth certificate rather than guessed at
- Stop the node to watch the last will arrive
EtherNet/IP
No simulator
The one that ships without a simulator, on purpose
Reading a single Logix tag means an encapsulation session, a forward-open on an unconnected message manager, a CIP path through the backplane and symbolic-segment addressing on top. A short Python stub could answer plausible bytes while exercising none of the parts that go wrong in a plant, so this example points at something real instead. Two options behave like the hardware.
# libplctag's own test server, no Rockwell licence:
$ ab_server --plc=ControlLogix --path=1,0 \
--tag=Tank_Level:REAL --tag=Pump_Running:BOOL
ab_server ships with the libplctag sources and answers CIP tag reads
- Studio 5000 Logix Emulate is the licensed option, and runs a real downloaded project
- Any CompactLogix or ControlLogix on the network works with no extra software