Unofficial notes · SIMATIC Target for Simulink · V6.0 SP3 · Manual A5E38915112‑AR, 01/2026
SIMATIC Target is a Simulink system target file: two TLC files,
_grt for Simulink Coder and _ert for Embedded Coder, that tell the Coder
what machine to build for. For an ODK‑enabled S7‑1500 controller it turns the model into C/C++,
builds that against ODK 1500S into a shared object, and writes the SCL blocks your S7 program calls it
from. For the Siemens Industrial Edge Runtime it instead packages the binaries and hands them to LiveTwin.
Either way, the block keeps the model's own interface.
Personal study notes — not a Siemens publication. The manuals on Siemens Industry Online Support are authoritative.
What it actually is
"Target" is the MathWorks word: a system target file that tells the Coder what kind of
machine it is generating for. There are two — Simatic_Target_V6_0_grt.tlc for
Simulink Coder, Simatic_Target_V6_0_ert.tlc for Embedded Coder — and either one lets
you pick a runtime: an S7‑1500 Software Controller (ODK) or LiveTwin on an Industrial Edge device.
Pressing Build in Simulink then produces loadable artefacts for whichever you chose, rather than generic
C. Manual p.15, p.26
The compile chain
Either Coder emits C/C++ from the model. For the ODK runtime, the ODK 1500S compiler
turns that into a shared object and SIMATIC Target writes the SCL wrapper so the S7 program has
something to call. Build with Code > C/C++ Code > Build Model or the Build button on
the SIMATIC Target toolstrip tab — Ctrl+B is the shortcut for the menu item. The toolstrip
also holds Model Settings, Target Options, Monitor & Tune, Control Panel, Tune Parameters and
Online Support. Manual p.26, p.75, p.84
Where the model runs
The compiled SO file runs on an S7‑1500 Software Controller, an ET 200SP Open Controller, a CPU 1518 MFP/ODK, or S7‑PLCSIM Advanced V3.0 or higher — the model executes there, one model step per FB call. The other runtime is LiveTwin on an Industrial Edge device, which runs the model as a 1D simulation package instead of an SO file. Manual p.15, p.77, p.17, p.110
What you get to call
The generated FB carries the model's own inputs and outputs — the temperature example's
setpoint and processValue in, outPID out — plus
EN/ENO and a STATUS output for diagnostics. It reads like a
library block, not like generated code.
The workflow
The build drops two things in the output folder, and they reach the CPU by separate routes: the SCL source goes into the TIA Portal project and becomes blocks, while the .so file goes onto the CPU's web server and is pulled into RAM at startup. Missing either one is the most common reason a first attempt does nothing.
Or skip the dialogs
set_SIMATICparam(model, name, value) and get_SIMATICparam mirror MATLAB's own set_param / get_param — nearly every Target option has a command-line name. Siemens recommends the user interface for consistency; three fields have no command-line parameter at all, by design: username, password and the TLS private-key passphrase. Manual p.67
Generated script
Values are strings in single quotes, exactly as the manual's option table shows them — even the numeric ones. A quote inside a text field is doubled, MATLAB's own escaping rule. Manual p.67–72
The worked example, live
A discrete PID built in Simulink drives a PT3 temperature process (three PT1 lags,
10 s / 10 s / 5 s). In the real system the PID is the compiled model inside the CPU and
the process is the LSim_PT3 block in the S7 program, both called from
OB CyclicInterrupt every 100 ms. The gains below are the values the shipped
example was generated with. Move them and you are doing exactly what External Mode or a watch table
does to a running CPU.
Solved at the model's own step size, Ts = 0.1 s — forward-Euler integrator and derivative filter, output clamped to the saturation limits, exactly as the generated Model_PIDOneStep does one step per call.
Writable model parameters
Names as they appear in the generated Model_PIDParams structure.
Presets
Upper limit 20 reproduces the manual's External Mode demonstration: outPID clamps at 20 and the process settles there instead of at 50.
What lands in your project
Importing the SCL source and choosing Generate blocks from source produces this
set. Which optional objects appear depends on what you ticked before the build. The interfaces below
are read from the SCL that ships with the example — model name Model_PID, so every
object is prefixed Model_PID.
What crosses the boundary
Every basic Simulink type maps to one ODK type, one C++ type and one STEP 7 type — click a row for the SCL declaration it produces. Manual p.127
| Simulink | ODK | C++ | STEP 7 |
|---|
STEP 7 access — complex types
| Contents | Arrays | Bus objects | Enumerations | Complex numbers |
|---|---|---|---|---|
| Inputs/outputs | ✓ | ✓ | ✓ | ✓ |
| Parameters | ✓ | ✓ | ✓ | ✓ |
| Internal signals | ✓ | ✓ | ✓ | ✓ |
Web server access — complex types
| Contents | Arrays | Bus objects | Enumerations | Complex numbers |
|---|---|---|---|---|
| Parameters | ✓ | ✓ | ✗ | ✓ |
| Internal signals | ✗ | ✗ | ✗ | ✗ |
| Scoping | ✗ | ✗ | ✗ | ✗ |
Bus objects compile into PLC data types for the S7 program. Manual p.127–128
| Storage class | Parameter access | Internal signals |
|---|---|---|
| Auto | Yes, if cast to a supported class | Yes, if cast to a supported class |
| Model default | ✓ | ✓ |
| ExportedGlobal | ✓ | ✓ |
| ImportedExtern | ✓ | ✓ |
| ImportedExternPointer | ✗ — build error 31 for tunable params | ✗ |
| Custom storage class | ✓ (static-variable CSCs ignored — warning 60; >64 classes lose grouping — warning 62) | ✓ (localizable signals not accessible — warning 61) |
| Reusable / Localizable | — | ✗ — not supported for internal signals |
The storage-class selection mask — All or Customized — is changeable at runtime through ReadWriteParameters' storageClasses input. Manual p.100, p.104, p.47–48
Stateflow
STEP 7 gets read access to active states through chartStates. The web view goes further: charts, Simulink functions and states inside charts, graphical functions, hierarchies, atomic subcharts, boxes and state transition tables (shown as a chart) all display. It does not show MATLAB functions in charts, truth tables, or subcharts nested inside subcharts — and transitions, parallel states and Moore charts are not shown as activities. Embedded Coder's Use bitsets for storing state configuration (StateBitsets) must be off for Stateflow access, or STEP 7 and web access to states is blocked (warning 21). Manual p.123–126, p.133
More than one loop on the CPU
Since V6.0 SP1, several Simulink models can be built into different software units and run on the same CPU; since V6.0 SP2, those units can carry namespaces, with TIA Portal V19 or later. Manual p.84–88
Naming and namespaces
Target prefixes every generated element with <ModelName> — default OB/DB names are <ModelName>BlockName — and a unit's namespace preset is applied to the program blocks and PLC data types generated into it. The Published attribute is preserved during the build: a called FB and its instance DB must be Published at the same time, or TIA Portal fails to compile. Running External Mode on several models at once needs a different Port Number and Connection ID for each. Manual p.86–88
Referenced models
Supported since V1.0 Update 1. Almost every setting comes from the parent model only — access to parameters, internal signals and Stateflow states are the exceptions, evaluated per referenced model. External Mode enabled in the parent covers its referenced models too, and a referenced model's own Interface setting must be External mode or None, or compiling fails. Manual p.92–93
PLCSIM Advanced, in the library
The SIMATIC Target Simulink library ships a ready-made PLCSIM Advanced block for software-in-the-loop coupling, alongside the OneStep/Load/Unload family. Manual p.108
S-functions
Supported three ways: non-inlined (a plain C/C++ MEX S-function, no matching .tlc), inlined (with a hand-written .tlc), or generated via the S-Function Builder block or the Legacy Code Tool, which can produce both the inlined S-function and its TLC for you. Manual p.106–107
Once it is running
Every route below writes to the model in RAM. Restart the CPU and the values compiled into the .so come back. Making a change survive is a separate, deliberate act.
Test purposes only. External Mode is meant for the test environment: no CPU password is required to control tags over it, so changing values while the plant is operating can cause damage or injury if something goes wrong. Manual p.94
| Route | Needs, before the build | Reaches | Sees signals | Survives restart |
|---|---|---|---|---|
| Simulink External Mode Connect from the model, TCP 17725 (or MQTT 9883 for LiveTwin) |
Interface = External Mode, CPU IP in MEX file arguments, stop time inf; optionally TLS — Secure Connection, optional Mutual TLS, certificates from the TIA Portal Certificate Manager via TCON_IP_V4_SEC | Any block parameter, live, from its own dialog | Yes — Simulink Scope | No |
| STEP 7 watch table via …ReadWriteParameters |
Enable parameter access with STEP 7; Default parameter behavior = Tunable | The tunable parameter set, as a PLC data type | Yes — with internal-signal access ticked | No — until you snapshot |
| User-defined website Web server API login page on newer firmware |
Generate model diagrams for PLC Web Server | Parameters under Params, WorkspaceParams or ModelWorkspaceParams, filtered by storage class | Yes — browser Scope, no MATLAB needed | No |
After a simulation finishes or is cancelled, cycle the CPU STOP → RUN before connecting External Mode again, and run OneStep at least once before connecting — steps taken before the connection are lost. Scope block names must not contain blanks. Manual p.97–98, p.119–121
Do not run both
This rule comes from the application example, not the manual: the example project wires an open contact ahead of the Model_PIDCallExtMode call for exactly this reason. Pick one per commissioning session.
Making it stick
Tune by whichever route. Monitor the GlobalParameters DB, take a snapshot of the actual values, copy them to start values, then set paramAccess and writeActive in OB Startup so the write block pushes them into the model on every restart. Download and restart the CPU. Alternatively, change the model and rebuild — and if the block interface changed, re‑import the SCL source. Either way, changes made from STEP 7 live only in work memory and reset the moment the ODK object is re-initialised. Manual p.102
The LiveTwin path, once it is running
On LiveTwin, External Mode does not open a TCP socket to the CPU — it publishes and subscribes through the External Databus app, an MQTT broker on the Edge device. Manual p.98–99
Securing it
Enable end-to-end security in both places: the External Databus configurator in Industrial Edge Management (Data Connections → External Databus → Certificates), and SIMATIC Target's own TLS panel. It is mutual TLS — .crt/.pem keys and certificates on both sides — with OpenSSL statically linked, so a local OpenSSL install never interferes. Passphrase-protect the private key. Manual p.113–114
On the S7‑1500 path, the equivalent is a plain TCP connection to port 17725 via TCON/TRCV/TSEND, optionally secured with TCON_IP_V4_SEC.
Before you lose an afternoon
Set-up
Two columns, because they differ. The application example was built and shipped on one stack; the current V6.0 SP3 installer is a later service pack that pins a much newer MATLAB.
| Component | Example as shipped (Sept 2024) | V6.0 SP3 product manual |
|---|---|---|
| SIMATIC Target for Simulink | V6.0 SP1 · 6ES7823‑1BE05‑0YA5 | V6.0 SP3 |
| System target file | Simatic_Target_V6_0_grt.tlc | _grt.tlc (Simulink Coder) or _ert.tlc (Embedded Coder) |
| SIMATIC ODK 1500S | V2.5 SP4 | V2.0 or higher |
| STEP 7 Professional (optional) | V19 · 6ES7822‑1AE23‑0YA5 | V16 or higher, with TIA Portal Openness |
| CPU 15xx (optional) | ET 200SP Open Controller CPU 1515SP PC2, SW controller V30.1 | any CPU supporting ODK 1500S V2.0+ |
| S7‑PLCSIM Advanced (optional) | V6.0 or later (example's own figure) | V3.0 or higher |
| LiveTwin (optional) | — | V2.0.0 or higher |
| MATLAB / Simulink | R2023b — 23.2 | R2025b* — 25.2, 64‑bit |
| Coders | MATLAB Coder + Simulink Coder 23.2 | MATLAB Coder + Simulink Coder 25.2 |
| Optional add-ons | — | Embedded Coder, Stateflow, Simscape 25.2 |
| Operating system | Windows 10 64‑bit | Windows 10 or 11, 64‑bit |
| Also required | — | Java Runtime Environment (32‑bit) |
| PC minimum | — | Core i5, ≥1.2 GHz, 4 GB RAM, 100 MB free on C:\ |
* R2025b is the officially compatible MATLAB version for V6.0 SP3; full consistency with older MATLAB versions is not guaranteed. Manual p.17
ODK 1500S ↔ SIMATIC Target compatibility
| Target version | ODK V2.0 | ODK V2.5 | ODK V2.5 SP1/SP3 | ODK V2.5 SP4 |
|---|---|---|---|---|
| V1.0 & V1.0 Update 1 | ✓ | – | – | – |
| V2.0 – V6.0 Update 1 | ✓ | ✓ | ✓ | – |
| V6.0 SP1, SP1 Update 1, SP2, SP3 | ✓ | ✓ | ✓ | ✓ |
Manual p.17–18
One-time Windows step
The Target Options dialog drives TIA Portal through Openness, so your Windows account must be a member of the local Siemens TIA Openness group — added in Computer Management — with the operating system restarted afterwards. Without it, automatic SCL import and automatic .so transfer fail. Manual p.37
One-time CPU step
Create a local user and role in the project's Security settings with runtime rights read files and write/delete files, and tick Activate web server on this module. The .so upload — manual or automatic — goes through the web server, into /ODK1500S, and write access is mandatory.
Licensing
A licence key transfers through the Automation License Manager. Without one you get a one-time 21-day trial, offered at your first build; the clock starts at activation, and an expired trial fails the build (error 1000 "License key missing", error 1001 if ALM cannot be reached). A V6.0 licence key also runs older Target versions without restriction. Manual p.21–22
Installing
Install older Target versions before newer ones, with all MATLAB instances closed and administrator rights. SilentInstall_Target_1500S.bat / SilentUnInstall_Target_1500S.bat do it unattended, into %ProgramFiles(x86)%\Siemens\Automation\Target1500S\<version>. ODK may be installed after Target — restart MATLAB afterwards. Selecting the TLC runs a file-integrity check against SecurityCatalog.cat; trigger it by hand with lib_V6_0.opts.verifySecurityCatalog, which returns 1 on success. Manual p.18–20
The envelope you are building into
Every generated block carries a comment header stating the build settings and the ODK runtime limits it was compiled against. Worth reading before blaming the model when External Mode stalls or a build fails on memory.
When the build talks back
The manual numbers information, warning and error messages independently — warning 1000 and error 1000 both exist, so the type chip is what tells them apart, not the number. Manual p.129–139