Resolving S7-1200 Discovery Failure in TIA Portal V16 on Windows

Problem Definition

Symptom profile reported in the field on a Siemens SIMATIC S7-1200 CPU 1215C DC/DC/DC (article number 6ES7215-1AG40-0XB0), factory-fresh, no project loaded, no PROFINET IP address assigned:

• Engineering station: Windows 10 64-bit, TIA Portal V16 (no service pack applied).
• Procedure: Online > Accessible nodes returns No accessible devices found in selected network.
• Procedure: project tree right-click Download to device > Search/Start search returns the same error and aborts the download wizard before any PROFINET DCP identification completes.
• Network: direct Ethernet from the engineering PG/PC to the CPU 1215C PROFINET port (X1). The same PG/PC can ping any device that has an IP. The same PG/PC works correctly with non-Siemens Ethernet devices on the same subnet.
• A second laptop (different OS image, identical TIA Portal V16 install) finds the CPU and successfully assigns an IP through the same wizard. After IP assignment, the original engineering station can also download to the PLC.
• External USB-to-Ethernet adapters exhibit the same failure, so this is not a single-NIC driver defect.

The pattern is diagnostic: the CPU responds to DCP only when queried by certain Windows 10 + TIA Portal V16 stacks, and silently drops the PROFINET DCP identify-all broadcast on others. The S7-1200 hardware, cabling, and the program logic are not at fault.

Root Cause Analysis

PROFINET device discovery in TIA Portal V16 is implemented on top of the DCP (Discovery and Configuration Protocol, IEC 61784-2) and uses the Windows socket layer to send a multicast FF:FF:FF:FF:FF:FF Ethernet broadcast to UDP port 0x8892 (34962 decimal) with the DCP identifier identify-all. The S7-1200 CPU 1215C always responds to this multicast by default, regardless of whether it has an IP address. Any failure to enumerate therefore originates on the PG/PC side, not on the PLC.

The four root-cause families that produce the exact symptom in the source report are, in order of frequency:

1. Windows 10 servicing-branch mismatch with TIA Portal V16. TIA Portal V16 was released against Windows 10 SAC 1909 and 2004 builds. After Microsoft retires a servicing branch, TIA V16 may install but the WinPcap / Npcap / SiemensProfinetDcp service stack fails to bind the raw socket used for DCP multicast. Result: Accessible nodes scans locally and returns no devices even though arp -a shows the PLC MAC.
2. Windows Defender Firewall with the wrong profile active. The TIA Portal installation adds firewall rules only for the network profile that was active at install time. If the user later changes the active network from Private to Public (the default when Windows 10 detects a new direct Ethernet peer), the previously created inbound rules for S7DOS, SiemensProfinetDcp, SIMATIC IE DCP and TCP 102 are silently disabled, and the DCP UDP socket is filtered.
3. Hyper-V / WSL / vSwitch / VPN virtual adapters consuming the bind order. TIA Portal V16 binds DCP to the first non-virtual interface returned by GetAdaptersAddresses. If a Hyper-V Default Switch, WSL2 vEthernet, or a TAP-Win32 adapter ranks above the physical Intel / Realtek NIC, the DCP broadcast is sent on a virtual segment that has no route to the S7-1200.
4. Missing or mismatched PROFINET IO driver components inside TIA V16. After a TIA Portal V16 install on a clean Windows 10 image, the PROFINET DCP service is not always registered if the user selects a minimum install. A repair install of TIA Portal or the targeted installation of the SIMATIC TIA Portal STEP 7 V16 PROFINET Driver Package re-creates the SiemensProfinetDcp service.

The field report's hint that the issue began only after the OS upgrade from Windows 7 to Windows 10 is consistent with cause (1) and (2). Windows 7 had no Network Location profiles, so the user could not have hit cause (2) before the migration. Cause (1) is further supported by the fact that a second laptop with the same TIA V16 install finds the device — that laptop is on a Windows 10 build TIA V16 still supports.

Confirming the Failure Mode

Before changing TIA or OS settings, run three diagnostic checks from an elevated command prompt on the engineering PC. All three should be false positive in a healthy installation.

Check 1 — Verify the PLC replies to PROFINET DCP

From cmd.exe:

With the PLC powered and the Ethernet cable connected, you should see the S7-1200 MAC address in the interface's ARP cache within 30 seconds, even with no IP assigned. If no MAC appears, the failure is L1/L2 (cable, switch port, CPU PROFINET LED, or the CPU is in STOP with PROFINET disabled). If the MAC appears but TIA Portal cannot see it, continue.

Check 2 — Verify the DCP socket is bound on the correct interface

Healthy state: no listener visible because the Siemens PROFINET DCP driver uses raw sockets, not UDP listeners. But netstat -an -p IP must show no error counters on the Ethernet adapter used. If netstat -s shows a non-zero Received Errors counter, the issue is NIC driver related.

Check 3 — Verify the PROFINET DCP service is running

Healthy state: STATE: 4 RUNNING. If the service is missing or stopped, the DCP multicast is never generated, and Accessible nodes will always return empty.

Solution A — Verify TIA Portal V16 / Windows 10 Compatibility

The supported Windows 10 builds for TIA Portal V16 are restricted. Open Settings > System > About and confirm the OS build. As of V16 Update 7, the supported set is:

The official list is maintained in the entry "Which operating systems are supported by the TIA Portal?" in the Siemens Industry Online Support (SIOS) knowledge base. If the engineering station is on an unsupported build, either downgrade the Windows 10 servicing branch (re-image to 21H2 is the most reliable choice for TIA V16) or upgrade TIA to a version that supports the current build.

Solution B — Configure the Network Location and Firewall

When the engineering PC is connected directly to a brand-new S7-1200, Windows 10 treats the new peer as an unknown network and assigns the Public profile, which blocks inbound responses to DCP. Fix the profile, then allow the TIA Portal rules.

1. Open Settings > Network & Internet > Ethernet. Click the connected adapter. Set Network profile type to Private.
2. Open Windows Defender Firewall with Advanced Security. Confirm the active profile is Private Profile.
3. Verify the following inbound rules are enabled for the Private profile:
   • SIMATIC TIA Portal V16 - UDP 8892 (PROFINET DCP)
   • SIMATIC TIA Portal V16 - TCP 102 (S7DOS / ISO-on-TCP)
   • SiemensProfinetDcp
4. If the rules are missing, repair the TIA Portal installation or re-run the TIA Portal setup as administrator. The setup registers the rules under the profile active at install time.

Solution C — Bind TIA Portal DCP to the Physical Interface

When the engineering PC has multiple network adapters (Hyper-V, WSL, VPN, VirtualBox host-only, USB-Ethernet, etc.), TIA Portal V16 will select the first adapter in the Windows bind order. Force the physical interface.

1. Press Win+R, type ncpa.cpl, press Enter.
2. Press Alt to expose the menu, choose Advanced > Advanced Settings.
3. In Adapters and Bindings > Connections, move the physical Ethernet adapter to the top of the list. Move Hyper-V / WSL / VPN / VirtualBox virtual adapters below it.
4. Restart the SiemensProfinetDcp service from Services or with net stop SiemensProfinetDcp & net start SiemensProfinetDcp.

If only a USB-Ethernet adapter is in use, disable every other adapter except the one connected to the S7-1200. The source report notes that an external USB-to-Ethernet dongle produced the same failure; that is consistent with the DCP driver binding to a still-enabled Wi-Fi or virtual adapter on the same machine.

Solution D — Use the Primary Setup Tool (PST) for First-Contact IP Assignment

The Primary Setup Tool is the legacy Siemens utility for assigning IP addresses to PROFINET devices before a TIA Portal project exists. The source report explicitly uses PST on a second laptop — adopt that approach as the primary first-contact tool, then load the project.

1. Download Primary Setup Tool (PST) from SIOS entry "Primary Setup Tool (PST) for PROFINET devices". (The PST is no longer shipped with TIA Portal V16 and must be installed standalone on Windows 10.)
2. Launch PST. Click Network > Browse to enumerate the network segment. The S7-1200 CPU 1215C should appear with its MAC address even with no IP assigned.
3. Right-click the CPU > Assign IP address. Enter an IP in the same subnet as the engineering PC (e.g., PC 192.168.0.10/24, PLC 192.168.0.1/24).
4. Click Assign. The CPU restarts its PROFINET stack and accepts the IP.
5. Return to TIA Portal V16 > Online > Accessible nodes. The CPU is now visible at the assigned IP.
6. Proceed with the normal Download to device workflow.

Solution E — Assign IP Directly Inside TIA Portal Accessible Nodes

If Accessible nodes is the only menu that returns no devices, the alternative path inside TIA is to assign the IP from the project tree, which uses a different DCP code path than the project-tree search.

1. In the TIA Portal project tree, expand Devices & networks.
2. Select the CPU 1215C device, then open Device view > Properties > PROFINET interface > Ethernet addresses.
3. Click Add new subnet if no subnet exists, then enter the desired IP and subnet mask. Click Assign IP address via the router if applicable.
4. Right-click the CPU in the project tree > Download to device > Extended download to the device.
5. In the wizard, target the PROFINET interface, select Search. The wizard sends a unicast PROFINET DCP identify to the MAC address known by the project. This often succeeds where the broadcast identify-all fails.

The DCP identify unicast is documented in the S7-1200 System Manual section Commissioning > Assigning an IP address to the PROFINET interface (SIOS entry 109759862).

Solution F — RESET the S7-1200 to Factory Defaults

If a corrupted PROFINET configuration is preventing the CPU from responding to DCP, perform a factory reset using the SIMATIC Memory Card or the mode selector.

1. Power off the CPU.
2. Insert a blank SIMATIC Memory Card (SMC) into the CPU.
3. Hold the STOP/MRES button while powering on.
4. Wait for the LED pattern indicating factory reset requested, then release and press MRES again within 3 seconds to confirm.
5. The CPU restarts with IP 0.0.0.0 and PROFINET name not-set. The DCP identify-all multicast will now be honored.

Factory reset details are in the S7-1200 System Manual, section Operations list of CPU 1215C > Reset to factory settings.

Verification Procedure

Run the following sequence on the engineering PC to confirm that the failure is resolved.

1. Open TIA Portal V16. Open the project. Confirm the engineering PC IP is on the same subnet as the CPU 1215C (e.g., 192.168.0.10/24 vs. 192.168.0.1/24).
2. Open Online > Accessible nodes. The CPU 1215C must appear at its IP (or as the MAC if no IP is set) within 10 seconds.
3. Right-click the device > Online and diagnostics. The PROFINET diagnostics page must show Station status: OK and the CPU's MAC and order number 6ES7215-1AG40-0XB0.
4. Right-click the device in the project tree > Download to device > Hardware and software (only changes). The download must complete with Compilation finished, Download finished.
5. Open the online view of the PLC tags. Tag CPU_1215C.System_Diag must report RUN and no diagnostic interrupts.

Preventive Hardening for Engineering Laptops

Troubleshooting Matrix

Notes on Related Controllers

S7-1500 / ET 200SP / ET 200MP CPUs implement the same PROFINET DCP discovery semantics as S7-1200 G1, so the same diagnosis applies. S7-1200 G2 (firmware V5.x) ships with PROFINET Security Class 1 enabled by default, which means the DCP identify-all broadcast is rate-limited. Field engineers should expect a 5-15 second delay before the G2 CPU appears in Accessible nodes. The S7-1500 system manual entry SIMATIC S7-1500 Automation System System Manual documents the same behavior.