Resolving S7-1200 G2 Web Application Manager Deployment Crashes

Problem Overview

The SIMATIC S7-1200 G2 Web Application Manager (WAM) terminates without warning immediately after the operator clicks Start Deployment when pushing a user-defined web page to the CPU. Unlike a managed exception, the process exits silently: no Siemens Automation License Manager dialog, no TIA Portal error pop-up, and no entry in the Windows Event Viewer tied to the WAM module. The CPU's web server and the TIA Portal project configuration are usually intact, indicating the failure lies inside the deployment handoff between the engineering station and the PLC web server rather than inside the user program.

This symptom is distinctive to the S7-1200 G2 generation (CPU 1212 G2, 1214 G2, 1215 G2, 1217 G2 DC/DC/DC and DC/DC/Rly variants) running TIA Portal V18 or later with the Web Application Manager add-in. First-generation S7-1200 CPUs (6ES721x-1AD30-0XB0 and earlier) do not use the WAM toolchain and instead rely on the legacy "User-defined web pages" generator embedded in the CPU properties, which deploys a static HTML/JS bundle through the standard TIA Portal download dialog. The WAM toolchain was introduced specifically for the G2 platform to support dynamic SPAs, WebSocket endpoints, and authenticated REST interaction with the CPU's built-in web API.

Three primary fault clusters produce the silent-exit behavior:

1. Certificate trust chain mismatch between the TIA Portal installation and the CPU's TLS material.
2. Project metadata corruption in the WAM workspace directory (typically under %LOCALAPPDATA%\Siemens\Automation\WebApplicationManager).
3. Web server configuration on the CPU that is consistent with HTTP operation but inconsistent with the WAM HTTPS-only deployment handshake.

Affected Hardware, Firmware, and Engineering Software

Root Cause Analysis

The WAM initiates a deployment by performing a TLS handshake against the CPU's web server on port 443 (HTTPS only — HTTP on port 80 is rejected by the WAM client regardless of CPU configuration). The handshake requires that the engineering station trust the X.509 certificate presented by the CPU. The CPU firmware ships with a self-signed Siemens Global certificate. The WAM must be told which CPU certificate to expect, and the engineering station's Windows certificate store must contain the same certificate in the Trusted Root Certification Authorities or Trusted People folder. When the chain fails to validate, the WAM does not produce a graphical error — it terminates the process and writes a non-blocking trace to %LOCALAPPDATA%\Siemens\Automation\WebApplicationManager\logs\wam-deploy.log. The crash is therefore observable only by reading the log file before the folder is reused by a subsequent deployment attempt.

Secondary root causes that produce identical silent-exit behavior:

• Corrupted WAM workspace: The WAM stores per-project manifest files keyed to the TIA project GUID. If the project is re-saved with a new GUID (e.g., "Save as") without deleting the matching WAM folder, the WAM attempts to deploy against stale manifest entries and aborts without prompt.
• Out-of-process CRL check timeout: The WAM queries the Microsoft Certificate Revocation List endpoint for the CPU certificate. On networks with strict egress controls or no internet access, the CRL call hangs for the WinHTTP default 60-second timeout, after which the WAM terminates the deployment session to avoid leaving a partial bundle on the CPU.
• Multi-monitor DPI mismatch: The WAM main window stores its last position in wam-settings.json. When launched on a secondary monitor with a different DPI scaling than the primary, dialogs render at coordinates outside the visible desktop area. While this does not crash the deployment itself, it is the source of the frequently reported "sub-windows hidden behind the primary monitor" behavior that often masquerades as a crash.
• Local administrator UAC token conflict: The WAM needs to bind the local TCP port 8443 to host its proxy preview server. If the user runs TIA Portal under an elevated token but the WAM is launched as a non-elevated child, the bind fails and the process exits.

Pre-Deployment Verification

1. Open TIA Portal and load the project containing the S7-1200 G2 station.
2. Confirm the device view shows the CPU as an S7-1200 G2 variant. Right-click the device and select Properties > General > Identification & Maintenance; the article number field must begin with 6ES721x-1AF4x.
3. Confirm the CPU firmware is V20.0 or later by selecting Online & diagnostics > Diagnostics > Online information and reading the firmware version from the device.
4. Open Project tree > Web Application Manager and verify that the add-in node is present. If the node is missing, install the Web Application Manager add-in via Siemens Industry Online Support using the TIA Administration Tool.
5. Verify TIA Portal version by selecting Help > About in the main menu. Record the exact TIA build (e.g., V19.0 Update 1, Build 19.0.1.12).
6. Confirm that the Windows user account launching the WAM is a member of the local Siemens TIA Openness group, has read/write access to %LOCALAPPDATA%\Siemens\Automation\WebApplicationManager, and can bind to TCP port 8443.

Certificate Configuration

Certificate misconfiguration is the leading cause of WAM deployment crashes. The S7-1200 G2 firmware ships with a Siemens-signed Global certificate under the subject CN=Siemens SIMATIC S7-1200 G2, O=Siemens AG. The WAM client uses Windows certificate stores — not the Java or OpenSSL stores — to evaluate trust. Three steps are required to establish a valid trust chain.

Step 1 — Export the CPU certificate

1. In TIA Portal, right-click the S7-1200 G2 CPU and select Properties > Web server > Security.
2. Click Export certificate. Save the certificate as a Base-64 encoded X.509 (.cer) file to a local directory such as C:\Siemens\Certs\s71200g2.cer.
3. Verify the export by double-clicking the file. The Issued To field must show the CPU's serial number, not "localhost" or a generic Common Name.

Step 2 — Install the certificate in the Windows store

1. Right-click the exported .cer file and select Install Certificate.
2. Choose Local Machine and confirm the UAC prompt. This step is mandatory — installing to Current User does not propagate trust to services or other Windows sessions.
3. Select Place all certificates in the following store, browse to Trusted Root Certification Authorities, and complete the wizard.
4. Restart the TIA Portal process to refresh the certificate store cache. The WAM child process inherits the cache from the parent TIA Portal process and will not see a certificate added after the parent is already running.

Step 3 — Configure CRL behavior

1. Open certlm.msc (Certificate Manager for Local Machine).
2. Locate the Siemens SIMATIC S7-1200 G2 certificate in Trusted Root Certification Authorities > Certificates.
3. Double-click the certificate, select the Details tab, and click Edit Properties next to Certificate Revocation List in the CRL Distribution Points section.
4. Disable CRL retrieval or configure a local CRL cache. The WAM honors the same WinHTTP defaults used by Internet Explorer and Microsoft Edge; if the network blocks outbound HTTP to the Siemens CRL endpoint, the WAM will time out and terminate the deployment.

Web Server Activation on the CPU

1. Open the device view of the S7-1200 G2 CPU in TIA Portal.
2. Select Properties > Web server > General and tick Enable web server on this module.
3. Select Properties > Web server > Security and tick Permit access only with HTTPS. Plain HTTP must remain disabled for WAM deployments; mixing the two causes the WAM to attempt the TLS handshake and fall back to cleartext, which the G2 firmware rejects by default.
4. Select Properties > Web server > User administration and add at least one user. The WAM requires a user with the Web application access permission level. The WAM does not surface a credential prompt during deployment — it expects the user to be assigned by name in the project, and the WAM retrieves the password from the protected TIA project file. If the TIA project is not protected with a project password, the WAM cannot read the credentials and the deployment terminates.
5. Compile the project (Ctrl+B) and download the hardware configuration to the CPU. The Web server is active only after a successful download with the new security settings.

Web Application Manager Deployment Procedure

1. Open the project, right-click Web Application Manager in the project tree, and select Open Web Application Manager.
2. In the WAM, click Add application and select the application's build output directory. The directory must contain an index.html, a manifest.json, and a webapp.config.json describing the REST endpoints and authentication realm.
3. Click Add PLC and select the S7-1200 G2 CPU from the project navigation.
4. Move both items into the Selected items column.
5. Click Start Deployment. The first deployment attempt should produce the WAM progress dialog. If the dialog does not appear, immediately inspect the log file at %LOCALAPPDATA%\Siemens\Automation\WebApplicationManager\logs\wam-deploy.log.

Resolving Common Crashes

Resetting the WAM workspace

1. Close TIA Portal completely.
2. Delete %LOCALAPPDATA%\Siemens\Automation\WebApplicationManager in its entirety. This folder is rebuilt on the next WAM launch.
3. Delete %APPDATA%\Siemens\Automation\WebApplicationManager.json if present.
4. Reopen the TIA project and reopen the WAM. The application list will be empty and must be re-added, but the WAM will operate against a clean manifest cache.

Confirming token elevation

1. Open Task Manager and locate TiaPortal.exe.
2. The UAC Virtualization column should read Not allowed for the elevated TIA Portal process.
3. The child WebApplicationManagerHost.exe should appear with the same session ID and the same elevated token. If the child shows a different elevation state, terminate the WAM host, right-click the TIA Portal shortcut, and select Run as administrator.

Alternative Deployment Methods

Engineers who require deterministic deployment or who operate in air-gapped networks can bypass the WAM entirely. The S7-1200 G2 web server stores user-defined web pages in a dedicated partition accessible via the S7 file system API. The deployment target is /home/web/<application-name>/ on the CPU's internal web partition.

Method A — TIA Portal "Download to memory card" path

1. Build the application and copy the bundle to a SIMATIC Memory Card (SMC) formatted as FAT32.
2. Insert the SMC into the S7-1200 G2 CPU. The CPU reads the user-defined web pages from the card at the next restart and copies the bundle to internal flash.
3. This method requires a physical restart of the CPU and is suitable for commissioning rather than iterative development.

Method B — Web API direct push (advanced)

1. Construct a multipart form-data POST request to https://<cpu-ip>/api/webapp using the CPU's HTTPS port.
2. Authenticate using HTTP Basic with the web application user created in TIA Portal.
3. Submit the manifest.json, index.html, and supporting assets in a single multipart payload.
4. The CPU responds with HTTP 201 on success. A failed POST returns HTTP 403 if the user lacks Web application access or HTTP 409 if the manifest version conflicts.

Direct API push is the recommended fallback when the WAM is unstable, but it requires that the application developer self-validate the manifest schema. The WAM normally enforces schema versioning, content security policy, and authentication realm configuration on behalf of the developer; bypassing the toolchain means assuming responsibility for these checks.

Verification and Testing

1. After a successful deployment, navigate to https://<cpu-ip>/webapp/<application-name>/ in a browser.
2. Confirm that the browser displays the expected user-defined web page. A certificate warning indicates that the engineering station certificate store still does not trust the CPU — repeat the certificate procedure.
3. Open the browser's developer tools, select the Network tab, and reload the page. Verify that the WebSocket connection to wss://<cpu-ip>/api/websocket returns HTTP 101 Switching Protocols.
4. Read the CPU diagnostic buffer using TIA Portal's Online & diagnostics > Diagnostics > Diagnostics buffer. A successful deployment appends an event with ID 0x4302 "Web application loaded". A failed deployment appends 0x4303 with the cause in plain text.
5. Restart the CPU and confirm the user-defined web page is still served. Bundles deployed via the WAM survive power-cycle, while bundles deployed via direct API are held in volatile memory unless explicitly committed.

Long-Term Recommendations

The S7-1200 G2 platform has received multiple firmware revisions since launch. The WAM toolchain has matured across TIA Portal V18, V19, and the current V20 release. Operators experiencing persistent crashes should:

• Update the CPU firmware to the latest available revision using the Siemens Industry Online Support firmware update tool.
• Update TIA Portal to the latest service pack matching the firmware version. Siemens couples WAM features to specific TIA versions — refer to the S7-1200 manual collection for the compatibility matrix.
• Standardize the engineering workstation configuration by deploying the certificate via Group Policy and disabling CRL retrieval across the engineering fleet.
• Maintain a project naming convention that includes the TIA version, so that stale WAM workspaces can be identified and cleaned before the next deployment attempt.