Resolving TIA Administrator ASUFatalException on Update Search

The TIA Administrator "Search for Update" function is the recommended mechanism for retrieving software updates, service packs, and HSP (Hardware Support Package) metadata from the Siemens update server. On certain TIA Portal installations, the function fails after several minutes with the unhandled exception Siemens.Automation.Common.Exception.ASUFatalException, which terminates the updater process without returning a descriptive error code. This article documents the affected configurations, isolates the root cause, and provides a verified remediation sequence.

1. Problem Description

When an operator selects Search for Update in the TIA Administrator tool window, the updater contacts the Siemens Automation Software Update server, authenticates the installed license pool, and downloads catalog metadata. Under fault conditions, the call returns an unhandled .NET exception rather than a dialog:

1. The TIA Administrator GUI freezes for between 30 seconds and several minutes while the background worker attempts the update query.
2. An unhandled exception dialog is raised containing the text Siemens.Automation.Common.Exception.ASUFatalException.
3. The TIA Administrator process terminates; no log file with an explicit HTTP or TLS error code is produced by default.
4. Subsequent retries (even after rebooting the host) reproduce the same fault until the underlying condition is cleared.

The exception name indicates a fatal failure inside the ASU (Automation Software Update) assembly that ships with TIA Portal. The condition is not always client-side: intermittent failures have been traced to transient unavailability of the Siemens update portal itself.

2. Affected Environments

3. Root Cause Analysis

The ASUFatalException is a generic wrapper raised by the Siemens automation common library when one of the following underlying conditions occurs during the update transaction:

• TLS negotiation failure with the Siemens update server (most common). The updater defaults to TLS 1.2; legacy hosts or restricted proxy environments may force a downgrade or block the handshake.
• SSL 3.0-only configuration. Disabling TLS 1.2 and forcing the client to use SSL 3.0 causes the server to reject the connection, surfacing as a fatal exception rather than a recoverable network error.
• Windows Firewall or endpoint protection silently drops the outbound HTTPS request on TCP/443 to *.automation.siemens.com.
• Proxy authentication failure when the host sits behind a corporate proxy that requires NTLM or Kerberos credentials not cached for the TIA Administrator process.
• Server-side outage of the Siemens update portal. The portal has historically suffered transient outages that present to the client as the same unhandled exception.
• Corrupt local ASU cache in %ProgramData%\Siemens\Automation\ASU from interrupted prior updates.

Because the exception is non-recoverable inside the updater, a retry after a short interval is the only way to discriminate between a true client configuration problem and a server-side outage. The remainder of this article documents the order of elimination that should be performed before opening a Siemens support ticket.

4. Pre-Diagnostic Checklist

Before changing registry or firewall settings, capture the following data points so that any subsequent Siemens support case contains reproducible evidence:

1. Confirm the TIA Portal and TIA Administrator versions from Help > About in both tools.
2. Confirm the Windows build with winver and the .NET Framework version from the registry key HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release (expected values: 461808 for 4.7.2, 528040 for 4.8).
3. Test direct HTTPS connectivity to the Siemens update portal from the affected host: curl -v --tlsv1.2 https://www.siemens.com/automation/ or via PowerShell: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri "https://www.siemens.com" -UseBasicParsing.
4. Review Windows Event Viewer under Applications and Services Logs > Siemens for any logged sub-exceptions.
5. Capture the contents of %ProgramData%\Siemens\Automation\ASU\Logs immediately after a failed search; these logs are rotated on each run.

5. Resolution: Step-by-Step Procedure

5.1 Confirm TLS 1.2 Is Enabled

The TIA Administrator V2 and V3 updater requires TLS 1.2. On Windows 10 21H2 and later, TLS 1.2 is enabled by default. On older or hardened images verify the registry values below and add the missing entries if necessary.

Client (outbound) — enable TLS 1.2:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"Enabled"=dword:00000001
"DisabledByDefault"=dword:00000000

.NET Framework strong cryptography — required for all .NET 4.x apps:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001

5.2 Re-enable Windows Firewall Exception for TIA Administrator

Disabling the Windows Firewall is not a permanent fix. Add a rule that allows the TIA Administrator process outbound on TCP/443:

1. Open Windows Defender Firewall with Advanced Security (wf.msc).
2. Select Outbound Rules > New Rule.
3. Rule type: Program. Browse to %ProgramFiles%\Siemens\Automation\TIA Administrator V2\TIAGui.exe (V2) or the corresponding V3 path under TIA Administrator V3.
4. Action: Allow the connection.
5. Profile: Domain, Private, Public (per corporate policy).
6. Name: Siemens TIA Administrator — Outbound HTTPS.

If a corporate proxy is in use, ensure the TIA Administrator process is exempted from proxy authentication or that the proxy allow-list includes the Siemens update hosts.

5.3 Clear the Local ASU Cache

Interruption of a prior update can leave a partial manifest in the local ASU cache, which subsequently triggers ASUFatalException on the next search. Clear the cache and restart the service:

1. Close all TIA Portal and TIA Administrator instances.
2. Stop the Siemens Update Service: net stop "Siemens.Automation.UpdateService" from an elevated command prompt.
3. Delete the contents of %ProgramData%\Siemens\Automation\ASU (do not delete the folder itself).
4. Start the service: net start "Siemens.Automation.UpdateService".
5. Launch TIA Administrator and retry Search for Update.

5.4 Reinstall TIA Administrator

If the above steps do not resolve the fault, reinstall the administrator tool. Use the matching installer for the TIA Portal version present on the host (for example 114358_TIAADMIN_V10_SP8.exe for V15.1 deployments). The standard sequence is:

1. From Control Panel > Programs and Features, uninstall "Siemens TIA Administrator".
2. Delete the residual folders:
   • %ProgramFiles%\Siemens\Automation\TIA Administrator V2
   • %ProgramFiles%\Siemens\Automation\TIA Administrator V3 (if present)
   • %ProgramData%\Siemens\Automation\ASU
3. Reboot the host to clear any locked files.
4. Run the original installer as Administrator and follow the dialog to completion.
5. Apply the latest service pack for the installed TIA Portal version.
6. Reboot and retry Search for Update.

5.5 Verify Server-Side Availability

Before opening a support ticket, confirm that the Siemens update portal is reachable from a different network segment or from a second host in the same site. The Siemens support portal status can be checked at support.industry.siemens.com. If the portal is genuinely down, the correct remediation is to wait and retry; do not change client configuration in this case, as the fault is not local.

6. Starting TIA Administrator After Remediation

Per the official TIA Portal documentation, TIA Administrator can be started locally once the prerequisites above are met:

1. From the Windows Start menu, navigate to Siemens Automation > TIA Administrator V2 (or V3, depending on installation).
2. Right-click the entry and choose Run as administrator if the host uses UAC and the administrator role is required to modify the ASU cache or installed software list.
3. Confirm that the GUI loads the installed software table within 5 to 10 seconds. If the GUI shows "This site can't be reached" or "localhost refused to connect", the underlying web service has not started — see Why can't you start TIA Administrator V3.0? (Siemens support entry 109976735).

Refer to Starting the TIA Administrator locally in the official TIA Portal V20 documentation for the canonical procedure.

7. Common Pitfalls and Field-Proven Caveats

• Reinstalling the TIA Administrator only: A standalone reinstall of 114358_TIAADMIN_V10_SP8.exe does not clear the ASU cache nor reapply .NET strong-crypto settings. Both must be addressed for a durable fix.
• Forcing SSL 3.0: SSL 3.0 is no longer accepted by the Siemens update portal. The portal requires TLS 1.2 with strong cipher suites (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 or higher).
• Disabling Windows Firewall entirely: Disabling the firewall masks the symptom temporarily but does not address the underlying protocol mismatch. Restore the firewall after adding the targeted outbound rule.
• Proxy bypass required: Hosts behind a corporate proxy that does not whitelist *.siemens.com will exhibit the same exception. Configure the proxy exception list for the TIA Administrator process or for the system account.
• Time skew: A system clock more than 5 minutes from real time can cause TLS handshake failures that surface as the same fatal exception. Synchronize the host clock via NTP before deeper investigation.

8. Verification Steps

Once the remediation sequence is complete, run the following verification checks:

1. Launch TIA Administrator. The software inventory should load without an unhandled exception dialog.
2. Click Search for Update. The progress indicator should advance and complete within 2 to 5 minutes on a typical broadband connection.
3. Confirm the result list shows at least the latest service pack and any available HSPs for the installed TIA Portal version.
4. Optionally install one update to confirm that the download and apply phases function, not just the search phase.
5. Re-check the ASU log directory to confirm no further ASUFatalException entries are appended.

9. Troubleshooting Matrix

10. Escalation Path

If the verification steps still produce ASUFatalException, escalate to Siemens Technical Support with the following package:

• Screenshots of the unhandled exception dialog and the TIA Administrator About window.
• Contents of %ProgramData%\Siemens\Automation\ASU\Logs.
• Output of winver, the .NET Framework release DWORD, and the SCHANNEL registry subkeys.
• Network trace (Wireshark or netsh trace start capture=yes) filtered on TCP/443 during a failed search.
• Confirmation of whether the failure reproduces on a second host in the same network segment.

Reference the Siemens support article 109976735 when opening the case to ensure the case is routed to the correct product specialist team.

11. Summary

The Siemens.Automation.Common.Exception.ASUFatalException raised by TIA Administrator during a Search for Update operation is most often caused by a TLS configuration mismatch, an SSL 3.0-only policy, or a transient outage of the Siemens update portal. The remediation sequence — enable TLS 1.2, remove SSL 3.0-only constraints, add a Windows Firewall exception for the TIA Administrator process, and clear the local ASU cache — resolves the fault in the majority of cases reported against TIA Portal V15.1, V18, and V20. Reinstallation of the TIA Administrator alone is insufficient and should always be paired with a cache clear and a SCHANNEL/.NET strong-crypto review.

FAQ