Resolving TIA Portal V16 TSEND_C Connection Data Crash on S7-1500

Problem Details

Engineers configuring Open User Communication on SIMATIC S7-1513-PN CPUs in TIA Portal V16 report a deterministic IDE crash when assigning a new connection to a TSEND_C block. The failure is reproducible on a single CPU inside a multi-PLC project while other CPUs in the same project (for example, S7-1215) configure the same block without error.

Symptom signature

• Inserting a TSEND_C block (FB/instance) in the affected S7-1513-PN program.
• Setting Partner = unspecified.
• Setting Connection type = TCP and Configuration Mode = Use program blocks.
• Clicking the Connection data drop-down and selecting <new>.
• TIA Portal terminates unexpectedly. No error dialog, no save prompt; the Siemens.Automation.Portal.exe process exits.

Scope

• UDP connections, ISO-on-TCP, and protocol-specific configuration modes do not trigger the crash.
• The same project, copied to a new TIA Portal project, still produces the crash when configured against the affected S7-1513-PN.
• TSEND_C blocks on S7-1215 stations in the same project configure cleanly, isolating the failure to a single CPU object's project metadata.

Root Cause Analysis

The crash is not a code defect inside TSEND_C itself. TSEND_C is the standard Open User Communication block on the S7-1200/1500 platform that sets up, monitors, and tears down a TCP or ISO-on-TCP connection (see TSEND_C and TRCV_C - Send and Receive Data Using Ethernet in the TIA Portal manual collection, and the application document Open User Communication with TSEND_C and TRCV_C). The instruction works correctly at runtime; the failure occurs inside the TIA Portal editor while it tries to instantiate a new connection descriptor bound to the CPU.

Most likely causes (in order of frequency observed in the field):

1. Project database inconsistency – the per-CPU XML/IM cache used by the editor diverges from the program blocks container. The crash path is triggered only on the S7-1500 because the connection-descriptor wizard enumerates ISO transport resources differently for S7-1500 PROFINET interfaces.
2. Sub-version mismatch – TIA Portal V16 was released with several update levels (V16, V16 Update 1 through V16 Update 9). The connection-assignment wizard was patched in later updates.
3. Residual references after deep copy – when an S7-1500 station is cloned and its variable names are renamed, internal cross-references between the connection configuration and the renamed symbols can leave dangling pointers that the wizard dereferences during <new> expansion.
4. IM folder divergence – Siemens' own FAQ on TIA project repair explicitly calls out the IM folder as a corruption vector that produces exactly this class of editor crash when configuring communication blocks.

Identifying the Affected Configuration

Before applying any fix, confirm that the failure matches the documented signature exactly. Use the matrix below to triage the symptom.

If your symptom does not match the first row exactly, the remedies below may not apply. Verify the connection type and the configuration mode before proceeding.

Prerequisites for Recovery

• Administrative rights on the engineering station (required to write the project cache and the TIA Portal installation directory).
• Current TIA Portal V16 installation media or access to the Siemens Industry Online Support update channel.
• A full .zap16 archive of the affected project before any modification.
• Access to the TIA Portal support request portal in case the local remedies fail.

Solution 1: Update TIA Portal to the Latest V16 Patch

Siemens ships a cumulative update train for V16. The connection-wizard regression that triggers the crash on TCP/Use program blocks with S7-1500 CPUs is fixed in later V16 updates.

1. Open Help > Installed software and record the current TIA Portal version (for example, V16.0 + Update 2).
2. Open the Siemens Support page Updates for STEP 7 / WinCC / S7-PLCSIM in the TIA Portal and download the highest available V16 update that matches your installed base.
3. Close TIA Portal, including the TIA Portal Server and any open TIA instances.
4. Run the update package as administrator. Do not run a parallel installation.
5. Reboot the engineering station.
6. Reopen the project and repeat the TSEND_C configuration. The <new> entry in the connection-data drop-down should now expand without terminating the IDE.

Solution 2: Delete the IM Folder of the TIA Project

The IM (Internal Model) folder caches the compiled view of the project. A divergence in this folder is the documented cause of editor crashes that are not reproducible on different stations. This is the same remedy Siemens recommends for general TIA project corruption symptoms.

1. Close TIA Portal completely.
2. Make a backup copy of the project folder (for example, copy Project_S7-1500.ap16 to Project_S7-1500_backup.ap16).
3. Rename the project from .ap16 to .zip and extract the archive with a standard ZIP tool.
4. Inside the extracted tree, navigate to IM (or SystemIM in newer TIA Portal versions).
5. Delete the entire IM folder.
6. Re-zip the contents back into a .ap16 archive, or keep the extracted folder and reopen TIA Portal on the directory form.
7. Open the project. TIA Portal rebuilds the IM folder on first compile.
8. Re-run Compile > Software (rebuild all) on the affected S7-1513-PN station.
9. Insert a TSEND_C block, choose TCP + Use program blocks, and click <new> in the connection-data drop-down.

Solution 3: Archive and Retrieve the Project

Archiving and retrieving forces the TIA Portal to rewrite the project file in a current schema. This has recovered projects in the field when Solution 2 alone does not clear the editor cache.

1. In TIA Portal, choose Project > Archive > Archive project. Select the .zap16 format and a known path.
2. Close TIA Portal.
3. Choose Project > Retrieve and select the freshly created archive. Specify a new project name and a new target directory.
4. Open the retrieved project and run Compile > Software (rebuild all).
5. Re-test the TSEND_C configuration on the S7-1513-PN.

Solution 4: Rebuild the S7-1500 Station in a New Project

When the IM cache is not the cause, the corruption is bound to the S7-1500 station object. Rebuilding the station in an empty project removes the object-level cache entirely.

1. Create a new TIA Portal V16 project.
2. Add a new S7-1513-PN with the same article number and firmware version as the original.
3. Add the S7-1215 stations used by the same machine.
4. Copy the program blocks (FCs, FBs, DBs) from the original project to the new project. Do not copy connection descriptors or the TSEND_C instance DB; recreate them.
5. Configure the PROFINET interface, IP addresses, and subnet exactly as on the original machine.
6. Re-create the TSEND_C instances from scratch: insert the block, set Partner = unspecified, Connection type = TCP, Configuration Mode = Use program blocks, and click <new> in the connection-data drop-down.
7. Verify the block compiles and downloads cleanly.

Solution 5: Use a Different Configuration Mode Temporarily

If the crash blocks commissioning and a hot fix is required, bypass the wizard by using a hand-written connection DB. The TSEND_C instruction accepts a connection ID resolved through the project connection table; you can populate that table by a different path.

1. Create a new TCON connection via Devices & Networks > Network view > Connections > New connection.
2. Configure the partner, IP, port, and connection type as TCP.
3. Reference the auto-generated connection ID directly in the TSEND_C block by setting Configuration Mode = Use configured connection data and selecting the newly created connection from the drop-down.
4. Switch back to Use program blocks only after the project is in a clean state.

Verification

After applying any of the solutions, perform the following verification sequence before downloading to the live S7-1513-PN:

1. Open the project, navigate to the affected S7-1513-PN, and insert a fresh TSEND_C instance.
2. Set Partner = unspecified, Connection type = TCP, Configuration Mode = Use program blocks.
3. Click the Connection data drop-down and select <new>. TIA Portal must open the connection dialog and assign a new connection ID without terminating.
4. Compile the project with Compile > Software (rebuild all). There must be no warnings referencing orphaned connection descriptors.
5. Download to the CPU and run a TCP loopback test against the partner. Confirm STATUS = 16#0000 (no error) on the rising edge of REQ.
6. Repeat the same sequence on a different S7-1500 station if available, to confirm the project is in a clean state.

Common Error Codes Returned by TSEND_C After Recovery

After the editor crash is fixed, runtime errors may still appear if the connection was not fully rebuilt. Use the table below as a quick reference.

Full STATUS semantics are documented in the TIA Portal help for the TSEND_C instruction and in the application document Open User Communication with TSEND_C and TRCV_C.

When to Escalate to Siemens Support

If all five solutions above fail to clear the crash, escalate through the official Siemens Industry Online Support Support Request channel. Before opening the request, gather:

• The exact TIA Portal V16 patch level (Help > Installed software).
• The article number and firmware version of the affected S7-1513-PN.
• The article numbers and firmware versions of the S7-1215 stations that do not exhibit the issue.
• The project archive (.zap16) of the failing configuration.
• A list of the remedies already attempted (Solutions 1 through 5).

Provide this package so that support can reproduce the failure against the same CPU and patch level without requiring an additional round-trip.

Prevention and Best Practice

• Always keep TIA Portal V16 at the latest available V16 update. The V16 release train is a stable branch; the latest update does not introduce new features and is therefore safe to install on active engineering stations.
• Avoid cloning entire S7-1500 stations and renaming variables in bulk. If cloning is required, recompile the cloned station from scratch with Compile > Software (rebuild all) before opening any communication-block configuration dialog.
• Periodically archive and retrieve the master project. This rewrites the project schema and clears transient editor cache inconsistencies before they trigger crashes.
• Track CPU firmware with the S7-1500 CPU firmware update utility and align it with the TIA Portal patch level to avoid cross-version edge cases.
• Document each TSEND_C instance with a unique connection ID, even though TIA Portal will assign one automatically. Unique IDs make runtime STATUS decoding faster.