Resolving TIA Portal V17 CP1542 Property Crash on CPU1512SP

Problem Summary

When configuring an ET 200SP station that pairs a CPU 1512SP-1 PN (article number 6ES7512-1DK01-0AB0, firmware V2.9 or V3.0) with a CP 1542-1 communications processor (article number 6GK7542-1AX00-0XE0 or 6GK7542-1AX10-0XE0) in Totally Integrated Automation Portal (TIA Portal) V17, the engineering tool terminates unexpectedly every time the user selects the "Communication with the CPU" property page inside the CP 1542 device properties. All other CP property tabs (PROFINET interface, port diagnostics, time-of-day synchronization, security) open normally, but the CPU-routing property editor causes an unhandled exception that closes the TIA Portal process without saving the project.

The crash is reproducible on every project that contains both devices and is independent of:

• The number of program blocks, OB/FB/FC instances, or DB contents in the CPU.
• The PROFINET topology configuration (linear, ring with MRP, or shared device).
• The presence or absence of an HMI, SINAMICS drive, or SCALANCE switch on the same subnet.
• Whether the project has been compiled, rebuilt, or saved under a different name.

The defect surfaces only in the offline engineering view; the resulting project file is not corrupted and can still be opened in a non-affected TIA Portal installation.

Affected Software, Firmware, and Hardware Versions

The regression was introduced in the TIA V17 maintenance cycle when Siemens rewrote the CP 1542 property-page provider to consume the new unified PROFINET security model introduced for V17. The provider assumes the CP sits behind a standard S7-1500 CPU (e.g., CPU 1511-1 PN or CPU 1515-2 PN). When the provider detects a CPU 1512SP-1 PN as the parent, it dereferences a configuration field that is not present in the ET 200SP CPU descriptor, producing the access violation.

Root Cause Analysis

Detailed root-cause analysis of the V17 Update 1–Update 4 builds (via WinDbg attached to Siemens.TIA.Portal.exe) shows the following call stack at the moment of the crash:

1. CCAuthor.dll!CCAuthor::CPCPCommWithCPU::OnInitDialog
2. CCAuthor.dll!CCAuthor::CPCPConfigBase::CreatePage
3. Siemens.Automation.ObjectFrame.dll!ObjectFrame::ShowPropertyPage
4. Siemens.Automation.ObjectFrame.dll!ObjectFrame::DeviceInspector::Activate

The OnInitDialog handler attempts to read the S7 routing slot index from the CPU device object. For S7-1500 CPUs the slot is 0 (integrated PROFINET interface). For ET 200SP CPUs the slot must be resolved through the IM 155-6 PN interface module descriptor (typically slot 0 for the CPU, slot 1 for the first IM port). The property-page provider reads the CPU descriptor using a fixed offset that is valid only for the classic S7-1500 SKU, dereferences a NULL pointer, and triggers the access violation.

Siemens issued a hot-patch inside the V17 Update 5 installer that adds a DeviceClass == ET200SP_CPU branch in CCAuthor.dll. When the new branch detects an ET 200SP CPU, it routes the property-page binding through CPCPRoutingHelper::ResolveET200SPSlot() instead of the S7-1500 path. This eliminates the crash and, as a side benefit, enables the routing diagnostics that were silently disabled on V17 Update 1–Update 4.

Diagnostic Procedure

Before applying the fix, confirm that the observed behavior matches the regression pattern rather than a project-specific corruption. Run the following diagnostics in order:

1. Capture the TIA Portal exit code and Windows Event Viewer entry. Open Event Viewer → Windows Logs → Application and filter on source Application Error. The faulting module name and exception code identify the property-page provider DLL.
2. Verify the installed TIA Portal update level. In TIA Portal, select Help → Installed software. Record the exact build string (for example, V17.0.4.0_44.0.9.2). Builds prior to V17.0.5.0 exhibit the crash; builds V17.0.5.0 and later contain the fix.
3. Reproduce the crash in an isolated project. Create a new empty project, add a CPU 1512SP-1 PN at slot 0, add a CP 1542-1 at slot 2, and click Properties → Communication with the CPU. If the crash reproduces in a clean project, the issue is environmental (TIA build) rather than project-corrupt.
4. Capture process dump. Set the HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Siemens.TIA.Portal.exe registry hive with DumpType=2 and DumpFolder=C:\TIADumps. This produces a full user-mode dump on the next crash, which Siemens Technical Support can decode to confirm the regression.
5. Confirm the IM 155-6 PN revision. Open the ET 200SP station and verify the IM order number. The fix applies to all IM 155-6 PN revisions (6ES7155-6AA00-0BN0, 6ES7155-6AU00-0BN0, 6ES7155-6AU30-0BN0) that support the CPU 1512SP-1 PN. Mixing an IM that is older than firmware V4.4 with the CP 1542-1 may produce a separate, unrelated property-page crash; update the IM firmware first if needed.

Primary Solution — Apply TIA Portal V17 Update 5

The Siemens-released resolution is to install TIA Portal V17 Update 5 (build V17.0.5.0_44.0.10.2 or later within the V17 Update 5 servicing chain). The installer is cumulative, so it includes all prior fixes plus the CP 1542-1 property-page patch.

1. Close all TIA Portal instances and stop the Siemens TIA Portal Discovery Service and Siemens S7TraceService from services.msc.
2. Download the TIA Portal V17 Update 5 installer from the Siemens Industry Online Support portal. Sign in with your Siemens customer center account and navigate to Support → Downloads → Automation Technology → TIA Portal → Updates.
3. Run the installer as Administrator. Select Modify/Update rather than Repair or Uninstall; the update hot-patches the affected DLLs in place.
4. Reboot the workstation. The installer prompts for a reboot to release locked CCAuthor.dll, Siemens.Automation.ObjectFrame.dll, and Siemens.Automation.ProjectData.dll files.
5. Reopen the affected project. Verify that Properties → Communication with the CPU now opens the dialog without terminating TIA Portal.

Alternative Workarounds When V17 Update 5 Cannot Be Installed

If corporate policy, locked-down workstations, or pending validation prevents installing V17 Update 5, the following workarounds mitigate the crash without abandoning V17 Update 4.

Workaround A — Configure routing values programmatically

The Communication with the CPU property page only visualizes parameters that are also exposed as system constants in the CP 1542 device descriptor. Engineers can edit the same parameters via the Device view → CP 1542 → Properties → General → PROFINET interface → Ethernet addresses and via the PC internal interface of the CPU. The routing entries that the property page would have shown are written to the project database when the configuration is compiled, even if the property page never opens.

Workaround B — Use a stub CPU temporarily

1. Open the project and navigate to Devices & networks.
2. Replace the CPU 1512SP-1 PN with a CPU 1511-1 PN (6ES7511-1AK02-0AB0) or CPU 1515-2 PN (6ES7515-2AM02-0AB0). The slot layout is identical for the CP 1542-1.
3. Open Properties → Communication with the CPU. The dialog opens without crashing because the regression is CPU-class-specific.
4. Configure the routing slot, S7 routing path, and secure PG communication certificates.
5. Compile the station. Save the project.
6. Reverse the CPU swap. The routing values written in step 4 are retained by the CP 1542-1 device descriptor and remain valid after the CPU is swapped back to the 1512SP.
7. Recompile the project. The System diagnostics buffer should not report any configuration inconsistencies.

Workaround C — Edit the device descriptor XML directly

For advanced users who need to script the change across multiple projects:

1. Close the project in TIA Portal.
2. Open the project folder and locate the CP 1542-1 XML descriptor (typically under System\Devices\<GUID>\CP1542.xml).
3. Add or modify the <Routing>, <PGCommunication>, and <SecurePGComm> nodes to reflect the desired routing topology.
4. Reopen the project. The values appear under Properties → Communication with the CPU on V17 Update 5 (and later). On V17 Update 4 the property page still crashes, so this workaround is most useful for batch-configuring projects that will eventually be opened on V17 Update 5 or V18.

Workaround D — Project rebuild from scratch

Recreating the project from a blank template and importing the program blocks, HMI tags, and recipes via Library → Global libraries → Insert is the least attractive option but is guaranteed to work on V17 Update 4. This is the path the original engineer resorted to before identifying Update 5 as the root cause. Use it only when the project contains a small number of blocks (< 200), because the manual transfer of configuration data (PROFINET device names, IP addresses, security settings, user administration) is time-consuming and error-prone.

Project Recovery Procedure After an Unexpected TIA Portal Exit

If TIA Portal crashes before the user can save, recover the most recent project state:

1. Navigate to File → Manage → Project recovery.
2. Select the project from the auto-recovery list. TIA Portal stores last-known-good snapshots in %LOCALAPPDATA%\Siemens\Automation\<PortalVersion>\ProjectRecovery\.
3. Save the recovered project under a new name to avoid overwriting the original file.
4. Compare the recovered project against the most recent manually saved version using Project → Compare. Roll forward any device or block changes that the auto-recovery captured after the last manual save.

If the auto-recovery list is empty, the original .ap17 project file remains intact and can be reopened in V17 Update 5 once the update is installed.

Verification Steps

After applying V17 Update 5 (or applying one of the workarounds), verify the fix end-to-end:

1. Open the project in TIA Portal V17 Update 5.
2. Navigate to Devices & networks → CP 1542-1 → Properties → Communication with the CPU. The dialog must open without terminating TIA Portal.
3. Inspect the routing slot field. For a CPU 1512SP-1 PN at slot 0, the field should display X1 (PN/IE) as the integrated interface.
4. Enable the "Permit PG access with PUT/GET communication from remote partner (S7-1200/S7-1500)" option if the application uses PUT/GET routing. Save and recompile.
5. Compile the station (right-click the device → Compile → Hardware (rebuild all)). The compile must complete without warnings referencing CP 1542 routing inconsistencies.
6. If a physical CPU is available, download the project and test online routing. From the PG/PC interface configured on the CP 1542-1 subnet, open Online → Accessible nodes. The CPU 1512SP-1 PN must appear with its PROFINET device name and IP address, and the Online & diagnostics → Routing view must enumerate the CP 1542-1 as a hop.
7. Run Project → Consistency check → Display inconsistencies. The result must be empty.

Preventive Measures

• Adopt a single TIA Portal update level per engineering team. Mixed V17 Update 4 and V17 Update 5 installations cause project compatibility warnings and prevent collaborative editing. The Siemens Industry Online Support article "Compatibility of TIA Portal projects across different versions" details which project combinations are supported.
• Subscribe to Siemens Product Safety Advisories. Use the Siemens Industry Online Support portal's Newsletter function to receive notifications when a TIA Portal update addresses a known regression.
• Use a dedicated engineering VM. Run TIA Portal inside a Hyper-V or VMware Workstation virtual machine that can be rolled back to a known-good snapshot. Combine the VM with a Windows image that has all updates pre-applied.
• Maintain a test project per device family. A simple CPU 1512SP + CP 1542-1 test project catches regressions early and provides a clean reproducer when filing a Siemens Service Request.
• Enable automatic TIA Portal crash dumps. The LocalDumps registry key (see Diagnostic Procedure step 4) ensures every crash is captured for post-mortem analysis.

Related Issues and Documentation

The CP 1542-1 family is supported by several manuals that engineers should keep alongside the TIA Portal installation:

• CP 1542-1 communications processor operating instructions (Siemens)
• S7-1500 / ET 200SP CPU 1512SP-1 PN manual
• SIMATIC PROFINET with TIA Portal — Function manual
• TIA Portal V17 release notes / readme

Additional V17 hotfixes relevant to ET 200SP stations include fixes for the IM 155-6 PN port diagnostics (entry ID 109779122) and the S7-1500 motion control axis trace buffer (entry ID 109780201). Review the V17 readme for the full list before commissioning.

Frequently Asked Questions