Resolving TIA Portal V19 Error 0130:000002 When Connecting to a S7-1200

Error 0130:000002 in TIA Portal V19 (also reported on V16, V17, V18) terminates the Go online handshake before any S7 communication channel is established. The PC can ping the CPU, the Web server is reachable, and Accessible Nodes lists the target, yet the Establish connection dialog fails. This reference isolates the root causes, the diagnostic sequence, and the corrective actions used in field service.

1. Error 0130:000002 - Anatomy and Meaning

The error code is a 32-bit hexadecimal value returned by the TIA Portal Online subsystem (Siemens.Automation.ObjectFrame). It is split into a 16-bit module identifier (0x0130) and a 16-bit sub-error (0x0002).

The error is not a CPU fault; the S7-1200 continues running its user program and continues to respond to HTTP, SNMP, and ICMP. The failure is on the engineering side, almost always between the PG/PC interface selection and the PROFINET DCP / S7 connection setup phase.

2. Root Cause Matrix

Every reported instance of 0130:000002 that I have seen in commissioning logs maps to one of the rows below. Ranked by probability.

3. Pre-Diagnostic Network Inventory

Capture the following baseline before changing any configuration. Save the output to a text file so it can be compared with post-fix state.

3.1 IPCONFIG and route table

ipconfig /all > C:\diag\ipconfig.txt
route print >> C:\diag\ipconfig.txt
getmac /v >> C:\diag\ipconfig.txt

Check the following:

• Is the Ethernet adapter used for PROFINET in the same subnet as the S7-1200? (Typically 192.168.0.x/24.)
• Are two adapters in the same subnet? This is the single most common cause of 0130:000002 on laptops that have Wi-Fi enabled.
• Is the default gateway pointing at the PROFINET subnet? It should not. PROFINET is layer-2 only.

3.2 Layer-3 verification

ping -n 4 <CPU_IP>
nslookup <CPU_IP>
tracert -d -h 4 <CPU_IP>

If ping succeeds and tracert shows one hop, IP connectivity is confirmed. Open the Web server (http://<CPU_IP>) to confirm the CPU is alive at the application layer.

3.3 Layer-2 (DCP) verification

In TIA Portal, open Online > Accessible nodes. The S7-1200 must appear with its PROFINET name, IP, and MAC. Note whether the same MAC appears twice - this is the diagnostic clue from the original report and is treated in detail in Section 6.

4. Step 1 - Network Adapter Isolation

Laptops that ship with both an Ethernet jack and Wi-Fi will frequently route PROFINET traffic out of the wrong adapter when both are connected. The OS picks the adapter with the lowest route metric, which on many Windows builds is the Wi-Fi.

4.1 Disable secondary adapters

1. Open Control Panel → Network and Internet → Network Connections.
2. Right-click the Wi-Fi adapter, choose Disable. If a VPN virtual adapter is present (Cisco AnyConnect, FortiClient, WireGuard), disable it as well.
3. Right-click the Ethernet adapter used for PROFINET, choose Properties → Internet Protocol Version 4 → Advanced.
   • Uncheck Automatic metric, set Interface metric to 1.
   • Uncheck Register this connection's addresses in DNS if the CPU does not need name resolution.
4. Open Device Manager → Network Adapters → <NIC> → Power Management. Uncheck Allow the computer to turn off this device to save power.

4.2 Bind PG/PC interface to the correct NIC

1. Launch Start → SIMATIC → Set PG/PC interface (alias SetPgPcInterface.exe).
2. Access point of use: S7ONLINE.
3. Interface parameterization: select the TCPIP → <MAC of correct NIC> entry, not the Wi-Fi one.
4. Click OK. TIA Portal will use only this adapter for online operations.

5. Step 2 - Verify IP Layer and DCP Discovery

PROFINET uses the Discovery and Configuration Protocol (DCP) on UDP port 43245 for identification and assignment, and ISO-on-TCP / RFC1006 on port 102 for S7 communication. Both must be reachable.

5.1 Force DCP from the PC

From an elevated command prompt, send a directed DCP Identify request using the Siemens PRONETA tool or the third-party Wireshark filter dcp. If two responses arrive for one request, the switch is repeating frames - jump to Section 6.

5.2 Validate TLS 1.2 / 1.3

S7-1200 firmware V4.4+ negotiates TLS 1.2 or 1.3 for the secure online channel. Older Windows 10 builds (pre-1903) ship with TLS 1.2 disabled by default. TIA Portal will silently fail rather than negotiate down.

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001

Reboot the PC after the registry edit. Confirm with PowerShell:

[Net.ServicePointManager]::SecurityProtocol

6. Step 3 - Resolve Duplicate MAC Detection (DCP Relay / Ring)

The original report observed two S7-1200 CPUs with the same MAC in the PN Browser, on a network using a Phoenix Contact managed switch that supports DLR. The behaviour is consistent with one of the following:

• The PROFINET ring is closed: the same frame is being seen twice.
• The switch is configured to relay or mirror multicast DCP traffic onto a second port.
• A media redundancy client (MRP) on the switch is set to manager mode by mistake.

6.1 Break the loop

1. Power down the CPU.
2. Disconnect every PROFINET cable from the managed switch except the PC uplink and the CPU uplink.
3. Power up the CPU, then re-run Online > Accessible nodes. Only one entry must appear.
4. If the duplicate vanishes, reconnect cables one at a time until the second instance reappears. That port is the offending path.

6.2 Switch configuration

On Phoenix Contact FL SWITCH 2308 PoE and similar managed devices, check the following settings in the Web UI (https://<switch_IP>):

7. Step 4 - TIA Portal / CPU Firmware Compatibility

The Siemens SiePortal reports the same 0130:000002 symptom in TIA Portal V16, V17, and V19 on S7-1200 / S7-1500 when the project was created in a newer TIA version and downloaded against an older CPU firmware, or vice versa. The project-side TIA Portal enforces a compatibility check at compile time; the online path performs it again at runtime. A mismatch causes the runtime to abort the connection with 0x0002.

7.1 Firmware matrix (S7-1200)

Verify the firmware level from the project side: Project tree → Devices → CPU → Properties → General → Catalog information. Compare against the firmware actually flashed in the CPU: Online > Accessible nodes > Online & Diagnostics → Diagnostics → Device information.

7.2 Recovery path

1. If the CPU firmware is older than the project's minimum, downgrade the project in TIA Portal (Options → Support packages → Add the older HSP) or upgrade the CPU firmware using the SIMATIC Automation Tool.
2. If the CPU firmware is newer than the project supports, install the matching TIA Portal version side by side or upgrade the existing TIA Portal to a release that supports the firmware (see the Siemens TIA Portal compatibility tool).
3. Recompile the project (Ctrl+B) before attempting to go online again.

8. Step 5 - PG/PC Interface and TLS Configuration

The Set PG/PC interface tool writes registry values under HKLM\SOFTWARE\Siemens\Automation\PGPCInterface. If the registry becomes inconsistent - for example, after a TIA Portal upgrade from V17 to V19 - the runtime cannot open a TCP socket on the chosen adapter.

8.1 Reset the PG/PC interface

1. Close all SIMATIC applications.
2. Run SetPgPcInterface.exe /clean from C:\Program Files\Siemens\Automation\Portal V19\bin.
3. Re-launch the GUI tool, re-select S7ONLINE → <NIC>.TCPIP.1.
4. Reboot the PC.

8.2 Validate ISO-TSAP reachability

Open a PowerShell session as Administrator and run:

Test-NetConnection -ComputerName <CPU_IP> -Port 102 -InformationLevel Detailed

A successful TcpTestSucceeded : True confirms that port 102 is reachable. If it is closed, the CPU is not responding to ISO-on-TCP - this is the failure mode that yields 0130:000002 at runtime.

9. Step 6 - Firewall and Windows Security Hardening

Disabling the Windows firewall in the Control Panel is not sufficient in modern builds. The Windows Defender Firewall with Advanced Security MMC snap-in, the Connection Security Rules, and the App & Browser Control all maintain their own rule sets. The Siemens portal process must be allowed explicitly.

9.1 Add explicit firewall rules

netsh advfirewall firewall add rule name="TIA Portal V19" dir=in action=allow program="%ProgramFiles%\Siemens\Automation\Portal V19\Bin\Siemens.Automation.Portal.exe" enable=yes

netsh advfirewall firewall add rule name="S7OMM Helper" dir=in action=allow program="%ProgramFiles%\Siemens\Automation\Portal V19\Bin\S7OMMHelper.exe" enable=yes

netsh advfirewall firewall add rule name="SINEC NFP" dir=in action=allow program="%ProgramFiles%\Siemens\SINEC NFP\SinecNfp.exe" enable=yes

9.2 Disable notification rules

netsh advfirewall set allprofiles state off
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound

9.3 Real-time protection and tamper protection

Windows Security → Virus & threat protection → Exclusions: add the TIA Portal installation directory and the project working directory (typically D:\TiaProjects). Real-time scanning of the project files during save can corrupt them silently and cause the next online attempt to fail with 0130:000002.

10. Step 7 - Switch Topology and PROFINET DLR

Device Level Ring (DLR) is defined by ODVA as a layer-2 redundancy protocol for EtherNet/IP. It is not PROFINET. A Phoenix Contact switch supporting DLR will, by default, perform DLR beacon / announce frame handling. If a PROFINET device is connected to the ring, those frames can be flooded onto the PROFINET segment unless filtered.

10.1 Verify the switch mode

1. Connect to the switch Web UI.
2. Navigate to Redundancy → DLR (Phoenix Contact uses MRP/DLR as a combined menu).
3. If the switch is set to DLR Supervisor, change it to DLR Participant or disable DLR entirely for PROFINET-only segments.

10.2 PROFINET MRP client role

If MRP (Media Redundancy Protocol, IEC 62439-2) is required, set the S7-1200 CPU to MRP client and the switch to MRP manager. The PROFINET ring is then closed on the switch port and no frame is duplicated to the engineering PC.

11. Step 8 - Wireshark Capture Procedure

When all of the above have been tried and the error persists, capture the online handshake to confirm the cause. This procedure takes about five minutes.

1. Install Wireshark 4.x on the engineering PC.
2. Start a capture on the Ethernet interface bound to PROFINET. Use the capture filter dcp || s7comm || arp || tcp.port == 102.
3. In TIA Portal, attempt Go online. The dialog will fail with 0130:000002 within 10-15 seconds.
4. Stop the capture. Inspect the following frames:

Save the capture and export it as .pcapng for inclusion in a Siemens support request via the SIOS portal.

12. Verification Checklist

Run through the items below in order. If any item fails, return to the indicated section.

1. Single adapter visible. ipconfig /all shows only one active Ethernet interface on the PROFINET subnet. (Section 4)
2. PG/PC interface bound. SetPgPcInterface shows S7ONLINE → <correct NIC>. (Section 8)
3. Ping succeeds. ping <CPU_IP> returns <1 ms. (Section 3)
4. Web server reachable. http://<CPU_IP> returns the standard S7-1200 page. (Section 3)
5. Port 102 open. Test-NetConnection -Port 102 returns True. (Section 8)
6. Single DCP response. Accessible nodes shows the CPU once. (Section 6)
7. Firmware matches. Project firmware level equals CPU firmware level. (Section 7)
8. Go online succeeds. TIA Portal reports Online — connected; the right pane shows CPU diagnostic buffers.

13. Preventive Measures

• Pin the engineering PC to a fixed IP. DHCP churn breaks the S7 connection less often but still breaks DCP.
• Disable Wi-Fi and Bluetooth on commissioning laptops. Many corporate image builds re-enable them after sleep.
• Use a dedicated PROFINET NIC (e.g., Siemens CP 1623 or Intel i210-T1) instead of the laptop's built-in port. Driver stability is significantly better.
• Centralise TIA Portal installations. Multiple TIA versions on the same PC fight over the PG/PC interface registry keys.
• Document the project ↔ firmware matrix in a shared spreadsheet. The TIA Portal Support packages archive often sits on a network share that not all engineers update.
• On managed PROFINET switches, configure DCP forwarding rules so that DCP Identify responses are sent to the originating port only, never flooded.

14. Field-Proven Diagnostic Flow

15. When to Escalate

If 0130:000002 persists after the eight steps above, collect the following and open a support request through the official Siemens support channel at SIOS:

• The TIA Portal version and installed HSP list (Help → About).
• The CPU order number (e.g., 6ES7214-1AG40-0XB0) and firmware version from the Web server's Module Information page.
• The Wireshark .pcapng file from Section 11.
• The output of ipconfig /all, route print, and netsh advfirewall show allprofiles.
• The exact TIA Portal project file (zipped, with the .ap19 or .ap19_1 extension).

With this evidence the Siemens support team can correlate against known issues such as the entry Persistent Error 0130:000002 when connecting to S7-1200/1500 in TIA Portal V16-V19 in the SiePortal knowledge base.