S7-1500 Router Address Lost After Restart: TIA Portal Fix

Problem Overview

On SIMATIC S7-1500 CPUs (S7-1511, S7-1513, S7-1515, S7-1516, S7-1517, S7-1518, and the S7-1500 Software Controller on IPC), the router address entered in the PROFINET interface properties appears to be accepted by TIA Portal in STOP mode and by the front-panel display, but it is reverted to 0.0.0.0 after a power-on reset (POR) or POWER OFF / POWER ON cycle. The same applies when the value is set through the CPU's online "Assign IP address" wizard or with PRONETA's single-device assignment.

Three symptoms cluster:

1. The CPU retains the gateway only until the next restart; load memory is not updated.
2. WinCC Comfort/Advanced, WinCC Unified, and TIA HMI panels connected over a routed path start to display #### instead of live process values once the gateway has been lost.
3. Direct engineering access from a PG/PC on the same physical subnet still works, because the local-subnet route does not require the gateway.

Root Cause Analysis

The behavior is not a bug. It reflects the difference between the CPU's work memory (volatile RAM) and load memory (non-volatile SIMATIC Memory Card or internal flash). All three of the following write paths touch RAM only:

• TIA Portal > Online > Online & Diagnostics > Functions > Assign IP address / Assign router
• CPU front panel: Settings > Addresses > X1 / X2 > Router
• SIMATIC Automation Tool or PRONETA "Assign IP" functions targeting a single device

None of these paths triggers a write to the load memory image of the project. The CPU boots from the load memory image; if no router address has been compiled into the hardware configuration and downloaded to the device, the interface starts with 0.0.0.0 for the gateway and remains there until the next RAM write from one of the paths above. The same logic applies to the IP address and subnet mask of the interface.

The secondary question — "is the router the same as the gateway?" — is answered in the affirmative for IP routing. The PROFINET interface on an S7-1500 has a single routing entry called Router in the TIA Portal UI. This entry populates the operating system's default gateway and is functionally equivalent to the Default Gateway field in Windows network settings.

S7-1500 Routing Architecture

S7-1500 CPUs support two distinct routing mechanisms that are often confused in field service reports:

The "Router address" field in the Ethernet addresses dialog controls IP routing only. S7 routing is enabled separately under Properties > General > Routing in the device configuration. See the Siemens function manual Overview of the routing mechanisms of S7-1500 CPUs for the architecture diagrams and selection criteria.

Reference topology

Prerequisites for a Permanent Router Configuration

• TIA Portal V16 or later (V17 / V18 / V19 / V20 behave identically for this configuration step).
• An offline project containing the S7-1500 station with the PROFINET interface of the CPU fully configured (IP address, subnet mask).
• Programming device with a routable connection to the CPU; this can be the same subnet as subnet A in the topology above.
• CPU in STOP if the IP / router is being changed for the first time after a fresh project download (Siemens does not require STOP for an IP change, but field practice recommends it to force a clean re-resolve of connections).
• The correct gateway IP for the subnet the CPU's interface physically resides on. If the CPU is on 192.168.0.0/24, the gateway must be reachable on that subnet (commonly the LAN-side address of the router/firewall, e.g. 192.168.0.254).
• Write/read access to the project (no exclusive project lock, no full know-how protection on the device configuration).
• A formatted SIMATIC Memory Card (SMC) of an approved type, 6ES7954-8Lx02-0AA0 or higher, if the CPU is configured to load from card.

Step-by-Step Configuration via TIA Portal

The router is part of the device configuration, not the program blocks. It must be entered offline and downloaded to the device.

1. In the TIA Portal project tree, expand the S7-1500 station and double-click Device configuration.
2. Select the CPU in the device view, then click the PROFINET interface [X1] (or [X2] if the CPU is dual-interface, e.g. S7-1518 / S7-1518T) in the graphic area.
3. In the inspector window, switch to Properties > General > Ethernet addresses.
4. In the IP protocol section, confirm that IP address and Subnet mask are correct for the local subnet.
5. Tick Use router. The Router address input field activates.
6. Enter the IP address of the default gateway on the local subnet (e.g. 192.168.0.254). Do not enter the WAN-side address of the router.
7. Right-click the CPU in the project tree and choose Compile > Hardware (rebuild all). Confirm that the compile finishes without errors.
8. Right-click the device and choose Download to device > Hardware configuration. Use the "Search for online nodes" wizard if the CPU is not already selected; tick Overwrite IP address in the online device only if the IP itself changed.
9. Wait for the download to complete and the CPU to restart (PROFINET interface renumbering can briefly drop the connection; this is normal).
10. Reconnect with Online > Online & Diagnostics and navigate to Diagnostics > Ethernet addresses. The router field must now show the configured value.
11. Power-cycle the CPU: POWER OFF, wait at least 5 seconds, POWER ON. After the CPU reaches RUN, re-check the router field via Online & Diagnostics. The value must persist.

CPU Display Configuration (Front Panel)

Modern S7-1500 displays allow IP, subnet, and router entries through Settings > Addresses > X1. This path writes to RAM. The behavior is documented and intended for commissioning where a PG is not yet available. The value is overwritten by the load memory image on the next restart.

Procedure on the display:

1. Navigate Settings > Addresses > X1 > Router.
2. Enter the IP address; confirm with OK.
3. Cycle the CPU.

Result: the value reverts to 0.0.0.0 unless the value has also been compiled into the offline hardware configuration. The display is therefore a verification tool, not a configuration tool, for permanent installations.

Display-level lock: under Protection > Display > Know-how protection / Access level, the menu paths to change IP parameters can be password-protected. If the field engineer cannot reach the router dialog on the display, the protection level must be relaxed first, ideally via the TIA Portal project.

DHCP-Based Router Assignment

If the S7-1500 CPU is configured to obtain its IP address from a DHCP server, the same server can deliver the default gateway. The relevant DHCP option is option 3 (Router) per RFC 2132. Siemens DHCP support on the S7-1500 is documented in Principle of address assignment via DHCP (S7-1500).

Conditions for DHCP router delivery to work:

• CPU > Properties > Ethernet addresses > Obtain IP address from a DHCP server is enabled.
• DHCP server is configured with option 3 set to the local-subnet gateway IP.
• DHCP lease time has not expired; on lease expiry the CPU will renew, and if option 3 is missing from the renewal the gateway may drop back to 0.0.0.0 until the next full handshake.
• The CPU and the DHCP server are on the same broadcast domain (no router between them).
• DHCP client identifier: the S7-1500 sends its PROFINET device name as the client identifier; some DHCP servers require a name reservation to assign option 3.

For deterministic behavior in industrial networks, prefer a static gateway in the compiled hardware configuration over DHCP. DHCP is useful for temporary commissioning or for fleets that move between subnets.

S7 Routing vs. IP Routing

Many field engineers enable "S7 routing" expecting that to make the CPU reachable across subnets. S7 routing is a protocol-level mechanism for S7 communication and does not populate the IP default gateway. If the use case is "let a remote PG reach this CPU over a routed path," the IP gateway is what is needed. If the use case is "let an HMI on subnet B communicate with the PLC on subnet A using S7 protocol," S7 routing through a gateway CPU or SCALANCE can be used in addition to or instead of IP routing.

HMI "####" Error Correlation

When an HMI displays #### in a tag field, the HMI is signaling that the tag value cannot be read at the configured update rate. The four most likely root causes when a router change has just been made:

1. HMI gateway not configured. The HMI also needs the IP address of its local-subnet router. If the HMI is on 192.168.1.0/24 with gateway 192.168.1.253, and the gateway is missing, the HMI cannot reach 192.168.0.20.
2. PLC connection points to wrong IP. The HMI connection in the TIA project may still reference the old IP if the device was renumbered.
3. PLC gateway lost on restart. The symptom in this article: PLC gateway back to 0.0.0.0 means the PLC cannot reply on a routed path. The HMI then keeps timing out.
4. PLC and HMI on the same physical subnet. If so, neither gateway is required and the issue is purely the connection string.

Use TIA Portal > Online > Accessible nodes to verify the HMI's reachable IP from the PG. From the HMI, use Control Panel > Network & Internet > Ping (or the diagnostic page on Unified Comfort Panels) to confirm the PLC is reachable. WinCC Unified stores the gateway in the runtime configuration under Network settings > Ethernet.

Project Protection and Access Control

Two protection-related settings interfere with online IP changes and must be understood before assuming a write was accepted:

For the symptom described, none of these is normally the cause of the power-cycle loss. They become relevant if the user expects to write IP parameters from a different project (not the source project) and sees the write rejected. The recommendation for permanent commissioning is to embed the IP / router in the project source itself and protect the project against unauthorized edits at the source-control level (e.g. TIA Portal multiuser or a Git workflow).

Verification Procedures

After the download and power-cycle test, run the following checks:

1. Online diagnostics. TIA Portal > Online > Online & Diagnostics > Diagnostics > Ethernet addresses > IP / Subnet / Router. All three must show the configured values, not 0.0.0.0.
2. Local ping from the PG. Open a Windows command prompt on the PG and run ping 192.168.0.20. The response must come from the CPU's MAC in the OUI prefix 00:0E:8C (older S7-300/400) or 28:63:36 (newer S7-1500 modules).
3. Routed ping from subnet B. From a PG on subnet B, ping the PLC. If the routed path is required, this validates that the gateway is correct on both ends.
4. PRONETA scan. Run Siemens PRONETA in network analysis mode to confirm the CPU appears with the expected IP and that no duplicate IP is on the network.
5. Power cycle x3. POWER OFF / POWER ON three times consecutively. Each time the router must come back with the configured value. This catches memory-card-related issues where a single boot appears correct but subsequent boots revert.
6. HMI live value test. On the HMI, switch to a screen with a tag derived from the PLC and confirm that the #### is replaced by the live value.
7. Firmware-downgrade test. If a firmware update is planned, perform the upgrade, then re-download the project. Some firmware versions reset non-volatile IP parameters if the project on the memory card does not match.

If the value still reverts, the most likely remaining cause is a project that has not been re-compiled and downloaded after the IP edit (e.g. another engineer's project on the engineering server has overwritten the device). Use TIA Portal's project comparison (menu > Tools > Compare) to identify configuration drift between offline and online.

Troubleshooting Matrix

Firmware-Specific Considerations

For the S7-1500 Software Controller (CPU 1505SP / CPU 1507S / CPU 1508S) running as of firmware V20.8, Siemens revised the IP routing behavior to better support IPC deployments with multiple Ethernet interfaces. Key points per the Siemens application document IP routing with the S7-1500 Software Controller as of firmware V20.8:

• Routing must be explicitly enabled per interface: tick Use router and enter the local-subnet router address. The example in the document uses 192.168.73.2.
• Multiple PROFINET / Ethernet interfaces can each have their own router; they are not shared.
• Firmware V20.8 onward stores the gateway in the project on the memory card of the IPC's CFast / SSD, but only if the project contains the value.
• Earlier firmware (V20.6 and below) on the Software Controller had known issues where the router was not honored for certain S7 routing paths; the workaround was to enable IP forwarding at the IPC level, which is not recommended in production.

For S7-1500 hardware CPUs (S7-151x), the firmware-version dependence is minimal; the configuration steps are identical from firmware V1.5 onward. Always check the release notes for the firmware on the CPU; major releases (V2.0, V2.5, V2.9, V3.0) occasionally reset to defaults if a downgrade is performed without a project reload.

Diagnostic Commands and Code Snippets

For quick verification on a Windows PG in the same subnet:

REM Verify the PLC IP and MAC
arp -a | findstr 192.168.0.20
ping -n 4 192.168.0.20

REM Trace the route from subnet B to the PLC
tracert 192.168.0.20

REM Resolve DNS-style name if name resolution is enabled
nslookup s7-1500-plant1

REM Show the PG's own routing table
route print

For PRONETA network scan, the CLI flag to focus on a single subnet:

Proneta.exe /scan /subnet 192.168.0.0/24 /report network_report.html

For an SCL block in the CPU that reads back the current gateway at runtime (read-only, for diagnostics):

// SCL — read current IPv4 gateway of PROFINET interface X1
#retCode := RDREC(SYS1:RDREC_DB,
                  ID     := 0,
                  INDEX  := 1,        // IF1 record index 1 = IP parameters
                  MLEN   := 24,
                  BUFFER := #buf);
IF #retCode = 0 THEN
   #gateway := DWORD_TO_IP(#buf.DWORD4);   // offset 8 = default gateway
END_IF;

For quick reference, the byte layout of the Siemens "IP parameters" record (index 1) used above is:

The field at offset 8 in the Siemens record is labeled "Default Gateway" in the documentation; this is the value that the TIA Portal UI presents as the "Router address." Offsets are platform-endian; use the appropriate byte-swap helpers when reading into PLC tags.

S7-1500 vs S7-1200 vs S7-300 Routing Notes

The mechanism is consistent across the S7-1500 / ET 200SP CPU / S7-1200 families: the router is part of the device configuration and must be downloaded to the device to persist. Field engineers moving from S7-300 should be aware that S7-300 gateways were set in system data blocks via NetPro, not in the device configuration.

FAQ