Resolving S7-1200 Hardware Mismatch Bypass I/O Configuration

1. Problem Overview: IO Device Failure on S7-1200 with Missing Hardware

When commissioning a SIMATIC S7-1200 CPU (including fail-safe variants such as the CPU 1214 FC) on the bench, engineers frequently encounter the diagnostic message "IO device failure - Unacceptable configuration difference (wrong or missing component)". The fault is logged with a hardware identifier (HW_ID) such as 305 and prevents the user program from starting because the configured topology in the TIA Portal project does not match the physical slot population.

Common symptoms include:

• CPU remains in STOP or repeats STOP-to-RUN transitions.
• Diagnostic buffer entries: "IO device failure", "Station failure", "Module not found".
• SF (system fault) LED is solid red; sometimes MAINT or BF LEDs are also lit depending on topology.
• Failure occurs at the first RUN start after download and persists across power cycles.

The typical scenario is a fully developed project that contains distributed I/O, signal modules (SM), communication modules (CM/CP), or fail-safe I/O that is not physically wired to the bench unit. Engineers need a way to run the application logic, simulate, or perform a soft test without the entire physical rack present.

2. Root Cause Analysis of HW_ID 305 Configuration Difference

The S7-1200 system performs a strict comparison between the configured module set stored in the loaded project and the detected module set in the actual backplane/PROFINET topology. The diagnostic event 0x001E ("IO device failure") combined with a configuration-difference cause is a member of the standard PROFINET alarm model and is mapped to the S7 diagnostic buffer as event ID 0x001E / 0x01E1 with channel diagnostics that identify the missing module by its hardware identifier.

Per the SIMATIC S7-1200 Programmable Controller System Manual (09/2024), the CPU enters the configured response to a station/IO-device failure. The default response for missing modules on a non-F runtime is typically STOP unless diagnostic event handling is reconfigured.

For F-CPUs (CPU 1214 FC, 1215 FC, 1504F, 1507F, 1508F, 1516F, 1517F, 1518F), the response is stricter: missing safety-related I/O can cause a passivation cascade, and the safety program shuts down the F-runtime if a required F-module is unreachable. The bench-test use case must therefore distinguish between standard I/O missing and F-I/O missing.

Key diagnostic buffer fields to read:

3. Why the CPU Stops on a Configuration Difference

Per the S7-1200 system manual, when a module identified by HW_ID in the loaded configuration cannot be reached at startup, the CPU raises the diagnostic interrupt "Unacceptable configuration difference". The CPU then executes the configured response to the corresponding diagnostic OB. If no error OB is loaded, the default action is to go to STOP. This is the central mechanism you must intercept.

The relevant OBs in the S7-1200/1500 architecture are:

Reference: Siemens KB 68192883: "List of error OBs in S7-300/400/1200/1500" and the S7-1200 Function Manuals.

4. Solution A: Mark Modules as "Not Plugged" in TIA Portal (Recommended)

This is the cleanest, project-preserving method. The hardware remains defined in the configuration, but the CPU does not look for it during startup. It is the technique endorsed by Siemens support for bench validation when only a subset of the physical hardware is wired.

4.1 Prerequisites

• TIA Portal V15.1 or later (V17 / V18 / V19 recommended for S7-1200 firmware V4.5+).
• CPU must be in STOP for project download.
• Project source is the same TIA Portal project that originally contained all modules.

4.2 Step-by-Step Procedure

1. Open the project in TIA Portal and expand the Project tree → Devices & networks.
2. Select the S7-1200 station or the affected PROFINET IO device.
3. Open the Device view of the station.
4. Right-click any module that is not physically present and choose "Mark as not plugged", or select the module and uncheck the box "Module is plugged" in the Properties window.
5. Save and compile the project (Project → Compile → Software (rebuild all)).
6. Download the hardware configuration to the CPU while it is in STOP. The CPU will reinitialize I/O without searching for the unchecked modules.

Tip: In the Device view, the icon strip at the top includes a toggle for "Show modules not plugged". Use it to view all the modules that are currently marked as absent, and to drag them back to a slot when the real hardware returns.

5. Solution B: Use Diagnostic OBs to Prevent STOP

If the project cannot be modified (for example, an OEM project is locked or versioned on the supplier's revision control), the alternative is to load empty diagnostic OBs into the CPU. The presence of OB 82 and OB 86 tells the CPU to call user code instead of switching to STOP when the corresponding fault occurs.

5.1 Add the OBs in TIA Portal

1. In the project tree, right-click the CPU → Program blocks → Add new block.
2. Choose Organization block (OB) with the correct number: 82, 86, 121, 122 as needed.
3. Inside the OB, add a single line of code so the OB is non-empty (e.g., a NOP or a simple bit reset). An empty OB will still suppress STOP because the runtime considers the OB as "loaded"; however, Siemens best-practice documentation recommends placing at least an // diagnostic handler comment to keep version control meaningful.
4. Compile and download to the CPU in STOP mode.

5.2 Sample OB 86 Skeleton (LAD)

Place the following in OB 86 to log the failure and let the rest of the program continue. Replace "DB_Diag".Tag_OB86_Time with a tag from a data block you create.

// OB 86 - Loss of IO device / DP slave
// Read the OB start info to identify the failed station
#OB86_MDL_ADDR     := LADDR;          // HW_ID of the failed module
#OB86_FLT_ID       := OB86_FLT_ID;    // 0x01 = incoming, 0x02 = outgoing failure
#OB86_RESERVED_1   := OB86_RESERVED_1;
"DB_Diag".Tag_OB86_Time   := INT_TO_DWORD(TIME_TO_INT(TIME()));
"DB_Diag".Tag_OB86_LADDR  := #OB86_MDL_ADDR;
"DB_Diag".Tag_OB86_FLT_ID := #OB86_FLT_ID;
// Optional: increment a counter, set a status bit, or trigger an HMI alarm

5.3 SCL Equivalent of OB 82

// OB 82 - Module diagnostic interrupt
IF (#IO_STATE = 0) THEN                // 0 = incoming, 1 = outgoing
    "DB_Diag".DiagInCount := "DB_Diag".DiagInCount + 1;
    "DB_Diag".DiagLADDR  := #LADDR;
    "DB_Diag".DiagCHAN   := #CHANNEL;
ELSE
    "DB_Diag".DiagOutCount := "DB_Diag".DiagOutCount + 1;
END_IF;

6. Solution C: TIA Portal Hiding of PROFINET IO Devices

For distributed I/O on PROFINET rather than local rack slots, the equivalent technique is to disable the IO device in the project:

1. Open Devices & networks and select the PROFINET network view.
2. Right-click the IO device (e.g., ET 200SP, ET 200MP, SINAMICS, SCALANCE) that is not on the bench.
3. Choose "Disable" (or temporarily set its PROFINET device name to a value the controller will not find).
4. Recompile the project and download the hardware configuration.

The CPU's PROFINET IO controller will then start without scanning the disabled device, eliminating the station-failure alarm and the corresponding OB 86 call.

7. Verifying the Bypass

After applying any of the three solutions, perform the following checks:

1. Power-cycle the CPU and confirm that the RUN LED goes solid green and the SF LED is off within ~5 seconds.
2. Open Online & diagnostics → Diagnostics buffer in TIA Portal and verify no further entries with Event ID 0x001E or "Station failure" appear.
3. From the watch table, force a bit in the user program and confirm the OB 86 and OB 82 counters are incrementing as expected (if the diagnostic OBs are populated).
4. Re-read the module list via the online view: Device view → Online → "Compare offline/online" to confirm only the present modules are detected.
5. For F-CPUs, open Safety Administration and confirm the F-signature is consistent with the bench configuration, and that the F-runtime status is RUN, not PASSIVATED.

8. Restoring the Full Configuration When the Real Hardware Returns

When the missing modules are physically connected to the station:

1. In the Device view, right-click the module(s) that were marked "not plugged" and choose "Mark as plugged" (or re-enable the IO device on the PROFINET side).
2. For PROFINET devices, assign the configured device name via Online & diagnostics → Assign PROFINET device name using the topology editor or the topology discovery in TIA Portal.
3. Compile and download the hardware configuration to the CPU in STOP mode.
4. After the CPU restarts, open Online → Accessible devices and confirm all modules are detected and report no diagnostic alarms.
5. For F-modules, re-run the F-signature check via Safety Administration → Compile safety program and download the safety program to refresh CRC signatures.

9. Hardware IDs and Slot Mapping Reference

The HW_ID reported in the diagnostic buffer is the value shown in the Properties → System constants of the device. You can map it back to a slot as follows:

An HW_ID of 305 typically indicates a central signal module (SM 12xx) or a CM/CP in slots 2-6, since the CPU 1214 typically reserves HW_IDs 128-255 for onboard and central I/O. Confirm by opening the device view, selecting the affected module, and reading Properties → General → System constants → Hardware identifier.

10. Troubleshooting Matrix

11. Firmware-Specific Notes

Reference: S7-1200 CPU firmware release history (Siemens KB 109763935).

12. Field-Proven Caveats and Safety Checks

1. Never ship a machine with the bypass active. A project that runs on the bench with modules marked "not plugged" must never be deployed to a real production system. The hardware will be there, but if the project is transferred unmodified, the modules will still be considered absent. Always re-check the device view before final commissioning.
2. Empty OBs are not free. A loaded OB changes the CPU's startup behavior. With OB 86 loaded, the CPU will not STOP on station failure; this may mask real I/O faults. Document the loaded OBs in the project's safety/concept document.
3. F-signature tracking. For F-CPUs, the F-signature is generated by the safety generator. Removing a module from the configuration invalidates the signature and requires a re-signature. On bench-test stations, this is acceptable; on production lines, it triggers a safety acceptance procedure per IEC 61508 / IEC 62061.
4. Watch table safety. When forcing values in the watch table for diagnostics, never force outputs on an F-module that is wired to a real actuator. Use a simulated input from a software button on the HMI instead.
5. Diagnostic buffer interpretation. The same diagnostic message (0x001E) can have multiple causes. Always read the additional text and the associated channel diagnostic (channel number, error type) to distinguish between "missing module", "wrong module", and "station unreachable". See Siemens KB 109479184: "Diagnostic events in S7-1200/1500".
6. PROFINET device name reassignment. When the device returns, do not assume the previously assigned PROFINET device name is intact. Reset the device to factory defaults and re-assign the name using TIA Portal topology editor or via a service tool.

13. Frequently Asked Questions