S7-1200 CPU 1214C Configuration: 4 DI/DQ SMs with CP 1243-7 LTE

1. System Architecture Overview

Designing a SIMATIC S7-1200 station with four 6ES7 221-1BH30-0XB0 (SM 1221, 16 digital inputs @ 24 V DC) modules, three 6ES7 222-1BH30-0XB0 (SM 1222, 16 digital outputs @ 24 V DC) modules, and a CP 1243-7 LTE communications processor requires a CPU that supports at least eight signal-module (SM) slots. The CPU 1214C DC/DC/DC (or DC/DC/Rly) supports exactly one signal board (SB) plus eight signal modules, which is the smallest CPU that fits the seven SMs plus one CP 1243-7 LTE combination requested.

The station is intended for unattended remote operation, so a cellular backhaul is used in place of a fixed LAN. The CP 1243-7 LTE provides an IP-based tunnel that the engineering workstation can use to load STEP 7 projects, run online diagnostics, reach the Web server, and poll the S7 program as if the CPU were on the local network. Refer to the S7-1200 Programmable Controller System Manual (PDF) for the full module catalog and configuration rules.

1.1 Topology Diagram

Figure 1: rack layout from left to right. CPU 1214C occupies slot 0; SM 1221 modules occupy slots 1-4; SM 1222 modules occupy slots 5-7; the CP 1243-7 LTE occupies slot 8. The CP terminates on an LTE/UMTS/GPRS cellular network and exposes the S7-1200 station to a remote engineering station through an OpenVPN or TeleControl Server Basic tunnel.

2. CPU 1214C Selection and Slot Rules

The S7-1200 family defines a strict maximum number of signal modules per CPU. A CPU smaller than 1214C cannot host seven SMs plus a communications processor.

For the requested four SM 1221 plus three SM 1222 plus CP 1243-7 LTE, eight SM slots are required. The CPU 1214C is the lowest-cost CPU that meets the requirement, and 75 KB of work memory is more than enough for typical remote-telemetry programs (count, scale, alarm, log, S7 communication). The 1214C is also available with a relay output variant (6ES7 214-1BG40-0XB0); choose the DC/DC/DC transistor variant when interfacing to 24 V DC loads.

For the new S7-1200 G2 platform, see the SIMATIC S7-1200 G2 product page. G2 CPUs expose different SM limits and firmware; the slot and tunnel rules in this article apply to the classic S7-1200 (firmware V4.x).

3. SM 1221 DI 16x24VDC (6ES7 221-1BH30-0XB0)

The SM 1221 digital input module with order number 6ES7 221-1BH30-0XB0 provides 16 sinking/sourcing 24 V DC inputs organized in two groups of eight. The four modules requested therefore contribute 64 isolated digital inputs.

Each input requires a 24 V source; the module's two groups can be wired either as PNP (sourcing) sensors to a common 24 V return or as NPN sensors with a 0 V common. The default project setting in TIA Portal is PNP (type 1 according to IEC 61131-2). To toggle, open Device view > SM 1221 properties > Digital inputs > Input filter.

4. SM 1222 DQ 16x24VDC (6ES7 222-1BH30-0XB0)

The SM 1222 transistor output module with order number 6ES7 222-1BH30-0XB0 delivers 16 sourcing 24 V DC outputs rated at 0.5 A each, organized in two groups of eight. Three modules therefore contribute 48 outputs, 24 A of switched load capacity in total per module group, and 1 A continuous per output.

For inductive loads such as solenoid valves or DC contactors, install a flyback diode (1N4007 or equivalent) directly across the coil, reverse-biased with respect to the 24 V supply. This both protects the output transistor and extends its life.

5. I/O Address Map and Process Image

The S7-1200 allocates I/O addresses automatically when modules are placed in the device view of TIA Portal, but the engineer should understand the address map for program design, HMI tag mapping, and process-image optimization.

Total points used:

• Digital inputs: 14 onboard + 64 SM = 78 DI (8 DI reserved in process image for SM slot alignment)
• Digital outputs: 10 onboard + 48 SM = 58 DO

The CPU 1214C supports a process image of 1024 bytes for inputs and 1024 bytes for outputs. The configuration above uses 11 bytes of inputs and 9 bytes of outputs, leaving substantial headroom. The CP 1243-7 LTE does not consume process-image space; it reports diagnostics only via the standard diagnostic buffer and the web server.

6. Power Budget Calculation

Each S7-1200 SM draws its internal logic current from the 5 V backplane that the CPU supplies. The CPU 1214C budget is 1600 mA on 5 V. The 24 V sensor and actuator current comes from the user's 24 V supply, not from the CPU.

The 5 V budget is satisfied. The 24 V supply that feeds the inputs and the loads must be sized separately. As a worst case for 24 V sizing, with all 64 inputs energized at 7 mA each and all 48 outputs at 0.5 A each (24 A continuous total - which exceeds practical duty), the field current dominates by an order of magnitude. Specify a 24 V, 10 A SITOP or equivalent and verify the inrush of any DC loads.

6.1 24 V Sensor and Load Supply

Formulae for sizing the 24 V supply:

• Input hold current: I_in_total = N_DI * 7 mA
• Output load current: I_out_total = sum(I_load_i)
• Sensor supply margin: I_margin = 1.25 * (I_in_total + I_out_total)

For the worst case of 64 inputs and 48 outputs at average 0.2 A per output, the field-side requirement is roughly 1.25 * (0.45 A + 9.6 A) = 12.6 A. A 10 A supply is acceptable if real load duty is below 0.18 A per output; otherwise step to 20 A. Confirm by reading the connected device datasheets.

7. CP 1243-7 LTE Communication Processor

The CP 1243-7 LTE (order number 6GK7 243-7FX30-0XE0) is the S7-1200 communications processor that provides IP connectivity over LTE / UMTS / GSM / GPRS. It is inserted as a standard signal module in any open SM slot, but it does not occupy a process-image area; instead it acts as a router on the CPU's PROFINET interface.

Reference the S7-1200 device configuration documentation for slot rules, and the CP 1243-7 LTE operating instructions for SIM handling, APN setup, and security policy guidance.

8. Remote Programming and Diagnostics over LTE

The question "can I access the CPU program, diagnostic and everything like using a local LAN connection?" is answered yes, but the path is the cellular tunnel, not a direct Ethernet cable. The CP 1243-7 LTE supports two main remote-access patterns.

8.1 Pattern A: OpenVPN Tunnel (recommended)

The CP 1243-7 LTE runs an OpenVPN client that connects to an OpenVPN server on the engineering side - typically a SCALANCE M876 or any Linux/Windows host running OpenVPN 2.4+. Once the tunnel is up, the S7-1200 station is reachable on a virtual subnet, and TIA Portal can use the CPU's PROFINET interface as if it were local.

1. Generate a static.key or PKI certificates for the OpenVPN server and client.
2. In TIA Portal, drag the CP 1243-7 into the device view at slot 8.
3. Open CP 1243-7 properties > VPN > OpenVPN and set the role to Client.
4. Import the .ovpn profile or paste the static.key contents into the configuration.
5. Enter the OpenVPN server's public DNS or fixed IP and the listening UDP/TCP port (default 1194/TCP).
6. Assign a virtual IP to the CP (e.g. 10.8.0.2) and to the engineering station (10.8.0.1).
7. Compile and download. The CP dials the APN, establishes the OpenVPN session, and the CPU becomes reachable at its PROFINET IP over the tunnel.

From the engineering station, the following tools work over the tunnel:

• TIA Portal Online > Go online against the CPU's IP - full program read/write, force table, watch table, trace, online diagnostics.
• Web browser to the CPU's Web server (default 80 / 443) and the CP's Web server (port 80 / 443, separate IP).
• SIMATIC Automation Tool for firmware update and project push.
• WinCC Unified / HMI panel remote commissioning.
• PUTTY / SSH into the CP's management interface (when enabled).

8.2 Pattern B: TeleControl Server Basic

Siemens TeleControl Server Basic (TCSB) is a Windows-based OPC UA server that aggregates remote S7-1200 stations. Each CP 1243-7 LTE acts as a TCSB agent and reports tags on a schedule or on change. TCSB is more appropriate for SCADA telemetry than for full program downloads; it is best deployed when the application primarily reads process values and writes set points.

1. Install TCSB on a Windows server reachable from the public internet.
2. In the CP's TIA Portal configuration, enable Telecontrol > TeleControl Server Basic.
3. Enter the TCSB server address, project number, station number, and a 32-byte PSK.
4. Define the data points (process tags) and their send cycle / trigger conditions.
5. Compile and download the CP. The CP dials the APN, opens a TLS-protected session to TCSB, and pushes the configured tags.

8.3 What Works Locally vs. What Works Remotely

9. TIA Portal Project Configuration

The following steps assume TIA Portal V16 / V17 / V18 with HSP 0286 or later installed so the SM 1221 -1BH30-, SM 1222 -1BH30-, and CP 1243-7 LTE -7FX30- are present in the hardware catalog.

9.1 Create the Project and Add the CPU

1. Launch TIA Portal and select Create new project. Name it (e.g. RTU_S7_1200_v01).
2. Open Add new device > SIMATIC S7-1200 > CPU > CPU 1214C DC/DC/DC > 6ES7 214-1AG40-0XB0. Pick the firmware version that matches the physical CPU (e.g. V4.4 or V4.5).
3. In Device view, confirm that the PROFINET interface is configured with an IP, e.g. 192.168.0.10 / 255.255.255.0, and that the CPU is the IO controller.

9.2 Insert the Signal Modules

1. Open the hardware catalog and navigate to SM 1221 > DI 16x24V (6ES7 221-1BH30-0XB0). Drag four instances into slots 1 through 4 of the device view.
2. Open the catalog under SM 1222 > DQ 16x24V (6ES7 222-1BH30-0XB0) and drag three instances into slots 5 through 7.
3. For each module, set the input filter (SM 1221) and the output reaction to CPU stop (SM 1222: Keep last value or Substitute a value).

9.3 Insert the CP 1243-7 LTE

1. Navigate to Communication modules > CP 1243-7 LTE and place it in slot 8.
2. Open CP 1243-7 properties and configure the following tabs:

• Ethernet interface: assign a separate subnet IP for the CP, e.g. 192.168.1.10, or leave IP routing through the CPU interface.
• Mobile network: enter the APN provided by the M2M SIM operator, the SIM PIN, and the authentication method (PAP/CHAP/none).
• Time: enable NTP and point to a public NTP server (or the engineering station).
• Security > Firewall: restrict inbound traffic to OpenVPN UDP 1194 and S7 102 by default. Drop everything else.
• VPN: choose OpenVPN, import the client profile, and set the keep-alive interval to 30 s.
• Telecontrol (optional): if TCSB is used, fill the server address, project, and PSK.

9.4 Define the S7 Routing Path

For TIA Portal to reach the CPU over the OpenVPN tunnel, the S7 route must pass through the CP. In Online > Accessible nodes, TIA Portal will list both the CPU PROFINET IP and the CP virtual IP. Right-click the CPU and select Assign PG/PC interface, then use the OpenVPN virtual NIC as the S7 route.

10. Commissioning and Verification

Before energizing the field wiring, perform a staged verification.

1. Mechanical check: confirm the CPU, four SM 1221, three SM 1222, and CP 1243-7 are latched into the DIN rail and the bus connectors are fully seated. The maximum station width is roughly 600 mm for this layout.
2. Wiring check: torque every terminal to 0.6 Nm. Verify shield continuity and that no 230 V runs in the same duct as the 24 V signal cable.
3. Power-on, no load: apply 24 V to the CPU and observe the LEDs. CPU: STOP (yellow), ERROR (off). CP: RN (off until SIM inserted). All SM LEDs: PWR (green), ERROR (off).
4. SIM and APN: insert a working M2M SIM into the CP. After ~30 s the CP's RN LED should go green solid, indicating LTE/UMTS attached. The SIG LEDs indicate signal strength: 1 LED marginal, 4 LEDs excellent.
5. OpenVPN bring-up: check the CP's Web server at https://<CP-IP>. The VPN status page should show Connected with the assigned virtual IP.
6. Online connection: from the engineering station, open TIA Portal and run Online > Accessible nodes. The CPU should appear with its PROFINET IP. Click Go online and verify the project name and the cycle time.
7. Force table test: write a single DI bit and verify the input LED on the corresponding SM 1221. Then force a single DO bit and verify the output LED on the corresponding SM 1222 and the actual load.
8. Diagnostic buffer: empty the buffer, then re-run the test sequence. The buffer should be clean of hardware faults.
9. Watch table: add a tag from each SM and a tag for the CP's online status. Leave the watch table open for 24 h and verify the CP keeps the tunnel up through any APN dropouts (the CP will redial within ~30 s).

11. Troubleshooting Matrix

12. Field-Proven Caveats

• Slot numbering in TIA Portal is rigid: dragging a module into slot 8 forces a renumbering of all later slots. Always start the layout with the CPU in slot 0, then add SMs left to right.
• The CP 1243-7 LTE does not pass LLDP; if the PROFINET topology view shows the CP as a "neighbor" rather than a "device," that is expected. The CP sits behind the CPU's PROFINET interface and acts as an IP router.
• Firmware V4.2 of the S7-1200 CPU has known issues with certain OpenVPN key lengths; upgrade to V4.4 or later to avoid intermittent tunnel re-key failures.
• If you co-locate the LTE antenna next to a 24 V switching power supply, expect VSWR drift under load. Move the antenna at least 50 cm from the supply's switching magnetics.
• The CP 1243-7 LTE does not support NAT loopback. Test the OpenVPN server from a separate internet connection before commissioning the remote site.
• For S7 routing through the CP, enable the S7 communication load on the CPU: CPU properties > Communication > S7 communication > Permit. Without this, the S7 PUT/GET traffic is blocked by default on firmware V4.x.

FAQ