S7-1212C Outputs Stop After SM 1223 Expansion Module Added: Field Troubleshooting Reference

1. Problem Statement

A field case describes a SIMATIC S7-1212C AC/DC/Relay CPU (catalog 6ES7212-1BE40-0XB0 or the earlier -1BE31-0XB0 variant) that was operating normally with a KTP400 HMI on PROFINET. An SM 1223 DC/DC signal module (a digital input/output expansion) was mechanically attached to the right side of the CPU and the stack was powered up. The onboard relay outputs Qa.0 through Qa.5 stopped energizing: the green status LEDs on the CPU faceplate did not light, the relay contacts remained open, and no diagnostic event was generated in the TIA Portal diagnostic buffer. The expansion module's own inputs and outputs behaved as expected. The issue was not present before the SM 1223 was installed, and it resolved spontaneously several hours later without deliberate intervention.

This symptom pattern—CPU onboard I/O dead, expansion module healthy, no TIA diagnostic event—is classic for one of three root causes:

1. Hot-plug / live insertion of the expansion module while 24 V backplane power was energized, which the S7-1200 platform does not support.
2. Partial or asynchronous TIA Portal device configuration that left the CPU in a half-configured state until the next bus re-scan.
3. Address collision or I/O remap caused by adding the SM in the device view while the program was still bound to the old address map.

Each cause has a known signature and a known remedy. This reference walks through diagnosis and repair step by step, then layers in the S7-1200 commissioning rules that prevent recurrence.

2. Affected Hardware & Catalog Numbers

Verify the exact catalog number of every component before troubleshooting; the S7-1200 line has gone through multiple firmware generations (V1, V2, V3, V4) and the SM 1223 has transistor and relay output variants that look identical in photos.

Confirm the SM 1223 variant physically attached to the rack. A "DC/DC" description from the user generally indicates the transistor-output version (6ES7223-1BH32-0XB0), which has 8 sinking inputs and 8 sourcing outputs. Confirm by reading the label on the right side of the module and cross-checking the part number in TIA Portal's hardware catalog under DI/DO > SM 1223.

3. Root Cause Analysis Matrix

Map the symptom you see in the field to the most likely root cause using the table below. Use the rightmost column to direct your first diagnostic step.

In the original report, the absence of any TIA diagnostic and the spontaneous recovery is the strongest signal of cause #1: hot-plug transient, sometimes called "bus glitch." When the I/O bus re-initializes correctly on the next power-up, the symptom disappears—hence the "mysterious fix." This is not a fix; it is a coincidence with the bus scan. Treat it as a latent fault.

4. Hot-Plug: Why It Matters on S7-1200

Unlike some modular PLC families (e.g., S7-1500 with selective hot-swap, or some third-party systems), the S7-1200 platform does not support live insertion or removal of signal modules. The backplane bus driver on the CPU 1212C is not designed to negotiate the inrush of a new module while the CPU is actively scanning the I/O bus.

When 24 V is present on the backplane rails (L+ / M at the CPU top terminals, terminal 1L through 4L on the SM 1223) and a module is mechanically snapped onto the bus connector, the following can occur:

• Bus arbitration loss: the CPU's I/O scanner loses sync with the local bus, latches a transient fault, and enters a partial I/O mute state. The CPU continues to run OB1 but stops updating the onboard output process image.
• Latch-up on the SM bus driver: the SM 1223 bus interface IC enters a latched state that requires a hard 24V removal to clear.
• 5V regulator foldback: the CPU's internal 5V rail that powers the bus interface collapses momentarily and the SM module's identification EEPROM read fails, leaving the module in an unidentified state until the next power-on reset.

The expansion module often appears to work because the CPU re-scans and re-initializes it on the next cold start, but the onboard outputs may be stuck in their pre-fault state because the process image was not flushed.

5. Diagnostic Procedure in TIA Portal

1. Open Online & Diagnostics. In the project tree, right-click the CPU 1212C > Online & Diagnostics > connect with the actual CPU's IP/PN name.
2. Read the diagnostic buffer. Diagnostics > Diagnostic buffer. Note timestamps and event IDs. Look for:
   - 0xE002 – Module removed / bus fault
   - 0xE004 – Module does not match configuration
   - 0xE005 – Module detection error / wrong module inserted
   - 0x4300 – Power supply fault on backplane
   - 0x5500 – Configuration error
3. Check the operating mode. Online & Diagnostics > Operating mode. Confirm the CPU is in RUN, not RUN-with-stop or STOP. If the CPU is in STOP, the relay outputs are de-energized by design and the LED indicator RUN/STOP will be flashing (not solid green).
4. Force the outputs from the watch table. Open a watch table, force Qa.0 = TRUE, and watch the process image in the right-hand "Monitor" column. If the process image toggles to 1 but the LED stays dark, the fault is hardware (relay contacts welded open, blown trace, or latched bus driver).
5. Compare device configuration online vs offline. Right-click the CPU > Compare offline/online. A red or yellow delta on the SM 1223 slot means the online hardware does not match the configured module. Download the hardware configuration to bring them in sync.
6. Inspect the power budget. In the device view, click on the CPU and open the System diagnostics > Power budget tab (or read the values from the S7-1200 system manual power budget table). Each SM has a 5V backplane draw and a 24V sensor draw. If the cumulative draw exceeds the CPU's 5V budget (CPU 1212C supplies 1600 mA at 5V backplane to all right-side modules), the CPU will shut down the bus and quietly mute outputs.

6. Step-by-Step Resolution

Execute the following sequence. Do not skip the power-down; the most common repeat-fault pattern is an engineer "fixing" the configuration while power is still applied.

1. Document the current state. Capture the online diagnostic buffer, the device configuration, and a photo of the wiring. This baseline lets you confirm the fix and protects the next shift.
2. Stop the CPU and remove all power. Open the disconnect on the 24V supply and the AC mains. Wait at least 30 seconds for the internal 5V rail to bleed down.
3. Physically inspect the SM 1223. Confirm it is fully seated on the bus connector and the bus connector is fully seated into the CPU. Look for bent pins, missing screws on the shield tab, or any sign of arcing on the SM 1223's top terminal block.
4. Verify the 24V supply capacity. The 24V rail feeding the SM 1223 must support its sensor current (8 inputs × 5 mA typ. = 40 mA) plus any sourcing-output loads. If you are using the same 24V rail for relay coil return paths, sum the worst-case load and derate the supply by 25%.
5. Power up in stages. Apply 24V, wait 5 seconds, then apply mains. Watch the CPU's status LED sequence: STOP > RUN. The SM 1223's DIAG LED should be off after a successful initialization.
6. Download the hardware configuration. In TIA Portal, drag the SM 1223 from the hardware catalog into the correct slot in the device view, then select Hardware (rebuild all) and download to the device.
7. Compile and download the software. Any address shifts in the process image caused by adding the SM 1223 must be reflected in the program. Recompile the blocks and download to the CPU.
8. Test the onboard outputs from a watch table. Force Qa.0 = 1, then 0, then 1. The relay must click and the LED must illuminate in sync. If it does not, see Section 9.

7. TIA Portal Device Configuration Reference

The expansion module must be present in the device configuration, not just on the physical rack. TIA Portal only allocates process image addresses and only initializes the bus driver for modules that exist in the device view.

To verify, open the device view, and in the Device overview tab the slot graphic should show the CPU 1212C in slot 0 and the SM 1223 in slot 1 (or slot 2 if a signal board is also installed). The I and Q address columns should show the correct byte ranges. Typical addressing for CPU 1212C + SM 1223 (8 DI / 8 DO):

If your program referenced QW2 thinking it was an onboard output and the SM 1223 consumed that address, you will see exactly the symptom described: the output bit flips in the process image, but the relay on the CPU faceplate never energizes because that address now belongs to a transistor output on the SM. Re-map the program to the correct address range after a clean compile.

8. Power Budget Rules

Each S7-1200 CPU publishes a power budget for the right-side signal modules. The CPU 1212C supplies a fixed 5V current to the backplane plus a 24V current to the sensor supply terminals. Each SM 1223 has a 5V draw (typically around 70 mA for the 8 DI / 8 DO transistor version) and a 24V sensor current draw (a few tens of mA at idle, more with all inputs energized).

Cross-check the exact values against the S7-1200 system manual power budget table for your firmware generation (V3 vs V4). The system manual is the only authoritative source; do not rely on memory or on the values printed on the box. Find the current manual at Siemens Industry Online Support by searching "S7-1200 system manual." If the SM 1223's 5V draw plus the draw of any other SM on the rack exceeds the CPU's budget, the CPU will silently drop the offending module—and in extreme cases, the onboard outputs will be affected because the internal regulator foldback pulls the whole bus down.

9. Hardware Verification After a Suspected Hot-Plug Event

If you suspect a hot-plug event damaged the CPU, run through this checklist before trusting the system.

1. Power-down / power-up cycle. Remove all power for at least 60 seconds. Re-apply mains first, then 24V. Observe the LED sequence on the CPU: STOP (solid green) → RUN (solid green) without intermediate red flashes.
2. Cycle the SM 1223 only. With the CPU in STOP, remove the 24V rail from the SM 1223's 1L terminal, wait 10 seconds, re-apply. The SM should re-initialize without a CPU fault.
3. Measure relay contact resistance. With the output forced ON from the watch table, measure across the relay contact with a multimeter. Expect < 50 mΩ for a healthy contact. Higher readings indicate contact welding or carbon tracking.
4. Check for diagnostic event recurrence. Leave the CPU online for 10 minutes in RUN. Re-read the diagnostic buffer. Any 0xE0xx or 0x4xxx event re-appearing points to a marginal hardware fault that will return.
5. Test all six onboard outputs. Force each Qa.0 through Qa.5 ON for 5 seconds, then OFF. Listen for a clean relay click and watch for the LED. A "stuck" relay that does not click on any of the six points to a CPU faceplate failure requiring RMA.
6. Verify HMI communication is still active. If the KTP400 was using PROFINET to read Q outputs from the CPU, confirm the HMI tag is updating. A silent HMI tag combined with dead outputs suggests the CPU entered a more severe fault state than initially apparent.

10. Mechanical & Wiring Best Practices

Most repeat-failures on S7-1200 stacks come from one of three installation sins. Address these proactively.

1. Bus connector seating. The flex bus connector ships tucked into the left side of the SM 1223. It must be slid out and into the CPU's bus connector pocket before the SM is snapped onto the DIN rail. A half-seated bus connector is the most common cause of intermittent I/O loss on stacked S7-1200 systems.
2. Shield grounding. The SM 1223 has a shield tab on the bottom. Run a 10 AWG (6 mm²) bonding wire from this tab to the cabinet ground bar. Without it, the SM can inject noise into the backplane that the CPU reads as a bus error and responds to by halting output updates.
3. 24V distribution. Do not daisy-chain 24V from the CPU's sensor supply to the SM 1223's 1L terminal and then onward to field devices. The voltage drop across a long daisy chain can drag the SM's sensor voltage below the 20.4V minimum and trigger a brownout event that the CPU reports as a module fault.

11. S7-1200 Topology Reference (SVG)

Use the diagram below to verify the physical stack order. Power flow runs from left to right; communications backplane runs from right to left into the CPU.

12. Verification & Commissioning Checklist

Sign off each row before returning the panel to production. Save the signed PDF to the project folder.

13. Related Diagnostic Event IDs

When the diagnostic buffer does fire (which it did not in the original report, but may in adjacent failure modes), these are the most relevant event IDs to map against the S7-1200 system manual:

14. Frequently Asked Questions