S7-400 Added I/O Cards: LEDs Light but No Variable Update in VAT

1. Problem Description

A field engineer adds two digital I/O modules to a Siemens SIMATIC S7-400 rack (UR2) in slots 6 and 7 after the existing populated slots. After downloading the new hardware configuration from STEP 7 (Classic V5.x or TIA Portal), the following symptoms are observed:

• Input channel LEDs on the new SM 421 digital input module illuminate correctly when 24 VDC is applied to the field device through the 6ES7921-4AB00-0AA0 front connector.
• The corresponding output LEDs on the SM 422 digital output module do not light, and the field-side terminals show 0 V instead of the expected 24 VDC, even when the output bit is forced ON in a Variable Table (VAT).
• Monitoring the new input addresses (e.g., IB 104, IB 105, IB 106, IB 107) in a VAT displays B#16#00 for all bytes regardless of physical input state.
• Monitoring the Peripheral Input Bytes (e.g., PIB 104 through PIB 107) also returns B#16#00 when checked in online monitor mode during machine operation.
• The pre-existing I/O card in a lower-numbered slot continues to function normally; the new cards alone are non-responsive in software.

2. Why the LED Works but the VAT Shows Zero

The diagnostic approach in STEP 7 distinguishes between two fundamentally different access paths to the same physical I/O point. The relationship between them is the core of this fault.

2.1 Two Access Paths to the Same I/O

For a VAT to display a real-world 24 VDC input state when monitoring IB 104, the CPU must transfer the module's input register into the internal I area at the start of an OB. The peripheral access path (PIB 104) is what confirms whether the module is actually seeing the signal on the backplane.

2.2 Interpreting PIB 104 = B#16#00

When the field engineer reports that PIB 104 through PIB 107 all return B#16#00 while the input LED is on, the I/O bus itself is not delivering the value. This rules out a process-image-update problem (OB1 issue) and points to a backplane or hardware configuration fault. A working module must report its physical state through PIB regardless of OB1 execution.

3. Process Image Partition (PIP) and OB Assignment

The most common software root cause on the S7-400 family is a mismatch between the module's assigned Process Image Partition and the OB that refreshes that partition.

STEP 7 (both Classic and TIA Portal) allows the engineer to assign any digital module to a specific PIP number. The CPU maintains a default PIP 0 that is automatically refreshed by OB1. Modules assigned to PIP 1, 2, 3, ... 15 are only refreshed by the OB whose OBxx priority is configured to update that specific PIP.

3.1 PIP-OB Refresh Matrix

If the new SM 421 and SM 422 modules were placed in a non-zero PIP during a previous engineering session, or if STEP 7 automatically assigned them to a PIP based on a template, the user program must contain the corresponding OB for the I/O to appear in the process image. If that OB is not called, the VAT will read IB x as the last-known value or zero.

4. Root Cause Tree for the Reported Fault

Walking the diagnostic tree against the observed symptoms:

4.1 Symptom 1: Input LED ON, PIB 104 = 0

The I/O bus is not reading the module. Possible causes in priority order:

1. Backplane pin damage on the slot - inspect the UR2 rack backplane connector at slot 6 and slot 7. Bent or oxidized pins on either the rack or the module will prevent the I/O bus handshake. Swap the module to a known-good slot to confirm.
2. Module inserted while CPU is in RUN - S7-400 hot-swap is not supported on standard I/O modules. Hot insertion can leave the module in an undefined state. Power down the rack, re-seat the module firmly, and power up.
3. Hardware configuration not fully downloaded - The HW Config download in STEP 7 must include both the new modules AND the system data. Verify the download via PLC > Download User Program to Memory Card or by checking Accessible Nodes after download.
4. Address conflict - If the new modules were placed at default addresses that overlap with an existing module or with reserved PROFIBUS/PROFINET peripheral area, the CPU may not communicate with the module. Change the module start address in HW Config to an unused area (e.g., 256 and above) and re-download.
5. Module hardware fault - the module itself has failed. Swap with a known-good module to isolate.

4.2 Symptom 2: Output LED OFF, No Field-Side Voltage

The same I/O bus fault that prevents the input module from being read will also prevent the output module from receiving a write. Diagnosis and resolution are identical to Symptom 1.

4.3 Symptom 3: Original Card in Lower Slot Works Correctly

This confirms the CPU, backplane, and STEP 7 project are fundamentally sound. The fault is specific to slots 6 and 7 - pointing to physical slot issues or address assignment for the new modules only.

5. Step-by-Step Resolution Procedure

5.1 Prerequisites

• STEP 7 V5.5 / V5.6 (Classic) or TIA Portal V16-V20 with the S7-400 HSP installed
• Online connection to the target CPU (MPI, PROFIBUS, or Industrial Ethernet)
• STEP 7 PLCsim license (recommended for offline verification)
• One spare digital I/O module of the same type for swap testing
• The S7-400 module data manual: S7-400 Module Data Reference (PDF)

5.2 Procedure

1. Open the project in STEP 7 and navigate to HW Config. Confirm both new modules are present in slots 6 and 7 with the correct order numbers. Reference the S7-400 Hardware and Installation Manual (PDF) for the valid slot assignments of the UR2 rack. Each UR2 segment supports up to 9 slots; in a fully populated UR2, slots 1-9 are segment 1 and slots 10-18 are segment 2.
2. Double-click each new module and verify the Addresses tab. Confirm the I and Q start addresses do not conflict with any existing module, PROFIBUS DP slave, or PROFINET IO device. If any doubt exists, reassign the start address to a high unused range (e.g., byte 256 or 512) and click OK.
3. Verify the Process Image tab on the module properties. In Classic STEP 7: right-click module > Object Properties > Addresses tab > Process Image section. Confirm the PIP assignment is "OB1-PA-Image (PIP 0)" or "Automatic update of process image". If it shows a non-zero PIP number, change it to 0 unless your program specifically requires a different PIP.
4. Check CPU properties for Process Image size. Open the CPU object > Cycle/Clock Memory tab. The Size of the Process Image field for inputs and outputs determines which address ranges are copied into the I/Q area. If the process image size is set to 4 bytes and the new module is at IB 104, the CPU will never copy bytes 100+ into the process image. Set the size to at least 256 bytes (the S7-400 default) unless memory constraints require otherwise.
5. Re-download the hardware configuration. In HW Config, click the Download to Target System button. Confirm the system data blocks (SDB) are written. The CPU will perform an INIT-class restart after a hardware configuration change in most cases.
6. Power-cycle the S7-400 rack. After HW Config download, perform a complete power-off/power-on cycle on the UR2. This ensures all modules re-enumerate on the I/O bus. Do not rely on a warm restart alone for hardware changes.
7. Test with peripheral access first. Open a VAT in Monitor mode and add both PIB <new start addr> and IB <new start addr>. Apply 24 VDC to a known input channel. PIB must update immediately. If PIB shows 0, the problem is at the bus level - proceed to step 8.
8. Inspect the backplane. Power down. Remove the suspect modules. Visually inspect the rack backplane at slots 6 and 7 with a flashlight and magnifier. Look for bent, recessed, oxidized, or contaminated pins. Clean with isopropyl alcohol and a non-abrasive swab. Re-seat the modules firmly - ensure both top and bottom retaining screws engage with the rack frame.
9. Swap slot positions. Move one of the suspect modules to a slot known to be working (e.g., the slot of the original card, after removing the original). If the moved module now works in the known-good slot, the slot hardware is faulty. If the moved module still does not work, the module itself is faulty.
10. Use PLCsim for code verification. Load the STEP 7 program into a PLCsim instance. In simulation, the PIB values can be forced via the SIM table. If the simulated VAT shows the same fault pattern as the real CPU, the issue is in the STEP 7 project (typically a pointer-based copy that overwrites the I area, or a PIP mismatch). If the simulated VAT works correctly, the issue is hardware on the physical rack.
11. Search for indirect I/O access in the user program. Open the STEP 7 program editor and search for any block that performs a copy or move operation targeting the new module's address range. Common offenders include BLKMOV, FILL, or pointer-based L PIB / T IB sequences. If the user program is writing to IB 104 from a buffer or from a different OB, it will overwrite the process image each cycle. Use Cross References on each new input address to identify all read and write access points.
12. Re-test in VAT. After all corrections, open the VAT, add IB <new addr> in BIN display, force the corresponding physical input, and confirm the bits toggle. Repeat for the output module by forcing QB <new addr> and measuring 24 VDC at the field terminals with a multimeter.

6. UR2 Rack Slot Map and I/O Bus Layout

The S7-400 UR2 rack contains two I/O bus segments separated by an interface gap at the slot containing an IM (Interface Module) receiver. The I/O bus and communication bus are divided into 2 bus segments, each with 9 slots. Per the S7-400 Hardware and Installation Manual (PDF), the standard UR2 layout is:

For a single non-expanded UR2, slots 4 through 11 are valid for I/O modules. Slots 6 and 7 are well within the supported range and should function identically to slot 4 or 5 electrically. The slot number itself is not the issue - the diagnostic must focus on the module's backplane seating and the STEP 7 project configuration.

7. Front Connector Wiring Reference: 6ES7921-4AB00-0AA0

The 6ES7921-4AB00-0AA0 is a 40-pin front connector (screw-type) used with the SIMATIC S7-400 digital I/O modules. The pinout follows the standard 6ES7921 family assignment. Always verify the exact pinout against the wiring diagram in the S7-400 Module Data manual (PDF) for the specific module in use.

A common wiring error on breakout modules is mixing the M (24 VDC return / 0 V) and 24 V (sensor supply) terminals. The breakout is typically labeled:

• 1L+ / 2L+ - 24 VDC sensor/load supply per channel group
• 1M / 2M - 0 V return per channel group
• In 0.0 ... In x.7 - Input channel terminals
• Out 0.0 ... Out x.7 - Output channel terminals

8. Verification Checklist

Confirm each item below after applying the corrective steps:

9. Troubleshooting Matrix

10. PLCsim Diagnostic Method

S7-PLCsim (bundled with STEP 7 Classic, separate in TIA Portal) is the most efficient way to separate software faults from hardware faults. The procedure is:

1. Open the STEP 7 project on an engineering station with PLCsim installed.
2. From the SIMATIC Manager, select Options > Simulate Modules or Start S7-PLCsim.
3. Download the entire STEP 7 project (blocks + system data) to the simulated PLC.
4. Open a VAT, add the new module's IB and PIB addresses, and place the simulation in RUN-P.
5. In the SIM table (PI/QT view), force the simulated input bits and observe the VAT update.
6. If the simulated VAT shows correct updates, the STEP 7 project and program logic are sound; the fault is hardware on the physical rack. If the simulated VAT shows the same fault, the fault is in the project configuration or program code.

11. Common S7-400 I/O Module Order Numbers

Reference list of typical digital I/O modules for the S7-400 family used in the described fault scenario. Always cross-check the exact order number against the S7-400 Module Data manual (PDF).

12. Frequently Asked Questions