Changing ET200MP AQ4 Channel Type Online via WRREC on S7-1500

1. Problem Overview

An S7-1500 CPU controlling a continuous process needs to reconfigure an analog output channel on a remote ET 200MP station without taking the CPU out of RUN. Specifically, the application must switch one or more channels of an AQ 4xU/I ST module (Siemens article number 6ES7532-5HD00-0AB0) from the voltage range 0…10 V to the current range 4…20 mA while the plant is live. Because the standard "Download to device" workflow for hardware configuration forces the CPU to STOP on a stand-alone S7-1500, a different mechanism is required: the user must write the new parameter assignment directly to the module at runtime using the WRREC instruction and the module's parameter data record 128.

The same mechanism applies to ET 200MP AI modules when enabling additional diagnostics such as the Quality Information (QI) bit on each channel of the AI 8xU/I/RTD/TC ST (6ES7531-7KF00-0AB0). All analog input and output parameter sets in the ET 200MP family can be reassigned in RUN through record-based writes; the CPU never has to leave RUN mode.

2. Module Identification and Prerequisites

Confirm the exact hardware before writing any record. The source application contains:

Check the firmware of the IM 155-5 PN ST and of the AQ module. The WRREC runtime parameter write is supported by all ET 200MP analog modules with firmware ≥ V1.0 and is documented in the SIMATIC ET 200MP Manual Collection.

Required tools and libraries:

• TIA Portal V16 or later (V17 recommended for firmware ≥ V4.2 modules).
• STEP 7 Professional or TIA Portal Basic with the S7-1500 hardware support package installed.
• The WRREC instruction (built-in, no library required) or SFB53 in legacy blocks.
• For PLCSIM testing: PLCSIM V18 or PLCSIM Advanced ≥ V3.0.
• Online access to the S7-1500 over PROFINET (the same network used by the ET 200MP station).

3. How Siemens ET 200MP Handles Online Parameter Changes

ET 200MP analog I/O modules store their channel parameters in record 128. There are two ways for the CPU to push a parameter set into a module:

1. Project download (HW Config): When the project is compiled and downloaded, the engineering station writes record 128 to the module during the connection establishment. This is what triggers the STOP transition on an S7-1500 with a stand-alone (non-redundant) CPU.
2. Runtime write via WRREC: The user program issues a write to record 128 at any time. The module validates the record, applies it on the fly, and reports the result back through the STATUS, DONE, and ERROR outputs of the instruction. The CPU stays in RUN.

Both paths use the same byte layout. The runtime path simply decouples the write from the project download. This is exactly the same mechanism that engineering tools such as the TIA Portal "Assign PROFINET device name" or "Online > Parameter assignment of modules" use internally when "Apply in RUN" is selected.

4. WRREC Instruction Reference

On the S7-1500, WRREC is available as a multi-instance-capable instruction under Instructions > Basic Instructions > Extended instructions > Distributed I/O > WRREC. Its formal interface:

The hardware identifier for the slot is found in TIA Portal under Devices & networks > ET 200MP > AQ 4xU/I ST > Properties > System constants. The value is typically of the form 268...272 for slot 6 of head module 0. Always use the symbolic constant from the project (for example, "AQ4xUI_1") so that the program survives hardware re-numbering.

5. Data Record 128 Structure for AQ 4xU/I ST

Record 128 for the AQ 4xU/I ST follows the standard Siemens parameter record layout documented on page 2466 (parameter record header) and the channel-parameter definitions on page 2670 of the SIMATIC ET 200MP Manual Collection. The complete layout for the four-channel parameter set is:

Header (bytes 0…1): These bytes define the layout of the parameter record. The most common values used by ET 200MP analog modules are:

• Byte 0 = 16#00 — reserved/format identifier (parameter record, channel-oriented).
• Byte 1 = 16#10 — length spec (16 parameter data bytes follow the header, covering 4 channels of 4 bytes each).

Refer to page 2466 of the manual for the exact bit-level definition. The values above match the structure that the project download uses for the same module and are therefore accepted by the module at runtime.

Channel parameter record (each 4 bytes):

For example, switching channel 0 from 0…10 V to 4…20 mA with wire-break diagnostics enabled produces the byte 16#0B = 0000 1011b (current, 4…20 mA, wire-break enable). Channels that remain at 0…10 V keep 16#00.

6. Step-by-Step Implementation

1. Identify the HW identifier. Open the ET 200MP device in TIA Portal, select the AQ 4xU/I ST slot, switch to Properties > System constants, and copy the symbolic name (e.g. Local~AQ4xUI~HEAD or the numeric value).
2. Declare a global DB for the parameter record. Create a data block DB_AQ_Params with an array of bytes of length 19. Mark the array with the {S7_string = '...'} attribute or use a PLC data type so that the byte order is consistent at compile time.
3. Initialize the header. Pre-load bytes 0 and 1 with 16#00 and 16#10 in the startup OB or in the first scan of OB1.
4. Build the per-channel parameter bytes. For each channel, set the byte value matching the desired output type and range. Leave substitute-value bytes at 16#00 unless the application needs specific STOP-state behavior.
5. Trigger the write. Use a one-shot edge of a boolean tag (for example, "cmdApplyAQRange") to start the WRREC call. Pass the data block slice as the RECORD parameter and 19 as LEN.
6. Monitor the result. Evaluate DONE, ERROR, and STATUS. Store the STATUS word in a diagnostics tag so that any rejection can be analyzed in HMI or in the TIA Portal watch table.
7. Re-arm the trigger. Reset the trigger tag once BUSY goes low.
8. Validate the output. Read back record 128 with RDREC if the application needs confirmation; otherwise, monitor the analog value in the I/O image.

7. Sample SCL Implementation

The following SCL block demonstrates a complete WRREC wrapper that builds the parameter record and writes it in RUN. Save as FB_AQ_RangeSwitch in the S7-1500 program and call it from OB1 or from an HMI-triggered FC.

FUNCTION_BLOCK "FB_AQ_RangeSwitch"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
   VAR_INPUT
      i_hwAq        : HW_IO;          // HW identifier of the AQ slot
      i_doSwitchCh0 : BOOL;           // TRUE = force ch0 to 4..20 mA
      i_doSwitchCh1 : BOOL;
      i_doSwitchCh2 : BOOL;
      i_doSwitchCh3 : BOOL;
      i_trigger     : BOOL;           // edge-triggered
   END_VAR
   VAR_OUTPUT
      o_busy        : BOOL;
      o_done        : BOOL;
      o_error       : BOOL;
      o_status      : WORD;
   END_VAR
   VAR
      s_aqRecord    : ARRAY[0..18] OF BYTE;
      s_re          : R_TRIG;
      s_wrec        : WRREC;
      s_len         : UDINT := 19;
   END_VAR

BEGIN
   // Header bytes 0..1 (see manual page 2466 of ET 200MP Manual Collection)
   s_aqRecord[0] := 16#00;
   s_aqRecord[1] := 16#10;

   // Channels 0..3: bit pattern 0000 1011 = 16#0B (current, 4..20 mA, wire-break enabled)
   // Voltage / no change = 16#00
   s_aqRecord[2]  := SEL(i_doSwitchCh0 := i_doSwitchCh0, IN0 := 16#00, IN1 := 16#0B);
   s_aqRecord[6]  := SEL(i_doSwitchCh1 := i_doSwitchCh1, IN0 := 16#00, IN1 := 16#0B);
   s_aqRecord[10] := SEL(i_doSwitchCh2 := i_doSwitchCh2, IN0 := 16#00, IN1 := 16#0B);
   s_aqRecord[14] := SEL(i_doSwitchCh3 := i_doSwitchCh3, IN0 := 16#00, IN1 := 16#0B);

   // Bytes 3..5, 7..9, 11..13, 15..17 are per-channel options; leave at 0 for default
   // Byte 18 = module-wide diagnostics / substitute behavior; leave at 16#00
   FOR #i := 0 TO 18 DO
       IF (#i = 3) OR (#i = 4) OR (#i = 5) OR
          (#i = 7) OR (#i = 8) OR (#i = 9) OR
          (#i = 11) OR (#i = 12) OR (#i = 13) OR
          (#i = 15) OR (#i = 16) OR (#i = 17) OR (#i = 18) THEN
          // (left as 16#00 for default behavior)
       END_IF;
   END_FOR;

   s_re(CLK := i_trigger);
   s_wrec(REQ    := s_re.Q,
          ID     := i_hwAq,
          INDEX  := 128,
          LEN    := s_len,
          DONE   => o_done,
          BUSY   => o_busy,
          ERROR  => o_error,
          STATUS => o_status,
          RECORD := s_aqRecord);
END_FUNCTION_BLOCK

8. Verification and Status Codes

After the WRREC call returns, check the result in the following priority order:

1. DONE = 1, ERROR = 0 — write accepted; the module has switched the channel type. Re-read the analog value to confirm scaling.
2. ERROR = 1 — the STATUS word contains the error code. Typical STATUS values for analog I/O modules:

Additional verification on the S7-1500 side:

• Watch table: Insert the module's HW identifier and the parameter DB. After triggering WRREC, force the trigger and observe DONE / ERROR / STATUS.
• Online & Diagnostics: Open the AQ module's online view and inspect the diagnostic buffer. A successful write appends an entry of type “Parameter assignment”.
• Process value check: Read the analog output value (in the I/O image or via RDREC) and confirm it is in the new engineering units.

9. PLCSIM Testing and Field Commissioning

WRREC works inside PLCSIM with the following caveats:

• PLCSIM V18 and newer fully simulate the ET 200MP station including PROFINET. The runtime parameter write to record 128 of an analog module is recognized and reflected in the simulation.
• PLCSIM Advanced (separate installer) is required to simulate an entire ET 200MP head with multiple slots at full speed, especially when the test program uses PROFINET IO updates.
• The HW identifier used inside the simulation must match the identifier that the simulated ET 200MP station exposes. TIA Portal automatically generates the matching identifiers when the project is loaded into the simulated controller.
• PLCSIM does not generate real analog currents; verify only the parameter-record round-trip (write » status » read-back) and the resulting value-in-process-image scaling.

Field commissioning checklist:

1. Back up the current project and note the existing parameter set for each channel.
2. Drive the affected output to a safe value (e.g., 4 mA or 0 mA) before switching range to avoid a transient that could damage the field device.
3. Manually drive the current/voltage at the field terminals with a multimeter to verify the new range after the write completes.
4. Update the STEP 7 hardware configuration to match the new range so that the next project download does not revert the change.
5. Document the runtime change in the plant log: tag, timestamp, status result, operator.

10. Extending the Method to AI 8xU/I/RTD/TC ST

The same WRREC technique applies to the AI 8xU/I/RTD/TC ST when activating the Quality Information (QI) bit per channel. The parameter record for AI modules also uses record 128. With the QI bit enabled, the value status returned in the I/O image reflects validity (good / bad / substitute). This is useful when the process requires explicit bad-quality handling (for example, voting of redundant signals, or interlock logic that must not run on a failed transmitter).

11. Frequently Asked Questions