Configuring Out-of-Range Alarms on S7-300 AI Modules

Overview

Out-of-range detection on SIMATIC S7 analog input modules differs fundamentally from the Allen-Bradley/Rockwell approach. Logix controllers expose boolean tags such as CH1_Underrange and CH1_Overrange directly on the analog module, allowing structured tag-based alarming. SIMATIC S7-300/400 modules split behavior into two classes:

• Modules without diagnostic interrupts — e.g., SM 331 AI8×13Bit (6ES7 331-1KF02-0AB0). Wire break, overrange, and underrange are not signaled; the only available mechanism is software threshold comparison on the raw input word (PIW).
• Modules with diagnostic interrupts — e.g., SM 331 AI8×12Bit (6ES7 331-7KF02-0AB0) and AI8×14Bit (6ES7 331-7NF00-0AB0). Hardware interrupt OB40 is generated on configured limits; diagnostic events are read with SFC 51 (RDSYSST) or SFC 59 (RD_REC).

This reference covers both paths: a portable threshold-detection FC for any S7-300 AI module, and the diagnostic interrupt path for modules that support it. It also bridges to S7-1200/1500 TIA Portal IN_Range/OUT_Range instructions and the diagnostic alarm system documented in the TIA Portal manual collection.

Problem: 13-Bit AI Module Has No Out-of-Range Tag

The SM 331 AI8×13Bit is one of the most common S7-300 analog modules in legacy plants. It offers eight differential inputs in four channel groups, 13-bit resolution, and supports voltage, current (4–20 mA), RTD, and thermocouple types. It does not support:

• Hardware interrupts (no OB40 call on limit violation)
• Diagnostic interrupts (no OB82 call on wire break, overrange, underrange)
• Channel-status tag exposed to the user program

The only signal available is the 16-bit raw process input word PIW. When a 4–20 mA sensor disconnects, the input does not return a clean “0 mA” value; the floating input drives the ADC to an out-of-nominal value (typically negative or at the upper saturation rail). Reading PIW online and physically disconnecting the sensor reveals the failure-mode value, which is the basis of the threshold technique.

Solution 1: Threshold Comparison FC (Any AI Module)

A reusable FC polls PIW for each channel and trips an alarm bit when the raw value falls outside the configured band. This method works on every S7-300 AI module — including 13-bit — with no diagnostic configuration required.

Step 1: Identify the Raw-Value Failure Thresholds

Place the CPU in RUN, open the variable table (VAT) for the AI module, disconnect each sensor, and record the observed PIW. Typical values for a 4–20 mA AI8×13Bit:

The exact PIW value is module-revision dependent; the S7-300 analog value representation is documented in the Siemens Industry Online Support portal under “Analog value representation for SIMATIC S7-300 SM 331/332/334”.

Step 2: Build the FC

Create a standard FC (e.g., FC100 “AI_RANGE_CHECK”) with the following interface:

ST source for FC100:

FUNCTION FC100 : VOID
VAR_INPUT
    i_PIW     : INT;
    i_LowLim  : INT;
    i_HighLim : INT;
END_VAR
VAR_OUTPUT
    o_InRange : BOOL;
    o_Alarm   : BOOL;
END_VAR
BEGIN
    IF (i_PIW >= i_LowLim) AND (i_PIW <= i_HighLim) THEN
        o_InRange := TRUE;
        o_Alarm   := FALSE;
    ELSE
        o_InRange := FALSE;
        o_Alarm   := TRUE;
    END_IF;
END_FUNCTION

Step 3: Call FC100 in OB1

// Channel 0 of AI8 in slot 4: PIW 288
CALL FC100
    i_PIW     := PIW288,
    i_LowLim  := -1000,    // below 4 mA or wire break
    i_HighLim := 29000,    // above 20 mA overrange
    o_InRange := M100.0,   // OK flag for HMI
    o_Alarm   := M100.1;   // OOR alarm for SCADA

Solution 2: Hardware Interrupt OB40 (Diagnostic-Capable Modules)

For SM 331 modules that support hardware interrupts (AI8×12Bit, AI8×14Bit, AI8×RTD×16Bit), configure the low and high limits in the hardware configuration. STEP 7 / TIA Portal then automatically calls OB40 when a configured limit is violated.

Step 1: Enable Hardware Interrupt in HW Config

1. Open the S7 project in STEP 7 (Classic) or TIA Portal.
2. Open the AI module in the device view and select Inputs tab.
3. For each channel set “Enable” on Hardware Interrupt Low Limit and Hardware Interrupt High Limit.
4. Enter the engineering-unit or raw limits depending on module firmware. Modern firmware accepts engineering units directly when the measurement type is selected.
5. Download the hardware configuration to the CPU.

Step 2: Implement OB40

OB40 receives the start information telling you which module and channel triggered the interrupt. The diagnostic information is in the temporary local variables (L-byte 8–26) or in the input area of the OB.

ORGANIZATION_BLOCK OB40
VAR_TEMP
    OB40_EV_CLASS   : BYTE;
    OB40_STRT_INF   : BYTE;
    OB40_PRIO       : BYTE;
    OB40_OB_NUMBR   : BYTE;
    OB40_RESERVED_1 : BYTE;
    OB40_IO_FLAG    : BYTE;
    OB40_MDL_ADDR   : WORD;
    OB40_POINT_ADDR : DWORD;
    OB40_FLT_ID     : BYTE;
    OB40_ALARM_TYPE : BYTE;
END_VAR
BEGIN
    // OB40_MDL_ADDR = logical base address of the AI module
    // OB40_POINT_ADDR bits identify the channel that fired
    IF OB40_MDL_ADDR = W#16#120 THEN  // AI base address example
        // Set HMI flag for "channel X out of range"
        M110.0 := TRUE;
    END_IF;
END_ORGANIZATION_BLOCK

This event-driven approach eliminates the constant scan needed by Solution 1 and is the preferred pattern on CPU 314C/315/317 with diagnostic-capable SM 331 modules.

Solution 3: SFC Diagnostics on Modules with Diagnostic Interrupt

Diagnostic-capable AI modules push a diagnostic record into the diagnostic buffer and signal OB82. Use SFC 51 “RDSYSST” to read SSL partial list W#16#00B3 (module diagnostic data, 4-byte records) and SFC 59 “RD_REC” for diagnostic records DS0/DS1.

Diagnostic Error Codes for SM 331 AI (Excerpt)

For S7-1500 motion/cam error IDs the range 16#80A0–16#80AF applies to synchronous-position errors per the Siemens SIMATIC S7-1500 error-ID reference; the analog-input error codes above are the ones relevant to AI module diagnostics.

SFC 51 Example — Read Module Status

// Read SSL list W#16#00B4 (module status)
CALL SFC 51
    REQ     := M120.0,         // one-shot trigger
    SZL_ID  := W#16#00B4,
    INDEX   := W#16#0000,
    RET_VAL := MW122,
    BUSY    := M124.0,
    SZL_HEADER := LW126,
    SZL_DATA   := LW128;
// Evaluate SZL_DATA channel error bits

Comparison: S7-300 vs S7-1200/1500 Out-of-Range Handling

On S7-1200/1500 the comparison logic is exposed as ladder/FBD instructions: IN_Range returns TRUE when a value lies between MIN and MAX, OUT_Range returns TRUE when it lies outside, and the OK/NOT_OK variant combines validity and range. See the TIA Portal diagnostic-alarm documentation for the full instruction set.

Engineering-Unit Limit FC (Optional Layer)

After the OOR check, scale the raw value and apply engineering-unit limits. This adds a second tier of alarms for process reasons (e.g., tank level above setpoint) that are independent of sensor health.

// FC101 - Engineering-unit OOR after FC105 scale
// Inputs: r_Scaled (REAL), r_LowEU, r_HighEU
// Outputs: o_HiHi, o_Hi, o_Lo, o_LoLo (BOOL)
IF r_Scaled >= r_HighEU THEN o_HiHi := TRUE; END_IF;\code>

This two-layer structure is the standard practice: raw threshold = sensor health, engineering unit limit = process state. Plant HMI systems often display the two alarm classes with different colors and priorities, mirroring the standard ISA-18.2 alarm-philosophy pattern.

Verification and Commissioning

1. Sensor disconnect test. With the program running and a VAT online, pull each sensor. Verify that the OOR alarm bit sets within one OB1 cycle and the HMI tag turns red.
2. Overrange test. Inject a current >20 mA (or voltage >range max) with a calibrator. Confirm alarm at the high threshold.
3. Underrange test. Inject a current <4 mA (or 0 mA on a 4–20 mA loop). Confirm alarm at the low threshold.
4. OB40 verification. On diagnostic-capable modules, trigger a limit event and watch the CPU diagnostic buffer (online > PLC > Module Information > Diagnostic Buffer). Verify OB40 is called and the alarm flag is set.
5. Diagnostic buffer test. Force a wire break and verify OB82 is called; read the diagnostic record via SFC 51 and confirm the channel error code 16#0006 or 16#0007 appears.
6. Recovery test. Restore the sensor signal; verify the OOR alarm clears and no latched bits remain in the M or DB flag area.

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

• Channel group sharing. SM 331 AI8×13Bit groups channels 0+1, 2+3, 4+5, 6+7. Each group shares a reference ground. A bad group common can cause correlated false OOR alarms on both channels of a pair; check the group jumper when two channels fail together.
• RTD vs current on the same module. A 4-wire RTD channel used as a current input will not produce a wire-break signature that matches the current-input case. Always verify the raw-value signature on the actual configured measurement type.
• Diagnostic interrupt flooding. A loose sensor on a diagnostic-capable module can call OB82 thousands of times per second. Implement a debounce in OB82 (set/reset a debounce timer) to avoid CPU scan-time spikes.
• Eng-units-only limit calls. Engineers familiar with Logix CH1_Overrange sometimes apply engineering-unit comparisons (e.g., > 50.0 °C) to detect wire break. This fails because the scaled value clamps; the raw-value check is mandatory.

FAQ