Configuring S7-1200 I-Device Analog Readings in TIA Portal

Overview

When a Siemens S7-1200 acts as a PROFINET I-device, the higher-level IO controller reads its inputs and writes its outputs through configured transfer areas. Digital signals travel through transfer areas without complication because the controller and I-device exchange them as packed bytes and the user program picks out individual bits with operand qualifiers such as I0.0 or Q1.5. Analog signals are different: every channel occupies a full 16-bit input word (IW) or output word (QW). The same transfer area that carries 512 bytes of digital I/O will not automatically route an analog value from an SM 1231 to the controller unless the word addresses of the SM 1231 actually fall inside the configured transfer range, and the controller program reads those words by name.

The classic symptom reported by integrators is: "Digital I/O works across the I-device, but analog readings show 0 or 32767." This is almost always a transfer-area sizing and alignment issue, sometimes combined with an analog module not being detected, a wire break on 4-20 mA, or the wrong measuring range selected in the module configuration. This guide explains the PROFINET I-device data flow for analog signals, walks through the configuration in TIA Portal V17/V18, shows SCL code for scaling raw values into engineering units, and ends with a troubleshooting matrix that maps each symptom to its likely root cause.

Prerequisites

• Two S7-1200 CPUs with PROFINET interface (CPU 1211C, 1212C, 1214C, 1215C, 1217C, including F variants). A second PROFINET port is required on the I-device only if you also need a separate network for HMI or PG access.
• TIA Portal V17 Update 4 or newer. V18 and V19 are supported; older V15/V16 projects can still be opened but may lose features when re-saved and re-compiled.
• Firmware V4.4 or higher on both CPUs. PROFINET I-device mode with up to 16 transfer-area slots requires V4.2 minimum; firmware V4.5 added the "Substitute value behavior" and "Real time setting" options for transfer areas.
• SM 1231, SM 1232, SM 1234 signal module, or SB 1231, SB 1232 signal board installed in the I-device CPU.
• Both CPU projects present in the same TIA Portal project (recommended for I-device mode) so TIA can auto-generate the device description. Cross-project I-device coupling is possible but requires exporting and importing GSDML.
• Sensor wiring completed and verified with a multimeter before PLC configuration. Voltage ranges above 24 V applied to a current input, or a 4-20 mA loop powered without a return path, are the most common field-side faults.

S7-1200 Analog Hardware Selection

The analog I/O available for the S7-1200 family falls into three categories: signal modules (SM) that mount on the right side of the CPU, signal boards (SB) that plug into the top of the CPU, and integrated analog inputs on certain CPUs (CPU 1214C, 1215C, 1217C have two AI each at IW0/IW2). The SM 1231 and SM 1232 provide the highest channel density and best accuracy.

PROFINET I-Device Concept and Data Flow

A PROFINET I-device is a station that exposes a PROFINET interface so a higher-level IO controller can read its inputs and write its outputs, while the I-device still runs its own program and may also act as an IO controller for its own lower-level devices. The S7-1200 supports this dual role on its onboard PROFINET port (and on the second port of CPU 1214C/1215C/1217C). The data exchanged with the IO controller is divided into transfer areas, each defined by:

• Direction — input area (data sent from I-device to IO controller) or output area (data sent from IO controller to I-device).
• Start address in the I-device's process image.
• Length in bytes (1 to 1024 bytes per area, up to 1024 total across all areas; firmware V4.4+ supports 16 areas).
• Consistency — "Total length" is required for analog words and any structure larger than 4 bytes.

Each transfer area becomes a slot in the I-device's PROFINET interface when the IO controller drags it into its device view. From the IO controller's perspective, a transfer area of 8 bytes for input data appears as 4 input words starting at the address shown in the I-device slot properties. The PROFINET update time is configured on the IO controller's port and applies to all slots.

Configuring the I-Device Transfer Area for Analog I/O

The integrator's existing configuration (Q230 / I230 with 512 bytes per direction for digital I/O) defines a generous transfer window but does not by itself guarantee that analog channels are accessible. The fix is to add a second transfer area whose address range overlaps the analog module's process image and whose consistency is set to "Total length".

1. Open the I-device project in TIA Portal and select the PROFINET interface of the CPU.
2. Open "Properties > Operating mode > I-device configuration".
3. If "I-device" is not yet enabled, check the box. This exposes the transfer area table.
4. Click "Add new transfer area". Set the following parameters:
   • Name: e.g. AI_to_Controller
   • Type: Input area (data from I-device to IO controller)
   • Start address: enter the absolute address of the first analog channel, for example IW96 if the SM 1231 AI4 starts at IW96
   • Length: at least 8 bytes for an AI4 (4 channels × 2 bytes), 16 bytes for an AI8, 32 bytes for AI16
   • Consistency: Total length
5. If the IO controller writes back setpoints (AO), add a second area named AO_from_Controller of type "Output area" with the address range of the SM 1232.
6. Compile and download the I-device project to the CPU.
7. In the IO controller project, drag the I-device from the network view into the topology. The transfer areas appear as slots. Configure the IO controller's process image address (e.g., IW512 for the AI block, QW512 for the AO block) and download.
8. Cycle power on both CPUs (or stop/run the I-device first, then the IO controller) so the AR (Application Relationship) re-establishes with the new slots.

I-Device Address Mapping for Analog Channels

The SM 1231 / SM 1232 / SM 1234 occupy specific addresses in the I-device's process image. TIA Portal assigns them automatically when the module is dragged into the device configuration, and the addresses can be read from the device overview table. A CPU 1214C with one SM 1231 AI4 in slot 1 typically produces the following I-addresses:

If the existing digital transfer area was defined as I230 / Q230 with 512 bytes (addresses 230 to 741 in the I-device process image) it does not overlap the analog channels at IW96..IW102. There are two ways to bring the analog data into the IO controller:

1. Move the transfer area start to IW96 so it covers both the analog channels and the digital I/O (if no digital I/O is in use below IW230, otherwise choose a start that covers everything that must be exchanged).
2. Add a separate transfer area starting at IW96 with length 8 bytes specifically for the analog data.

The cleanest long-term practice is option 2: keep the digital transfer area as-is and add a dedicated analog area. This avoids moving hundreds of digital operands if the integrator already references them in the program, and it allows independent update-time tuning for the analog slot.

SM 1231 Channel Configuration and Wiring

After the module is in the device view of the I-device, double-click the SM 1231 to open its properties. Under "Analog inputs" select the measuring range for each channel. The most common ranges and their raw-integer mappings are summarized below.

For each channel, also enable "Diagnostics" if you want the module to flag overflow / underflow / wire break as a diagnostic interrupt visible in the diagnostic buffer. Enable "Smoothing" to apply a first-order low-pass filter inside the module. A smoothing factor of "Weak", "Medium", or "Strong" corresponds to an effective number of averaged samples of approximately 4, 16, or 32.

Analog signals are susceptible to conducted and radiated noise. With cable runs over 10 m, twisted-pair shielded cable is mandatory, and the shield must be bonded to ground at one end only — preferably at the cabinet ground bar. The SM 1231 provides a ground screw on the module front; connect this to the cabinet PE bar with a short, low-impedance bond (recommended length <100 mm). Running analog signal cables in parallel with VFD output cables, motor leads, or contactor coils introduces common-mode noise that adds 4-20 mA LSB jitter visible as raw-value fluctuation. Maintain at least 200 mm separation, or cross at right angles.

For 4-20 mA loops, ensure the loop has a return path: the sensor's negative terminal must connect to the SM 1231 channel's M terminal, not to a floating ground. A typical wiring mistake is to power the loop from a 24 V supply and route only the positive lead to the SM 1231, leaving the return through chassis — this floats the input and produces erratic readings.

Reading and Scaling Analog Values in the IO Controller

After the IO controller project is downloaded, the analog data appears at the slot address configured in the IO controller's device view. Reading it is a straight word load; the value is the raw integer (0-27648 or -27648 to 27648). Ladder, FBD and SCL can all read it.

// SCL example: read raw value of AI0..AI3 from I-device
// Slot address configured as IW512..IW518 in IO controller
"AI0_RAW" := IW512;
"AI1_RAW" := IW514;
"AI2_RAW" := IW516;
"AI3_RAW" := IW518;

In ladder logic, the equivalent is a simple MOVE block from IW512 to a data word tag.

A raw value of 27648 representing 10 V (or 20 mA) is not useful in the controller's application code. The standard Siemens scaling instructions convert between the raw integer range and a floating-point engineering range:

• NORM_X normalizes the raw value to 0.0..1.0 given the raw low and high limits.
• SCALE_X maps the normalized value to the engineering low and high range (e.g., 0.0..100.0 °C, -50.0..+150.0 °C, 0.0..16.0 bar).

// SCALE_X example: 4-20 mA input, range 0.0..100.0 degC
// Raw low = 0 (corresponds to 4 mA with live-zero), raw high = 27648 (20 mA).
// To handle wire-break / under-range cleanly, treat any raw value below 0
// or equal to 32767 as a fault.
"AI0_NORM" := NORM_X(
    MIN := 0,
    VALUE := IW512,
    MAX := 27648);

"AI0_DEGC" := SCALE_X(
    MIN := 0.0,
    VALUE := "AI0_NORM",
    MAX := 100.0);

// Fault flag — wire break on 4-20 mA
"AI0_FAULT" := (IW512 = 32767) OR (IW512 < 0);

For bipolar ranges such as ±10 V mapped to -27648..+27648 and an engineering range of -50..+150:

"AI0_NORM" := NORM_X(
    MIN := -27648,
    VALUE := IW512,
    MAX := 27648);

"AI0_VAL" := SCALE_X(
    MIN := -50.0,
    VALUE := "AI0_NORM",
    MAX := 150.0);

For batch scaling of multiple channels in a single FC, an SCL loop over an array of channel descriptors avoids repetitive ladder rungs and keeps the conversion table in one place.

// Batch scaling in FC "ScaleAllAI"
// Input: ARRAY[0..3] of INT at IW512..IW518
// Output: ARRAY[0..3] of REAL at "AI_DEGC"
FOR #i := 0 TO 3 DO
    #norm := NORM_X(MIN := 0, VALUE := "AI_RAW"[#i], MAX := 27648);
    "AI_DEGC"[#i] := SCALE_X(MIN := 0.0, VALUE := #norm, MAX := 100.0);
END_FOR;

If the raw value reads 32767, the analog channel is in wire break (4-20 mA / RTD mode) or the input is outside the configured measuring range. If the raw value reads 0 with the sensor verified good, the address being read is not the one assigned to the channel — re-check the slot address in the IO controller's device view.

Common Configuration Errors and Fixes

The troubleshooting matrix below maps the typical failure modes reported on S7-1200 I-device analog configurations to the most common root causes.

Diagnostics, Verification, and Performance

Once the configuration is downloaded, the fastest way to confirm analog transfer is to use the watch tables in the IO controller project.

1. In the IO controller project, add a watch table and create tags of type INT for each slot word (e.g., "AI0_RAW" = IW512, "AI1_RAW" = IW514).
2. Toggle the I/O status monitor (glasses icon). The raw integer updates in real time.
3. Apply a known input (e.g., 5.000 V from a calibrator) and confirm the raw value is approximately 5 / 10 × 27648 = 13824 (within the module's accuracy spec of ±0.3% of full scale at 25 °C).
4. Open the I-device's web server (browse to the CPU's IP > "Module information" > "PROFINET interface" > "I-device data") to verify that the IO controller AR is established and the transfer areas are listed as active.
5. Use the diagnostic buffer of the IO controller to catch configuration errors that block AR establishment.
6. For each SM 1231 / SM 1232 channel, enable "Diagnostics" interrupts and watch the CPU diagnostic buffer for "Wire break" / "Overflow" / "Underflow" messages.

Analog values on the SM 1231 are updated every 10 ms (100 Hz conversion rate). The PROFINET I-device transfer area updates on the IO controller's update cycle, typically 1 ms (RT class 1) or 250 µs (RT class 2 / IRT). The end-to-end latency from a sensor voltage change at the SM 1231 terminals to a refreshed tag in the IO controller's watch table is therefore approximately 11-12 ms. If the IO controller also runs a position loop or fast PID on this value, confirm that the cycle time of the OB (OB1, OB30..OB38) is at least 2 ms shorter than the analog update interval to avoid aliasing.

The SM 1231 AI8 has 8 channels multiplexed into a single ADC; switching between channels takes 100 µs. When scanning fast (under 5 ms cycle), only the first 4 channels achieve full 100 Hz; channels 5..8 may be at 50 Hz effective. If 8 channels at full speed are needed, split the load across two SM 1231 AI4 modules rather than one SM 1231 AI8.

Frequently Asked Questions