Overview: Wire Break Detection on S7-1200 Analog I/O
Wire break detection on analog outputs is fundamentally different from analog inputs. On an analog input, the module sources a small excitation current into the field device and watches the resulting voltage drop - if the loop opens, the input voltage rails high or low and the module flags a wire break. On an analog output, the module is the source: it drives either voltage (U) or current (I) into the load. Detecting an open loop on the output side requires the module to internally monitor whether its commanded value matches the actual current flowing out, which is a feature available only on specific SM 1232/SM 1234 variants and only when configured in current mode (4-20 mA).
This reference covers the complete procedure to capture, decode, and alarm wire break events on the analog output channels of a SIMATIC S7-1200 SM 1234 signal board/module using OB82 (Diagnostic Error Interrupt), with a hardware test bench built around a 500 Ohm resistor and field-validated capture logic in TIA Portal V17 or later.
SM 1234 Module Identification and Diagnostic Capability
The MLFB (order number) printed on the side of every S7-1200 analog module determines which diagnostics are exposed. The most common SM 1234 variants are:
| MLFB | AI Channels | AO Channels | Resolution | AO Wire Break Diagnostic |
|---|---|---|---|---|
| 6ES7234-4HE32-0XB0 | 4 (U/I/RTD/TC) | 2 (U/I) | 13/14 bit | Supported in 4-20 mA current mode |
| 6ES7234-4HE32-0XB1 | 4 (U/I/RTD/TC) | 2 (U/I) | 14 bit | Supported, enhanced event set |
| 6ES7234-4HD32-0XB0 | 4 (U/I) | 2 (U/I) | 12/14 bit | Limited - short circuit only on U outputs |
To identify the module in your project, open Devices & Networks, select the SM 1234 head, then read the Properties > General > Order Number field. Cross-reference the firmware version in Properties > General > Firmware. Wire break on AO channels was added or improved on firmware V2.0 and later for the -0XB1 revision; older -0XB0 modules with firmware V1.x will not raise wire break diagnostics reliably in current mode below ~3.5 mA.
Prerequisites
- CPU: S7-1200 firmware V4.2 or later (V4.4+ recommended for stable OB82 event ordering).
- SM 1234 head module with firmware V2.0 or later (verify MLFB ends in -0XB1).
- TIA Portal V16 Update 4 or later (V17/V18 preferred for full diagnostic descriptor support).
- One digital multimeter (DMM), one 500 Ohm, 0.25 W or larger resistor, two terminal blocks, and a DIN rail segment for the test bench.
- A 24 VDC power supply capable of at least 2 A continuous (PSU305 or equivalent).
- Watch table reserved for AO diagnostic capture (Watchtable_AO_Diag suggested).
- A global data block (DB_AO_Diag) created with the structure shown in Section 6.
Diagnostic Error Interrupt OB82 Fundamentals
OB82 is the S7-1200/CPU firmware's Diagnostic Error Interrupt organization block. The operating system calls OB82 once on the rising edge of a diagnostic event (e.g., a wire break occurring) and once again on the falling edge (e.g., the wire being reconnected). The OB runs to completion in a single scan and is not re-triggered for the same event while the fault persists.
OB82 receives a fixed set of input parameters when invoked. The four fields most relevant to AO wire break capture are:
| OB82 Parameter | Type | Meaning |
|---|---|---|
| LADDR | HW_IO (WORD) | Hardware identifier of the module raising the event. Used to filter which channel triggered the fault. |
| Channel | UINT | Channel number within the module (0-based). |
| MultiError | BOOL | TRUE if more than one error is pending. Iterate over further slots if so. |
| IOState | WORD | Bit pattern showing per-channel error state. Bit 4 (0x10) = wire break on the corresponding output channel. |
A common engineer mistake is to compare the incoming LADDR directly against a literal decimal constant (e.g., 270). Although this often works on the head PLC's main module, it produces intermittent failures on remote stations, signal boards, and modules inserted via hot-swap. The robust method is to drag the module's System Constant tag (e.g., Local~SM1234_1) into the compare instruction, which guarantees the correct HW identifier regardless of slot position.
TIA Portal Configuration: Enabling Diagnostics
- Open the device configuration and select the SM 1234 head module.
- Navigate to Properties > Inputs/Outputs > Output channels.
- For each output channel used, set:
- Output type: Current
- Output range: 4 to 20 mA
- Diagnostics: Wire break = Enabled
- Confirm that Hardware interrupt on limit violation is enabled if you also want to alarm on underrange/overrange.
- Compile the hardware configuration (Ctrl+Shift+B) so the system constants update.
- Drag the SM 1234 module from the network view onto a global DB tag list to capture its hardware identifier symbol.
Building the Diagnostic OB82 in Structured Text
Create a new OB (right-click Program blocks > Add new block > Organization block) and select Diagnostic error interrupt. TIA Portal auto-fills the interface declarations. Inside the OB, paste the following structured text skeleton, which captures every rising-edge wire break event into a ring buffer inside a global DB:
// Capture AO wire break events into DB_AO_Diag
// Triggered on OB82 rising/falling edge
IF #LADDR = "Local~SM1234_1_Head".IO_HW_ID THEN // system constant, not literal
IF (#IOState AND 16#0010) <> 0 THEN // Bit 4 = wire break on channel 0
// Copy rising-edge event into ring buffer
"DB_AO_Diag".Event["DB_AO_Diag".Index].LADDR := #LADDR;
"DB_AO_Diag".Event["DB_AO_Diag".Index].Channel := #Channel;
"DB_AO_Diag".Event["DB_AO_Diag".Index].IOState := #IOState;
"DB_AO_Diag".Event["DB_AO_Diag".Index].Timestamp := RTM_TOD();
"DB_AO_Diag".Event["DB_AO_Diag".Index].EdgeRising := TRUE;
"DB_AO_Diag".Event["DB_AO_Diag".Index].Channel0Broken := TRUE;
// Roll the index
"DB_AO_Diag".Index := ("DB_AO_Diag".Index + 1) MOD 64;
// Raise operator alarm
"DB_AO_Diag".Channel0AlarmActive := TRUE;
ELSIF (#IOState AND 16#0010) = 0 THEN
// Falling edge - wire break cleared
"DB_AO_Diag".Channel0AlarmActive := FALSE;
END_IF;
END_IF;
The DB structure required by the snippet above is:
DATA_BLOCK "DB_AO_Diag"
{ S7_Optimized_Access := 'FALSE' }
STRUCT
Index : INT; // ring buffer cursor
Channel0AlarmActive : BOOL;
Channel1AlarmActive : BOOL;
Event : ARRAY[0..63] OF STRUCT
LADDR : WORD;
Channel : UINT;
IOState : WORD;
Timestamp : TIME_OF_DAY;
EdgeRising : BOOL;
Channel0Broken : BOOL;
Channel1Broken : BOOL;
END_STRUCT;
END_STRUCT;
END_DATA_BLOCK
Mirror the channel logic for channel 1 using mask 16#0020 (Bit 5 = wire break on output channel 1).
Capturing Diagnostic Data: LADDR and IO_STATE
A diagnostic event arriving in OB82 contains only the slot-relative information; you must immediately write the values into a global DB or watch table because the OB-local tags are volatile and disappear the instant OB82 returns. Add the following entries to your watch table Watchtable_AO_Diag:
| Watch Tag | Address / Symbol | Trigger Display |
|---|---|---|
| OB82.LADDR (last capture) | DB_AO_Diag.Event[0].LADDR | Per-cycle |
| OB82.IOState (last capture) | DB_AO_Diag.Event[0].IOState | Per-cycle |
| Wire break active ch0 | DB_AO_Diag.Channel0AlarmActive | Per-cycle |
| Event counter | DB_AO_Diag.Index | Per-cycle |
| Last 16 event timestamps | DB_AO_Diag.Event[0..15].Timestamp | Manual refresh |
After enabling online monitoring, toggle the wire and observe Event[0].IOState changing to 16#0010 on the rising edge and back to 16#0000 on the falling edge. If Index increments but IOState stays at 0, OB82 is running but the LADDR filter is excluding the SM 1234 module - confirm the system constant symbol against the live device list.
Hardware Test Bench with 500 Ohm Load
A 4-20 mA current loop driving 500 Ohms produces 2-10 VDC across the resistor, well within the 24 V compliance of any S7-1200 AO. Building the bench requires no specialized tools:
- Power off the S7-1200. Snap two terminal blocks onto the same DIN rail as the SM 1234.
- Insert the 500 Ohm resistor between the two terminal blocks (one lead on TB-A, other lead on TB-B).
- Jumper from the SM 1234
AO0+terminal to TB-A. - Jumper from the SM 1234
AO0-terminal to TB-B. - Power up the PLC. With the analog output forced to 12 mA (50% of 4-20 mA range), the DMM across the resistor must read 6.00 VDC +/- 0.05 V. If the reading is 0 V, the polarity is reversed.
Once the bench is verified, place the project online, open the watch table, and physically tug the jumper off TB-B. The DMM should immediately swing to 0 VDC (open loop) and the SM 1234 DIAG LED should begin blinking at 2 Hz. The watch table's DB_AO_Diag.Channel0AlarmActive should transition to TRUE within one scan. Reconnect the jumper; the LED extinguishes and the alarm clears.
Field Commissioning Procedure
- Verify the MLFB and firmware of every SM 1234 in the cabinet against the parts list.
- Download the project including OB82 and DB_AO_Diag to the PLC.
- Go online, force each AO to 12 mA, and physically disconnect the field wiring one channel at a time.
- Confirm that
Channel0AlarmActive/Channel1AlarmActivetoggles and the DIAG LED blinks. - Reconnect wiring, confirm clear.
- Transfer the test wiring to the real load (valve, VFD reference, panel meter, etc.) and repeat steps 3-5.
- Document the LADDR values per station in a maintenance log so future firmware changes do not break the OB82 filter.
Alternative Method: Process Feedback Comparison
On many machine control loops, the controlled device provides independent confirmation that the AO command reached it - a positioner feedback signal, a flow transmitter downstream, or a valve positioner 4-20 mA return. If wire break detection is unavailable on the SM 1234 variant in use, a software check is often more reliable than trying to force the module to flag it:
// Software wire break detection via feedback mismatch
IF ABS("FB_AO_Cmd".Output - "FB_AI_Return".Input) > 0.5 AND
("FB_AO_Cmd".Output > 4.0) AND
(TON_Wait.Q) THEN
"DB_AO_Diag".Channel0AlarmActive := TRUE;
ELSE
"DB_AO_Diag".Channel0AlarmActive := FALSE;
END_IF;
The TON_Wait timer is set to the actuator's full-stroke time (typically 5-30 s for a pneumatic valve, 1-5 s for a small electric actuator) so that transient moves do not generate false alarms.
Diagnostic Event Reference
| Event Code (hex) | Description | AO Channel Affected | Remediation |
|---|---|---|---|
| 0x0001 | Short circuit (voltage mode) | Voltage output only | Check load wiring and load resistance |
| 0x0010 | Wire break (channel 0) | Channel 0, current mode | Inspect field loop; check load resistor > 0 Ohm |
| 0x0020 | Wire break (channel 1) | Channel 1, current mode | Same as above |
| 0x0007 | Underrange (below 4 mA commanded) | Any current AO | Verify scaling block |
| 0x0008 | Overrange (above 20 mA commanded) | Any current AO | Verify scaling block |
| 0x0100 | Module parameter error | Both | Recompile HW config and download |
Troubleshooting Matrix
| Symptom | Likely Root Cause | Corrective Action |
|---|---|---|
| OB82 never executes despite DIAG LED blinking | OB82 block missing from project | Add OB82 organization block |
| OB82 runs but LADDR filter never matches | Literal value used instead of system constant | Replace literal with hardware identifier tag from device configuration |
| IOState always 0 inside OB82 | Diagnostics not enabled in device config | Enable "Wire break" on each AO channel in module properties |
| DIAG LED lights but no operator alarm appears | Alarm tag not bound to HMI / SCADA | Expose Channel0AlarmActive to the HMI tag list |
| Wire break not flagged below 3.5 mA | Diagnostic threshold floor | Force AO to > 3.5 mA during commissioning |
| Multiple wire breaks on different channels confuse OB82 | MultiError not iterated | Loop on slot when MultiError=TRUE, capture all pending events |
| Event counter wraps and overwrites unprocessed events | Ring buffer too small | Increase DB_AO_Diag ring size from 64 to 256 elements |
Standards and Reference Reading
The IEC 61131-9 standard (single-drop digital communication interface for small sensors and actuators, SDCI / IO-Link) describes wire-break detection principles for digital inputs that translate directly to current-loop analog diagnostics. For implementation theory on integrated current sources and threshold comparators inside digital input modules, the Texas Instruments application note SLYT753 provides an excellent background on the leakage-current-vs-threshold tradeoff. Beckhoff's EP1839 EtherCAT box documentation at infosys.beckhoff.com EP1839 shows how an output can detect wire break even in the off state by sensing sub-threshold leakage. Maxim Integrated (now Analog Devices) describes an equivalent on-input implementation in the MAX22190 octal digital input design note. For Siemens-specific AO module behavior, the TIA Portal S7-1200 manual collection walks through the same OB82 capture technique against an SM 1231 input module, which is the closest official analog signal to the SM 1234 output procedure documented here.
Why does my SM 1234 never raise a wire break diagnostic on the analog output?
Confirm that the module is a head SM 1234 (6ES7234-4HE32-0XB0 or -0XB1), not an SB 1234 signal board. Signal boards do not expose AO wire break diagnostics. Also confirm that the channel is configured for Current 4-20 mA mode in the device configuration and that the Diagnostics: Wire break checkbox is enabled per channel. Voltage outputs use short-circuit detection, not wire break.
OB82 fires but my LADDR compare never matches - is the firmware at fault?
Not normally. The most common cause is that a literal decimal address (e.g., 270) was typed into the compare instruction instead of the module's system-constant tag. Drag the hardware identifier from PLC tags > System constants > Local modules into the compare operand. This guarantees the correct HW identifier regardless of slot position or station remapping.
What is the bit position for wire break inside OB82.IOState on SM 1234?
Bit 4 (mask 16#0010) = wire break on AO channel 0. Bit 5 (mask 16#0020) = wire break on AO channel 1. Bit 7 (0x0080) typically indicates a short circuit on voltage outputs. Always cross-check the live IOState against the module's diagnostic event table in the online & diagnostic tools view of TIA Portal.
What load resistance should I use to bench-test AO wire break?
500 Ohms is the standard bench load. With a 4-20 mA loop, the resulting voltage drop is 2-10 VDC, comfortably within the 24 V compliance of the SM 1234. If the resistor is omitted or far larger than ~750 Ohms, the AO may saturate and report an overrange instead of a wire break. A precision 0.1% resistor is not required; a standard 1% metal-film 500 Ohm 0.25 W part is sufficient.
Can I use software feedback comparison instead of OB82 diagnostics?
Yes. If the field device returns a 4-20 mA or 0-10 V signal confirming its position, comparing the commanded output against the feedback after a debounce timer (the actuator's full-stroke time) is often more reliable than module-level diagnostics. Use the sample ST code in the Alternative Method section, with the timer tuned to the actuator's stroke time to suppress false alarms during normal movement.