Configuring S7-1200 SM 1234 Analog Output Wire Break Detection

David Krause12 min read
S7-1200SiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview: Wire Break Detection on S7-1200 Analog I/O

Wire break detection on analog outputs is fundamentally different from analog inputs. On an analog input, the module sources a small excitation current into the field device and watches the resulting voltage drop - if the loop opens, the input voltage rails high or low and the module flags a wire break. On an analog output, the module is the source: it drives either voltage (U) or current (I) into the load. Detecting an open loop on the output side requires the module to internally monitor whether its commanded value matches the actual current flowing out, which is a feature available only on specific SM 1232/SM 1234 variants and only when configured in current mode (4-20 mA).

This reference covers the complete procedure to capture, decode, and alarm wire break events on the analog output channels of a SIMATIC S7-1200 SM 1234 signal board/module using OB82 (Diagnostic Error Interrupt), with a hardware test bench built around a 500 Ohm resistor and field-validated capture logic in TIA Portal V17 or later.

Wire break diagnostics on analog outputs is a channel-level feature. It must be explicitly enabled in the device configuration. Voltage outputs typically expose only "short circuit" diagnostics, not "wire break". Confirm your module ordering number supports wire break in current mode before commissioning.

SM 1234 Module Identification and Diagnostic Capability

The MLFB (order number) printed on the side of every S7-1200 analog module determines which diagnostics are exposed. The most common SM 1234 variants are:

MLFB AI Channels AO Channels Resolution AO Wire Break Diagnostic
6ES7234-4HE32-0XB0 4 (U/I/RTD/TC) 2 (U/I) 13/14 bit Supported in 4-20 mA current mode
6ES7234-4HE32-0XB1 4 (U/I/RTD/TC) 2 (U/I) 14 bit Supported, enhanced event set
6ES7234-4HD32-0XB0 4 (U/I) 2 (U/I) 12/14 bit Limited - short circuit only on U outputs

To identify the module in your project, open Devices & Networks, select the SM 1234 head, then read the Properties > General > Order Number field. Cross-reference the firmware version in Properties > General > Firmware. Wire break on AO channels was added or improved on firmware V2.0 and later for the -0XB1 revision; older -0XB0 modules with firmware V1.x will not raise wire break diagnostics reliably in current mode below ~3.5 mA.

If you are using the SM 1234 signal board form factor (SB 1234, MLFB 6ES7234-4HA30-0XB0), the analog outputs do not support wire break diagnostics regardless of firmware. Use a true SM 1234 head module if wire break on AO is required.

Prerequisites

  1. CPU: S7-1200 firmware V4.2 or later (V4.4+ recommended for stable OB82 event ordering).
  2. SM 1234 head module with firmware V2.0 or later (verify MLFB ends in -0XB1).
  3. TIA Portal V16 Update 4 or later (V17/V18 preferred for full diagnostic descriptor support).
  4. One digital multimeter (DMM), one 500 Ohm, 0.25 W or larger resistor, two terminal blocks, and a DIN rail segment for the test bench.
  5. A 24 VDC power supply capable of at least 2 A continuous (PSU305 or equivalent).
  6. Watch table reserved for AO diagnostic capture (Watchtable_AO_Diag suggested).
  7. A global data block (DB_AO_Diag) created with the structure shown in Section 6.

Diagnostic Error Interrupt OB82 Fundamentals

OB82 is the S7-1200/CPU firmware's Diagnostic Error Interrupt organization block. The operating system calls OB82 once on the rising edge of a diagnostic event (e.g., a wire break occurring) and once again on the falling edge (e.g., the wire being reconnected). The OB runs to completion in a single scan and is not re-triggered for the same event while the fault persists.

OB82 receives a fixed set of input parameters when invoked. The four fields most relevant to AO wire break capture are:

OB82 Parameter Type Meaning
LADDR HW_IO (WORD) Hardware identifier of the module raising the event. Used to filter which channel triggered the fault.
Channel UINT Channel number within the module (0-based).
MultiError BOOL TRUE if more than one error is pending. Iterate over further slots if so.
IOState WORD Bit pattern showing per-channel error state. Bit 4 (0x10) = wire break on the corresponding output channel.

A common engineer mistake is to compare the incoming LADDR directly against a literal decimal constant (e.g., 270). Although this often works on the head PLC's main module, it produces intermittent failures on remote stations, signal boards, and modules inserted via hot-swap. The robust method is to drag the module's System Constant tag (e.g., Local~SM1234_1) into the compare instruction, which guarantees the correct HW identifier regardless of slot position.

OB82 will not execute if the OB itself is not present in the project. Adding OB82 to the program blocks container is the first trigger condition; without it, diagnostic events are silently queued in the diagnostic buffer but no program logic runs.

TIA Portal Configuration: Enabling Diagnostics

  1. Open the device configuration and select the SM 1234 head module.
  2. Navigate to Properties > Inputs/Outputs > Output channels.
  3. For each output channel used, set:
    • Output type: Current
    • Output range: 4 to 20 mA
    • Diagnostics: Wire break = Enabled
  4. Confirm that Hardware interrupt on limit violation is enabled if you also want to alarm on underrange/overrange.
  5. Compile the hardware configuration (Ctrl+Shift+B) so the system constants update.
  6. Drag the SM 1234 module from the network view onto a global DB tag list to capture its hardware identifier symbol.

Building the Diagnostic OB82 in Structured Text

Create a new OB (right-click Program blocks > Add new block > Organization block) and select Diagnostic error interrupt. TIA Portal auto-fills the interface declarations. Inside the OB, paste the following structured text skeleton, which captures every rising-edge wire break event into a ring buffer inside a global DB:

// Capture AO wire break events into DB_AO_Diag // Triggered on OB82 rising/falling edge IF #LADDR = "Local~SM1234_1_Head".IO_HW_ID THEN // system constant, not literal IF (#IOState AND 16#0010) <> 0 THEN // Bit 4 = wire break on channel 0 // Copy rising-edge event into ring buffer "DB_AO_Diag".Event["DB_AO_Diag".Index].LADDR := #LADDR; "DB_AO_Diag".Event["DB_AO_Diag".Index].Channel := #Channel; "DB_AO_Diag".Event["DB_AO_Diag".Index].IOState := #IOState; "DB_AO_Diag".Event["DB_AO_Diag".Index].Timestamp := RTM_TOD(); "DB_AO_Diag".Event["DB_AO_Diag".Index].EdgeRising := TRUE; "DB_AO_Diag".Event["DB_AO_Diag".Index].Channel0Broken := TRUE; // Roll the index "DB_AO_Diag".Index := ("DB_AO_Diag".Index + 1) MOD 64; // Raise operator alarm "DB_AO_Diag".Channel0AlarmActive := TRUE; ELSIF (#IOState AND 16#0010) = 0 THEN // Falling edge - wire break cleared "DB_AO_Diag".Channel0AlarmActive := FALSE; END_IF; END_IF;

The DB structure required by the snippet above is:

DATA_BLOCK "DB_AO_Diag" { S7_Optimized_Access := 'FALSE' } STRUCT Index : INT; // ring buffer cursor Channel0AlarmActive : BOOL; Channel1AlarmActive : BOOL; Event : ARRAY[0..63] OF STRUCT LADDR : WORD; Channel : UINT; IOState : WORD; Timestamp : TIME_OF_DAY; EdgeRising : BOOL; Channel0Broken : BOOL; Channel1Broken : BOOL; END_STRUCT; END_STRUCT; END_DATA_BLOCK

Mirror the channel logic for channel 1 using mask 16#0020 (Bit 5 = wire break on output channel 1).

Capturing Diagnostic Data: LADDR and IO_STATE

A diagnostic event arriving in OB82 contains only the slot-relative information; you must immediately write the values into a global DB or watch table because the OB-local tags are volatile and disappear the instant OB82 returns. Add the following entries to your watch table Watchtable_AO_Diag:

Watch Tag Address / Symbol Trigger Display
OB82.LADDR (last capture) DB_AO_Diag.Event[0].LADDR Per-cycle
OB82.IOState (last capture) DB_AO_Diag.Event[0].IOState Per-cycle
Wire break active ch0 DB_AO_Diag.Channel0AlarmActive Per-cycle
Event counter DB_AO_Diag.Index Per-cycle
Last 16 event timestamps DB_AO_Diag.Event[0..15].Timestamp Manual refresh

After enabling online monitoring, toggle the wire and observe Event[0].IOState changing to 16#0010 on the rising edge and back to 16#0000 on the falling edge. If Index increments but IOState stays at 0, OB82 is running but the LADDR filter is excluding the SM 1234 module - confirm the system constant symbol against the live device list.

Hardware Test Bench with 500 Ohm Load

A 4-20 mA current loop driving 500 Ohms produces 2-10 VDC across the resistor, well within the 24 V compliance of any S7-1200 AO. Building the bench requires no specialized tools:

  1. Power off the S7-1200. Snap two terminal blocks onto the same DIN rail as the SM 1234.
  2. Insert the 500 Ohm resistor between the two terminal blocks (one lead on TB-A, other lead on TB-B).
  3. Jumper from the SM 1234 AO0+ terminal to TB-A.
  4. Jumper from the SM 1234 AO0- terminal to TB-B.
  5. Power up the PLC. With the analog output forced to 12 mA (50% of 4-20 mA range), the DMM across the resistor must read 6.00 VDC +/- 0.05 V. If the reading is 0 V, the polarity is reversed.

Once the bench is verified, place the project online, open the watch table, and physically tug the jumper off TB-B. The DMM should immediately swing to 0 VDC (open loop) and the SM 1234 DIAG LED should begin blinking at 2 Hz. The watch table's DB_AO_Diag.Channel0AlarmActive should transition to TRUE within one scan. Reconnect the jumper; the LED extinguishes and the alarm clears.

The internal "wire break" threshold of SM 1234 current outputs is typically around 3.5 mA. If the AO is forced to a value below that current and the load is disconnected, the module may not flag a wire break because the commanded current is already below the diagnostic trip threshold. Force 12 mA or higher during bench testing.

Field Commissioning Procedure

  1. Verify the MLFB and firmware of every SM 1234 in the cabinet against the parts list.
  2. Download the project including OB82 and DB_AO_Diag to the PLC.
  3. Go online, force each AO to 12 mA, and physically disconnect the field wiring one channel at a time.
  4. Confirm that Channel0AlarmActive/Channel1AlarmActive toggles and the DIAG LED blinks.
  5. Reconnect wiring, confirm clear.
  6. Transfer the test wiring to the real load (valve, VFD reference, panel meter, etc.) and repeat steps 3-5.
  7. Document the LADDR values per station in a maintenance log so future firmware changes do not break the OB82 filter.

Alternative Method: Process Feedback Comparison

On many machine control loops, the controlled device provides independent confirmation that the AO command reached it - a positioner feedback signal, a flow transmitter downstream, or a valve positioner 4-20 mA return. If wire break detection is unavailable on the SM 1234 variant in use, a software check is often more reliable than trying to force the module to flag it:

// Software wire break detection via feedback mismatch IF ABS("FB_AO_Cmd".Output - "FB_AI_Return".Input) > 0.5 AND ("FB_AO_Cmd".Output > 4.0) AND (TON_Wait.Q) THEN "DB_AO_Diag".Channel0AlarmActive := TRUE; ELSE "DB_AO_Diag".Channel0AlarmActive := FALSE; END_IF;

The TON_Wait timer is set to the actuator's full-stroke time (typically 5-30 s for a pneumatic valve, 1-5 s for a small electric actuator) so that transient moves do not generate false alarms.

Diagnostic Event Reference

Event Code (hex) Description AO Channel Affected Remediation
0x0001 Short circuit (voltage mode) Voltage output only Check load wiring and load resistance
0x0010 Wire break (channel 0) Channel 0, current mode Inspect field loop; check load resistor > 0 Ohm
0x0020 Wire break (channel 1) Channel 1, current mode Same as above
0x0007 Underrange (below 4 mA commanded) Any current AO Verify scaling block
0x0008 Overrange (above 20 mA commanded) Any current AO Verify scaling block
0x0100 Module parameter error Both Recompile HW config and download

Troubleshooting Matrix

Symptom Likely Root Cause Corrective Action
OB82 never executes despite DIAG LED blinking OB82 block missing from project Add OB82 organization block
OB82 runs but LADDR filter never matches Literal value used instead of system constant Replace literal with hardware identifier tag from device configuration
IOState always 0 inside OB82 Diagnostics not enabled in device config Enable "Wire break" on each AO channel in module properties
DIAG LED lights but no operator alarm appears Alarm tag not bound to HMI / SCADA Expose Channel0AlarmActive to the HMI tag list
Wire break not flagged below 3.5 mA Diagnostic threshold floor Force AO to > 3.5 mA during commissioning
Multiple wire breaks on different channels confuse OB82 MultiError not iterated Loop on slot when MultiError=TRUE, capture all pending events
Event counter wraps and overwrites unprocessed events Ring buffer too small Increase DB_AO_Diag ring size from 64 to 256 elements

Standards and Reference Reading

The IEC 61131-9 standard (single-drop digital communication interface for small sensors and actuators, SDCI / IO-Link) describes wire-break detection principles for digital inputs that translate directly to current-loop analog diagnostics. For implementation theory on integrated current sources and threshold comparators inside digital input modules, the Texas Instruments application note SLYT753 provides an excellent background on the leakage-current-vs-threshold tradeoff. Beckhoff's EP1839 EtherCAT box documentation at infosys.beckhoff.com EP1839 shows how an output can detect wire break even in the off state by sensing sub-threshold leakage. Maxim Integrated (now Analog Devices) describes an equivalent on-input implementation in the MAX22190 octal digital input design note. For Siemens-specific AO module behavior, the TIA Portal S7-1200 manual collection walks through the same OB82 capture technique against an SM 1231 input module, which is the closest official analog signal to the SM 1234 output procedure documented here.

Why does my SM 1234 never raise a wire break diagnostic on the analog output?

Confirm that the module is a head SM 1234 (6ES7234-4HE32-0XB0 or -0XB1), not an SB 1234 signal board. Signal boards do not expose AO wire break diagnostics. Also confirm that the channel is configured for Current 4-20 mA mode in the device configuration and that the Diagnostics: Wire break checkbox is enabled per channel. Voltage outputs use short-circuit detection, not wire break.

OB82 fires but my LADDR compare never matches - is the firmware at fault?

Not normally. The most common cause is that a literal decimal address (e.g., 270) was typed into the compare instruction instead of the module's system-constant tag. Drag the hardware identifier from PLC tags > System constants > Local modules into the compare operand. This guarantees the correct HW identifier regardless of slot position or station remapping.

What is the bit position for wire break inside OB82.IOState on SM 1234?

Bit 4 (mask 16#0010) = wire break on AO channel 0. Bit 5 (mask 16#0020) = wire break on AO channel 1. Bit 7 (0x0080) typically indicates a short circuit on voltage outputs. Always cross-check the live IOState against the module's diagnostic event table in the online & diagnostic tools view of TIA Portal.

What load resistance should I use to bench-test AO wire break?

500 Ohms is the standard bench load. With a 4-20 mA loop, the resulting voltage drop is 2-10 VDC, comfortably within the 24 V compliance of the SM 1234. If the resistor is omitted or far larger than ~750 Ohms, the AO may saturate and report an overrange instead of a wire break. A precision 0.1% resistor is not required; a standard 1% metal-film 500 Ohm 0.25 W part is sufficient.

Can I use software feedback comparison instead of OB82 diagnostics?

Yes. If the field device returns a 4-20 mA or 0-10 V signal confirming its position, comparing the commanded output against the feedback after a debounce timer (the actuator's full-stroke time) is often more reliable than module-level diagnostics. Use the sample ST code in the Alternative Method section, with the timer tuned to the actuator's stroke time to suppress false alarms during normal movement.

Back to blog