Configuring Siemens SM 331 Wire Break Detection on 4-20mA

1. Problem Overview and Engineering Intent

A 4–20 mA current loop is the de-facto standard for process instrumentation because a single conductor pair simultaneously carries power and a measurement signal whose live zero at 4 mA is non-zero. That property is the foundation of any wire break detection strategy: a healthy transmitter must always source at least 4 mA; a reading of 0 mA on a 4–20 mA channel is physically impossible unless the loop has been opened, shorted, or the transmitter has lost excitation. Engineers building S7-300 systems around the 6ES7331-7KF02-0AB0 (SM 331, 8 AI, 12-bit) frequently discover that the raw PIW value silently tracks whatever the front-end measures—including the underrange debris produced by a broken conductor—and want a deterministic, hardware-assisted way to raise a "wire broken" flag without writing a custom threshold in user code.

The SM 331 family does provide a built-in wire break check, but it is only useful when it is enabled in the hardware configuration of STEP 7 and only on measuring ranges that are physically capable of supporting it (current ranges, RTD, TC). Voltage ranges cannot report a wire break because an open input on a voltage channel simply drifts to 0 V, which is indistinguishable from a valid 0 V signal. This article walks through the configuration, the firmware-level encoding of the diagnostic bit, the OB82 interrupt path, and the code patterns used to translate the diagnostic event into a Boolean flag the rest of the program can consume.

2. The 4–20 mA Wire Break Principle

Current loops are fail-safe by design:

• 0 mA → loop open, conductor severed, or transmitter unpowered
• 1–3.6 mA → underrange; the SM 331 reports underflow and the diagnostic bit is set if the check is enabled
• 3.6 mA → nominal low-end of the measurement, equivalent to 0 % of span
• 20 mA → nominal high-end, 100 % of span
• > 22.8 mA (typical) → overflow; the SM 331 saturates the digital value and reports overflow

Transmitters and the SM 331 share a convention: any signal below approximately 3.6 mA is treated as an underflow / broken-wire event. A first-pass implementation can simply look at the engineering value after scaling and raise a flag when it falls below 0 %, but that approach forces the user program to know the calibration constants. The hardware-assisted path lets the analog front-end do the comparison and presents the result as a bit the CPU can poll or be interrupted on.

3. SM 331 6ES7331-7KF02-0AB0 Hardware Capabilities

The 6ES7331-7KF02-0AB0 is an 8-channel, 12-bit analog input module that supports voltage, current (including 4–20 mA), RTD, and thermocouple inputs in any combination. The version released as 7KF02 exposes a wider set of diagnostic parameters than the earlier 7KF01 variant. The relevant feature set for wire break detection:

The user cited that "the input card you're using at present has no diagnostic capability." That statement is only true of older or value-class SM 331 variants that lack the diagnostic interrupt. The 7KF02 revision is fully diagnostic-capable; if the feature is invisible, it is almost always because STEP 7 is loading an older GSD or HSP that does not expose the new parameters.

4. Compatible and Alternative Modules

If the project is being built from scratch, the following modules are drop-in alternatives that support the same diagnostic philosophy with higher resolution or wider feature sets:

On S7-1500 / ET 200MP, the equivalent parameter is called Diagnosis - Wire break and appears under the channel parameters in the device view. Activating it is functionally identical to the STEP 7 path described below; the diagnostic event surfaces through the standard PROFINET diagnostic alarm (see Using wire break option in analog modules for a worked example of the user-facing parameter).

5. STEP 7 HW Config: Enabling Wire Break Detection

The procedure below is the canonical STEP 7 V5.x path; TIA Portal follows the same logic with a different menu structure.

1. Open the S7 project in SIMATIC Manager → HW Config.
2. Insert the SM 331 (6ES7331-7KF02-0AB0) into the rail. Verify the order number and firmware version match the physical module; a mismatch disables the new parameter set.
3. Double-click the module to open Properties - AI8x12Bit.
4. Switch to the Inputs tab. For each channel wired to a 4–20 mA loop, set the measuring range to 4DMU (4–20 mA, four-wire transmitter) or 2DMU (4–20 mA, two-wire transmitter) as appropriate.
5. Enable the "Wire break check" checkbox. On STEP 7 V5.x the label is exactly that; on TIA Portal the equivalent field is Diagnostics > Wire break.
6. Enable "Diagnostic Interrupt" on the module's Diagnostics tab. This is what causes OB82 to fire when a wire break occurs.
7. If the project uses shared I/O across multiple OBs, ensure OB82, OB83, and OB100–OB102 are present in the CPU's block container. A missing OB82 will cause the CPU to STOP on the first diagnostic event.
8. Compile and download the hardware configuration. After download the module is reparameterized on the next STOP→RUN transition.

6. PIW Value Mapping and Overflow / Underflow Encoding

The SM 331 reports measured values to the CPU as a 16-bit signed integer in the process image (PIW). When the front-end detects an out-of-range condition, the SM substitutes a saturated value rather than passing through the raw ADC reading:

For an unipolar 4–20 mA range, the SM 331 maps 4 mA to 0 and 20 mA to 27648. Anything below 0 mA is reported as -32768. A purely software implementation can therefore poll PIW == 16#8000 on the relevant channel and treat it as a wire break—but this loses the interrupt context and cannot distinguish a wire break from a shorted input on some variants. The recommended path is to combine polling with the OB82 interrupt.

7. OB82 Diagnostic Interrupt Handling

OB82 is the diagnostic interrupt OB. It fires when the SM 331 raises or clears a channel diagnostic. The temporary variables OB82_MDL_DEFECT, OB82_INPUT_FLT, and the local data starting at LB12 describe the event. A minimal but production-ready implementation looks like this in STL:

FUNCTION_BLOCK FB_WireBreakMonitor
VAR
    bWireBreak : ARRAY[0..7] OF BOOL;   // one bit per channel
    iLastChannel : INT;
    iLastError   : INT;
END_VAR

// Called from OB82
NETWORK
TITLE = Diagnostic interrupt handler
      L     #OB82_MDL_ADDR         // logical base address of faulty module
      L     W#16#0                 // expected base address from HW Config
      <>I
      JC    EXIT                   // not our SM 331
      L     LB 12                  // OB82_LOCAL_DATA[0] = channel number
      T     #iLastChannel
      L     LB 13                  // OB82_LOCAL_DATA[1] = error type
      T     #iLastError
      L     W#16#0103              // error code pattern: wire break on AI
      ==I
      JC    SET                    // if matched, set the per-channel flag
      L     W#16#0107              // error code: error cleared (recoverable)
      ==I
      JC    CLR                    // clear the per-channel flag
      JU    EXIT
SET:  SET
      S     #bWireBreak[0]         // index via #iLastChannel if ARRAY
CLR:  CLR
      R     #bWireBreak[0]
EXIT: BE

The exact error codes are documented in the S7-300 module data manual; the values 0x0103 and 0x0107 shown above are representative and must be verified against the manual for the firmware revision in service. See Analog Wire broken, Overflow and Underflow Diagnostic Status for a community-validated reading of the same structure on newer modules.

8. SCL Implementation for Newer Projects

For S7-300 CPUs that support SCL (3xxC and up) and for any S7-1500 migration, the equivalent code is far more readable:

FUNCTION_BLOCK "FB_WireBreakMonitor"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
   VAR_INPUT
      iModuleBaseAddress : INT;       // Logical base address of SM 331
   END_VAR
   VAR_OUTPUT
      bWireBreakChannel0 : BOOL;
      bWireBreakChannel1 : BOOL;
      // ... up to bWireBreakChannel7
   END_VAR
   VAR
      sErrorText : STRING[80];
   END_VAR
BEGIN
   // Re-arm: read current diagnostic state into a temp
   IF "DiagnosticChannelStatus"(iModuleBaseAddress, 0) = 2 THEN
      bWireBreakChannel0 := TRUE;
   ELSIF "DiagnosticChannelStatus"(iModuleBaseAddress, 0) = 1 THEN
      bWireBreakChannel0 := FALSE;
   END_IF;
END_FUNCTION_BLOCK

For S7-1200/S7-1500 with the SM 1234 (4 AI / 2 AQ) analog combo, the diagnostic OB is wired identically and the channel status bit is exposed via the standard GET_DIAG instruction; see How to do analog output wire break detection on SM 1234 for the AQ side of the same problem.

9. Polling the S7-300 Channel Status Word (Alternative Path)

If the application cannot tolerate the OB82 overhead or the OB is consumed by another block, the SM 331 also exposes a status byte per channel in the I/O area immediately following the measured values. The status byte layout is:

Polling bit 2 of each status byte on a fixed cycle yields a wire break indicator without any OB involvement. The status byte locations are described in the module's SiePortal reference post and must be cross-checked against the local HW Config address assignment.

10. Migration to S7-1500 / ET 200MP

When the S7-300 system is being modernized, the wire break logic transfers almost unchanged. On the F-AI 8xI 0/4..20 mA (6ES7536-1MF00-0AB0), the parameter is exposed as Diagnosis - Wire break and the diagnostic event surfaces as a PROFINET alarm that OB82 (or its S7-1500 equivalent) handles identically. The TIA Portal manual for the module describes the parameter set in detail (see TIA Portal cloud: Diagnosis - Wire break). For non-F variants, the standard AI 8xU/I/RTD/TC ST (6ES7531-7KF00-0AB0) and AI 8xI 2/4-wire (6ES7531-7NF60-0AB0) carry the same capability without the safety layer.

11. Verification and Commissioning Procedure

1. Connect a 4–20 mA calibrator (Beamex MC6, Fluke 754, or equivalent) to channel 0 of the SM 331.
2. Force 4.000 mA. Verify the engineering value reads 0 % and that no diagnostic bit is active.
3. Force 20.000 mA. Verify 100 % and no diagnostic bit.
4. Disconnect the loop at the transmitter end. Verify the engineering value clamps to -32768 (or the out-of-range substitute) and the wire break bit is set within one diagnostic scan cycle.
5. Confirm OB82 fires; check the diagnostic buffer entry via PLC > Module Information > Diagnostic Buffer in STEP 7.
6. Reconnect the loop. Verify the wire break bit clears (either via the falling edge of OB82 or via a 0x0107-style "error gone" event) and the engineering value returns to the live reading.
7. Repeat for all 8 channels. Document the observed PIW at 4.000 mA and 20.000 mA for the SAT record.

12. Troubleshooting Matrix

FAQ