Resolving Siemens SM331 6ES7331-7KF02-0AB0 Startup Limiting-Value Read on S7-300

Overview of the Startup Limiting-Value Phenomenon

When an S7-300 CPU powers up with an SM331 analog input module configured as 6ES7331-7KF02-0AB0, the input process image frequently presents a saturated (overrange) value for the first 1-3 seconds of operation. After this transient window, the same channel begins returning a value proportional to the connected 4-20 mA transmitter output. Engineers commonly observe the 16-bit process image reading 7FFFh (32767) or 6C00h (27648) during boot, then stepping to the engineering value once the module finishes its internal calibration and accepts the system data tables (SDT) downloaded from the CPU.

The symptom is independent of program logic because OB1 has not yet executed when the limit value appears. The cause is electrical and parameterization-related: the analog front-end has not completed its conversion cycle, the transmitter has not yet settled to its 4 mA quiescent current, or the module's diagnostic bit has set before the configured measurement range is loaded.

Affected Hardware and Module Identification

The closely related module 6ES7331-7KB02-0AB0 (SM331 AI2 x 14 Bit) exhibits the identical startup behavior and shares the same Siemens FAQ entries.

Root Cause Analysis

The startup limiting-value phenomenon has three independent root causes. Each can produce the symptom in isolation; in field installations two or three are usually present simultaneously.

Cause 1: Module Parameterization Phase

When the S7-300 CPU completes its startup routine, it transfers the SDT (System Data Tables) containing the analog-input configuration - measurement range, integration time, smoothing factor, diagnostic enable - to the SM331 module. Until this transfer completes and the module's ASIC reinitializes against the new range, the conversion result is undefined and the diagnostic interrupt for "parameter assignment error" is active. The S7-300 default behavior is to write the overrange value (7FFFh) into the input process image for every channel in an un-parameterized channel group.

The CPU executes OB100 (warm restart) once the SDT transfer begins and OB1 begins immediately after OB100 completes. If OB1 reads the PI before the module finishes accepting the SDT (typically 200-800 ms after OB100 entry), the reading is the overrange sentinel rather than the converted value.

Cause 2: Transmitter Power-Up Settling

Two-wire 4-20 mA transmitters draw their loop current from the module's 24 V sensor supply terminals. During the first 100-1500 ms after power is applied to the transmitter, the internal current regulator has not yet settled, and the loop current can exceed 20 mA (or fall below 4 mA) before clamping. The module reports this as either underflow (negative full scale, 8000h) or overrange (7FFFh). Four-wire transmitters connected to a separate supply exhibit the same behavior if the SM331 module's encoder supply ramps up faster than the transmitter loop, or if the transmitter is powered by the same 24 VDC bus that is still charging its bulk capacitance.

For a 4-wire transmitter that is powered 2-3 seconds before the S7-300 station, the loop current should already be stable when the module enters conversion. If the limiting value still appears, Cause 1 or Cause 3 is dominant.

Cause 3: IM365 / IM153 Inter-Rack Parameterization Latency

If the SM331 7KF02 is mounted in an expansion rack behind 6ES7365-0BA01-0AA0 (IM365) or in an ET 200M behind 6ES7153-1AA03-0XB0 / 6ES7153-2BA10-0XB0 (IM153-2), the parameterization SDT must travel across the interconnecting IM bus. The transfer introduces an additional 200-1500 ms latency. During this latency the central CPU may already have executed OB100 and reached OB1, while the distributed module is still holding 7FFFh.

The Siemens FAQ "Why are sporadically not all the modules parameterized when starting up a software redundancy configuration with 2 IM 6ES7153-2BA.." documents this latency and lists affected IM part numbers including 6ES7153-2BA02 and 6ES7153-2BA10.

S7-300 Startup Sequence and OB Timing

Understanding the S7-300 startup sequence is essential to choosing between hardware and software remedies.

1. Power ON to backplane voltage OK - t = 0 ms
2. CPU performs self-test and reads MMC/system data - t = 100-400 ms
3. CPU writes SDT to local I/O and distributed I/O via IM - t = 400-1200 ms
4. CPU executes OB102 (cold restart) if selected, else OB100 (warm restart) - t = 600-1500 ms
5. OB1 begins executing cyclic scan - t = 700-1700 ms
6. Module calibration complete and first valid conversion available - t = 1500-3000 ms

The 2-second window reported in the field corresponds to the gap between steps 5 and 6. Reading the PI in OB1 before step 6 completes yields the overrange sentinel. The window expands when the module is on an IM bus (Cause 3).

Diagnostic Procedure

Use the following sequence to confirm the root cause before applying a remedy.

1. Open the STEP 7 project and navigate to HW Config > Properties on the SM331 7KF02 slot. Verify the MLFB is exactly 6ES7331-7KF02-0AB0 and the firmware release (shown under Module Information in the online view).
2. Open SIMATIC Manager > PLC > Module Information. On the Diagnostic Buffer tab, look for event IDs 3942 (module parameterization error) and 3922 (module OK). Note the time difference between the two entries.
3. Connect a software oscilloscope (e.g., TRACE in STEP 7 or a laptop running a trend on the same DB tag) to the input word (PIW) of the affected channel. Set the trend sample time to 100 ms. Power-cycle the station and record the first 5 s of the trend.
4. Verify the transmitter loop current with a clamp-on milliamp meter (or in-line ammeter) on the 4-20 mA loop. Confirm the current is stable at 4 mA within 500 ms of station power-up.
5. If the module is in an ET 200M, open Module Information on the IM153-2 and check the Bus tab for parameterization timestamp.

Hardware and Configuration Remedies

Remedy H1: Verify SDT Compatibility and Re-Download Hardware Configuration

A corrupted or mismatched SDT is the most common cause of persistent parameterization errors. The procedure:

1. In HW Config, select the SM331 module and note the order number.
2. Open the Object Properties of the rack or station and run PLC > Download to Target with the option Download hardware configuration.
3. After download, perform a memory reset (MRES) on the CPU and reinsert the MMC.
4. Power-cycle the station and re-check the diagnostic buffer.

If event ID 3942 is still present, the SDT is rejected by the module. Verify the configured measurement range matches the wiring: a 4-wire 4-20 mA transmitter requires the current measurement range selected for that channel group, not voltage.

Remedy H2: Verify Wiring Type Against Channel Group Configuration

The SM331 7KF02 has four channel groups (0-1, 2-3, 4-5, 6-7). Each channel group has a single measurement range setting. If channels 0 and 2 are both used but channels 0 is configured for voltage and channels 2 is configured for current, only the voltage group will read correctly; the current group will return overrange.

Remedy H3: Sensor Power Sequencing

If the transmitter is 2-wire and draws power from the module's encoder supply, the supply is on the same 24 VDC bus as the backplane. Adding an inrush limiter or sequencing relay between the 24 VDC source and the encoder supply terminals (terminals 1-20 on the 6ES7331-7KF02-0AB0 front connector) extends the inrush window and reduces the 0.5-1.5 s loop settling transient.

For 4-wire transmitters powered by an independent supply, ensure the supply is on for at least 3 seconds before the S7-300 station is powered. If both supplies come on together, swap the supply topology so the transmitter supply is energized first.

Remedy H4: IM Bus Latency Mitigation

For SM331 modules behind an IM153-2 in an ET 200M, update the IM153-2 firmware to the latest release (6ES7153-2BA10-0XB0 with firmware V4.0 or later). Newer IM firmware reduces the parameterization transfer latency from 1500 ms to under 800 ms.

For software-redundant configurations with two IM153-2 modules, follow the Siemens FAQ recommendation to assign the SM331 module to the active IM only and parameterize it as a single-channel group.

Software Remedies: OB100 Delay and Value Validation

Remedy S1: Insert a Time Delay in OB100

The simplest workaround is to delay the start of OB1 execution by inserting a timer in OB100. This holds the CPU in OB100 until the SM331 module has finished parameterization and the first valid conversion is available.

// OB100 - Warm Restart
// Insert this network at the end of OB100
       SET
       L     S5T#3S            // 3-second delay; tune to your installation
       SF    "Delay_Timer"     // Timer DB or M flag; "Delay_Done" reset on entry

// Optional: Set a flag so OB1 knows when the delay has completed
       U     "Delay_Done"
       =     "Startup_OK"

       BE

For larger systems where OB100 must complete quickly, use the alternative of polling the module's diagnostic bit in OB1.

Remedy S2: Value Validation in OB1

Implement a value-validation function block that detects the overrange sentinel and replaces it with the last known good value until a new valid conversion is detected.

// FB100 - Analog Input Validation
// Inputs :  RAW_IN    (INT)    - PIW address or DB value
//           LAST_GOOD (REAL)   - last engineering value
// Outputs:  ENG_OUT   (REAL)   - validated engineering output
//           QUALITY   (BOOL)   - 0 = bad, 1 = good
//
// Limits:
//   4-20 mA scaled to 0-100% = 0-27648 counts
//   Overrange sentinel       = 32767 (7FFFh)
//   Underrange sentinel      = -32768 (8000h)
//   Open wire (4-20 mA)      = 32767 (wire-break diagnostic)

// ========================================================================
      L     #RAW_IN
      L     27648              // upper nominal
      >I                         // if RAW > 27648
      SPB   BAD                 // branch to BAD
      L     #RAW_IN
      L     0                   // lower nominal
      <I                         // if RAW < 0
      SPB   BAD
      L     #RAW_IN
      ITD                       // integer to double integer
      DTR                       // double integer to real
      L     2.7648e+4           // scale factor (27648 / 100)
      /R                         // scale to engineering units (0-100%)
      T     #ENG_OUT
      L     #LAST_GOOD
      T     #ENG_OUT            // alternative: filter / EMA
      SET
      =     #QUALITY            // QUALITY = 1 (good)
      BEA
BAD:  L     #LAST_GOOD
      T     #ENG_OUT
      CLR
      =     #QUALITY            // QUALITY = 0 (bad)
      BE

Call this FB once per OB1 cycle per analog channel. The FB rejects values outside the expected range and holds the last good value until a valid conversion appears.

Remedy S3: Diagnostic-Interrupt Driven Validation

For installations where the module's diagnostic interrupt is enabled in HW Config, OB82 (Diagnostic Interrupt) fires when the module reports a parameterization error or wire break. Use OB82 to set a "module OK" flag that OB1 can check before using the analog value.

// OB82 - Diagnostic Interrupt
// Set "Module_OK" = TRUE on entry (default), FALSE if OB82 reports error
      UN    "DIAG_ERR"          // diagnostic error from local data LB8-25
      S     "Module_OK"
      BE

Combine with the value-validation FB so that any read where Module_OK = FALSE is rejected for the first 3 s of operation.

Remedy S4: Limit Monitoring with Replacement Strategy

The simplest limit check is to compare the raw count against the configured nominal range. For 4-20 mA, valid counts are 0 to 27648; anything outside is suspect.

// Function: SCALE_AND_LIMIT (FC101)
// Input  : PIW (e.g., PIW 288)
// Output : DB30.DBD0 (REAL, scaled 0-100%)
//          DB30.DBX4.0 (BOOL, "Value_Valid")

      L     PIW 288
      L     0
      >=I
      U(
      L     PIW 288
      L     27648
      <=I
      )
      =     DB30.DBX4.0         // Value_Valid flag
      SPB   OK
      L     0.0
      T     DB30.DBD0           // output = 0 if invalid
      BEA
OK:   L     PIW 288
      ITD
      DTR
      L     2.7648e+4
      /R
      T     DB30.DBD0
      BE

Sensor Power Sequencing Best Practices

Verification and Long-Term Monitoring

1. After applying the remedy, cycle station power 10 times and confirm the input word reaches a valid value within the configured settling time on every cycle.
2. Record the time from CPU RUN to first valid conversion (use the timestamp from the diagnostic buffer). Document this value for each channel.
3. Add the FB100 / FC101 validation logic to the standard analog-input library so all new installations inherit the protection.
4. For high-availability systems, route the analog input through a redundant module pair (SM331 6ES7331-7KF02-0AB0 in both racks of an H-system) and validate against both values before trusting the read.
5. Add a permanent TRACE on each validated channel using STEP 7's trend recorder, with a 100 ms sample rate and 30 s window. Save the trend as part of the commissioning report.

Troubleshooting Matrix

Engineering Sizing Notes and Standards Reference

When the analog input is part of a current loop powering a downstream actuator or relay, verify that the 24 VDC supply sizing accounts for inrush. For a four-wire transmitter drawing steady-state I_load amps, the supply must deliver:

P_supply (W) = V_bus (V) x I_load (A) x 1.25     // 25% margin for inrush

For multiple transmitters on a common PSU, sum the I_load values before applying the 1.25 margin. Do not assume the PSU rated current is available for the analog loop; CPU and IM modules draw peak currents during backplane negotiation that can dip the bus 100-300 mV, sufficient to push a 4-20 mA loop outside its regulation range if the transmitter uses the same rail.

Verify compliance with EN 61131-2 (Programmable Controllers - Equipment Requirements) for the analog signal under the worst-case supply dip. The standard permits 24 VDC supply to drop to 19.2 V (80% of nominal) for 10 ms during PSU dynamic load; analog readings captured during this window must be considered invalid and rejected by software validation.

Edge Cases and Field Commissioning Notes

Several scenarios produce the same overrange symptom but require different remedies.

Edge Case E1: Hot-Swap of SM331 in ET 200M

Replacing an SM331 module in a running ET 200M (with the IM153-2 in active mode) triggers a re-parameterization. OB82 fires, the new module is loaded with the SDT, and the input process image goes to 7FFFh for 1.5-3 s while the new module calibrates. The same FB100 validation logic handles this case without operator intervention.

Edge Case E2: Mixed 6ES7331-7KF02 and 6ES7331-7KB02 in Same Station

The 7KB02 module is the 2-channel variant; it shares the same firmware behavior as the 7KF02. When both are configured in the same station, parameterization is sequential, not parallel. If OB100 is delayed only by the 7KF02 settling time (1.5 s), the 7KB02 may still be holding 7FFFh when OB1 starts. Use the maximum of all module settling times as the OB100 delay, typically 3 s.

Edge Case E3: CPU in RUN with Module in STOP

If the SM331 is in diagnostic mode and the CPU is forced into RUN with the module not yet OK, OB82 fires repeatedly until the module is re-parameterized. The CPU does not enter STOP; it simply ignores the bad data. The FB100 validation logic must be active in this case to prevent downstream control loops from acting on 7FFFh.

Edge Case E4: PROFIBUS DP Slave Startup

If the S7-300 is a DP slave (CPU 315-2 DP, 317-2 DP) and the DP master is not yet in OPERATE, the SM331 module still receives its SDT from the local CPU and parameterizes correctly. The DP master only affects cyclic data exchange; the analog module's local parameterization is independent of PROFIBUS state. The startup limiting-value window is not affected by DP master state.

Edge Case E5: TIA Portal vs STEP 7 V5.5

The SDT format is identical between STEP 7 V5.5 and TIA Portal V13+. Migrating a project between the two does not change the SM331 parameterization timing. However, TIA Portal's online diagnostic buffer view shows additional event IDs (e.g., 0xE002 for module inserted) that are not visible in the classic STEP 7 view. Use the TIA Portal view for clearer event sequencing.

Long-Term Stability Recommendations

1. Add the FB100 validation to a project-wide analog-input library so all future installations inherit the protection.
2. Document the startup settling time per channel in the commissioning report. Use this as a baseline for future troubleshooting.
3. Schedule annual verification of the OB100 delay against the latest module firmware release. Newer firmware may narrow the settling window, allowing a shorter delay.
4. For H-systems (S7-400H with redundant SM331 modules), implement a cross-check FB that compares both modules' values and rejects if the deviation exceeds 2% of span. This catches cases where one module has drifted or partially failed.
5. Maintain a spare 6ES7331-7KF02-0AB0 module on site with known-good firmware release. Swapping modules is the fastest way to determine if the symptom is module-specific or station-specific.

FAQ