Fixing HART 7 PV Freeze on Siemens 6ES7331-7TF01-0AB0 ET 200M

Problem Statement

Engineers deploying a Siemens SIMATIC ET 200M distributed I/O station equipped with the SM 331 HART analog input module (order number 6ES7331-7TF01-0AB0) frequently report a recurring field symptom when pairing the module with a HART revision 7 field transmitter such as a KROHNE OPTIFLEX or OPTIWAVE series level device.

The failure pattern is deterministic and easy to reproduce:

1. Power is applied to the HART 7 transmitter.
2. The SM 331 HART AI module reports a valid Primary Variable (PV), Secondary Variable (SV), Tertiary Variable (TV), and Quaternary Variable (QV) in the S7 process image for approximately 60 seconds.
3. The PV value then freezes at the last reported engineering unit. The 4–20 mA loop current may continue to track the true process variable, but the S7 tag value remains static.
4. Power-cycling the field transmitter restarts the same one-minute window of correct updates before the value freezes again.
5. The issue is specific to HART 7 transmitters. Swapping in an older HART 5 or HART 6 unit on the same channel restores continuous, healthy PV/SV/TV/QV updates indefinitely.

Affected Hardware Identification

Confirm that the module under test is the HART-capable variant and not a standard SM 331. The HART modules are identifiable by their order number suffix and by the HART logo on the front label.

The module is hosted on either an IM 153-1, IM 153-2, or IM 153-4 PN interface module in the ET 200M rack. HART communication is overlaid on the 4–20 mA loop using the Bell 202 frequency-shift-keyed signal at 1200 bps. The module's FW 3.x.x firmware (per the symptom report) executes the HART state machine that polls PV/SV/TV/QV via universal commands 03 (Read Dynamic Variables) and 09 (Read Device Variables with Status).

HART Protocol Revision Compatibility

The Highway Addressable Remote Transducer (HART) protocol is governed by the FieldComm Group. Each device declares a Device Revision, a Protocol Revision (commonly 5, 6, or 7), and a Universal Command Revision. The HART 7 standard added WirelessHART, Block Transfer, and Device Variables 17–32 in addition to features such as time-stamped data, long tag, and enhanced burst mode.

Per FieldComm Group documentation, the HART revision family is designed to be backward compatible: a HART 7 host must still respond correctly to commands introduced in HART 5 and 6. In practice, the older the host's HART state-machine implementation, the more likely it is to mis-handle a new revision's variable map, response code, or device-status bits.

The Siemens SM 331 6ES7331-7TF01-0AB0 with firmware 3.x.x supports the original HART command set and was engineered against HART 5/6 reference behavior. When a HART 7 transmitter such as the KROHNE OPTIFLEX 1300, OPTIWAVE 5400, or OPTIFLUX 7300 is connected, the host's burst-management and command-9 parser can fail to refresh the dynamic variables, leading directly to the one-minute freeze behavior described in the field.

Root Cause Analysis

The 60-second freeze is a strong tell-tale of a HART burst-mode or token-passing collision between the AI module and the transmitter. The most likely failure paths, in order of frequency, are:

1. HART 7 device-variable mapping mismatch. Command 09 in HART 7 returns up to 32 device variables in a TLV structure. The SM 331 firmware 3.x.x parser expects the original 4-variable layout. After parsing, the module attempts to resynchronize; the next valid transaction occurs on the burst announcement of the new device, but only one cycle of fresh data is delivered before the parser re-encounters an unrecognized status byte and latches.
2. Long-tag (32-character) presence. HART 7 introduced command 22 (Read Long Tag). If the KROHNE device is configured with a long tag and the host requests it via command 22, the AI module's HART task can stall awaiting a reply that the module's reply buffer cannot reconstruct.
3. Time-stamped PV delivery (HART 7 command 78). KROHNE devices with firmware that defaults to timestamped PV will only respond to command 78. The SM 331 firmware 3.x.x does not issue command 78, so the transmitter does not stream new data after the first 60-second acknowledge window.
4. Preamble mismatch. HART 7 allows preamble lengths from 5 to 20 bytes. Older Siemens modules default to a fixed 5-byte preamble. The KROHNE unit may have negotiated a longer preamble that the module's UART framing logic misinterprets as a corrupted frame after the first minute.

Diagnostic Procedure

Use this procedure to confirm the failure mode and isolate the responsible variable. All steps assume STEP 7 V5.5 or TIA Portal with the ET 200M HSP installed.

1. Read module firmware. In HW Config / Device View, right-click the SM 331 → Module Information → Diagnostic tab. Record the firmware version (expected: V3.x.x) and the order number. Confirm the module is seated on the correct IM 153.
2. Insert a 250 Ω HART communicator in parallel on the loop (e.g., Emerson 475/375, ABB DHH805, or Siemens SMARTLINE). Read the connected device and verify the protocol revision reported by the KROHNE transmitter is 7.
3. Enable HART diagnostics in STEP 7. In HW Config, open the module properties → Diagnostics tab, enable "HART communication error" and "HART primary variable out of limits." Save and download to the CPU.
4. Monitor the S7 status bits. The SM 331 exposes a per-channel quality byte. If QUALITY = 0xC0 (Good) but VALUE = constant, the HART communication is technically active but the dynamic update has stopped — a textbook HART-7 host incompatibility.
5. Swap with a HART 5 or HART 6 transmitter on the same channel. If the new transmitter updates continuously, the host is functional and the issue is on the KROHNE HART 7 side.
6. Capture the HART frame log. Use a HART protocol analyzer (e.g., ProComSol DevCom2000 with frame capture, or Beamex MC6) at the AI terminals. Look for: missing command 09 responses after the first ~60 s, NACK from the host, or unexpected preamble length.
7. Check the KROHne transmitter's HART configuration menu. Look for parameters labeled HART revision, burst mode, preamble, and long tag. Note the present values.

Solution 1: Siemens Module Firmware Update

Siemens released firmware updates for the SM 331 6ES7331-7TF01-0AB0 family that explicitly add HART 7 support (rev 1.0 of the universal commands and rev 2 of the common-practice commands). The relevant firmware updates are:

To update the firmware:

1. Download the firmware file (FWUPDATE.S7F or similar) from the Siemens Industry Online Support portal at SIMATIC ET 200M HART analog modules manual entry.
2. Connect the programming device to the CPU (PROFIBUS or PROFINET) and open STEP 7.
3. Select PLC → Module Information → Firmware Update (available in STEP 7 V5.5 SP2 and later).
4. Select the SM 331 channel, browse to the firmware file, and start the update. The module reboots automatically.
5. After the update, repeat the diagnostic procedure to confirm the PV updates continuously.

Solution 2: HART Multiplexer / Multi-Variable Display

If the module firmware cannot be updated (legacy STEP 7 environment, validated system, or firmware cap), insert a stand-alone HART multiplexer that polls all four variables and re-emits them to the AI module as a single HART stream. This offloads the HART 7 parsing from the SM 331.

The standard wiring topology replaces the direct transmitter-to-AI connection. The multiplexer sits in the field enclosure, polls the HART 7 transmitter using its full HART 7 command set, and re-transmits a HART 5/6-compatible stream (or a Modbus TCP output) to the S7 input. The AI module then continues to function as if a legacy transmitter were connected.

Solution 3: HART Version Downgrade on the Field Device

Several transmitter manufacturers — including Rosemount, Endress+Hauser, and KROHNE — allow the HART revision to be forced to 5 or 6 from the device's local display or via HART command. This is the least invasive path when firmware updates are blocked.

1. Connect a HART 475/375 communicator to the transmitter loop.
2. Navigate to Configure → HART → Output → HART Revision (KROHNE PACTware / HART menu path varies by series).
3. Select HART 5 or HART 6.
4. Write the change to the device and power-cycle.
5. Re-test on the 6ES7331-7TF01-0AB0 channel. The PV/SV/TV/QV values should now refresh continuously.

Verification

After applying any of the three solutions above, perform these verification steps to confirm the issue is resolved:

1. Watchdog test: Force the process variable on the KROHNE transmitter to change every 5 seconds. In WinCC, FactoryTalk View, or TIA Portal HMI, observe the S7 tag for 30 minutes. The value must track within 2 HART cycles (≤ 500 ms) of the change.
2. Diagnostic byte check: Confirm that the SM 331 channel's diagnostic byte remains 0x00 (no fault) for the full test window.
3. Power-cycle test: Remove and re-apply 24 V DC to the transmitter 5 times. Each cold start should yield healthy PV within 5 s and maintain it indefinitely.
4. Burst mode test: Enable HART burst mode on the KROHNE transmitter (Command 109) and verify the AI module continues to refresh correctly.
5. SV/TV/QV verification: Use the SFC58 / SFC59 (READ_REC / WR_REC) in the S7 program to read the HART variable record; the SV/TV/QV slots must return fresh engineering units, not the freeze value.

Troubleshooting Matrix

Long-Term Recommendations

For new deployments, Siemens recommends migrating to the S7-1500 family with the AI 8xU/I/RTD/TC HART (order 6ES7531-7KF00-0AB0) or the ET 200SP AI 4xI 2-/4-wire HART module (6ES7134-6TD00-0CA1). Both natively support HART 7 universal commands 1, 2, 3, 9, 12, 13, 14, 15, 16, 33, 48, 109, and command 78 timestamped data without requiring a multiplexer.

For brownfield sites, the multiplexer path (Solution 2) provides a clean upgrade without disturbing the validated S7-300 / ET 200M program and I/O layout. The multiplexer is also the recommended approach when WirelessHART adapters or HART-IP gateways are being added to the same loop for IIoT data acquisition.