Resolving ET200S Analog Input Read Failures on S7-300 PLCs

Resolving ET200S Analog Input Read Failures on ET 200S with S7-300 PLCs

This technical reference documents a recurring field failure mode where an ET 200S distributed I/O station reports correct 4–20 mA loop current at the terminals, but the value is never visible at the configured input word (for example, %IW256) in STEP 7 / TIA Portal. The root cause is rarely a hardware fault and almost always a mismatch between the configured input address and the size of the S7-300 CPU process input image (process image of the inputs, PII). The remediation is either expanding the process image or, preferably, remapping the ET 200S analog module to addresses inside the image window. Where the application cannot tolerate the move, direct peripheral access (%IW:P) bypasses the PII and reads the value directly from the slave at the cost of longer access time.

1. Problem Statement

An ET 200S head station (IM 151-1 / IM 151-3) is connected as a PROFIBUS-DP slave to an S7-300 CPU (e.g. CPU 315-2 DP / CPU 317-2). One or more analog input modules are configured, for example:

• 6ES7 134-4GB01-0AB0 — 2AI, 4–20 mA, 13 bit + sign
• 6ES7 134-4GB11-0AB0 — 2AI, ±10 V / ±20 mA / 4–20 mA
• 6ES7 134-4GD00-0AB0 — 4AI, ±10 V / 0–10 V / 4–20 mA
• 6ES7 134-4MC00-0AB0 — 4AI, RTD/TC

After HW Config download, the I/O addresses auto-assigned by STEP 7 / TIA Portal frequently land above IW255 — for example at PIW 256 / %IW256. The S7-300 default process input image is 128 bytes (input words IW0 through IW126). Anything outside that window cannot be read symbolically through the image; the CPU updates the PII, but the area above it is reserved for non-image access only.

2. ET 200S Analog Module Fundamentals

The ET 200S analog input family resolves 4–20 mA to 0–27648 (Siemens S7 normalized range). The raw 16-bit value presented in the input word is the number representation, not engineering units — scaling is the programmer's responsibility, normally via FC105 SCALE or FC106 UNSCALE.

The full S7 normalized ranges used by these modules are:

• 4–20 mA → raw 0 to 27648 (0 mA is below the live-zero; out-of-range negative values indicate a wire break when wire-break diagnostics are enabled).
• 0–20 mA → raw 0 to 27648 (no live-zero, no wire-break detection on low end).
• ±10 V → raw –27648 to +27648.
• PT100 / PT1000 RTD → raw –2000 to +8500 representing –200.0 °C to +850.0 °C (resolution 0.1 °C).
• Thermocouple type K → raw –2700 to +13720 (°C × 10).

3. Root Cause: Process Image of the Inputs (PII)

The S7-300 OB1 cycle consists of three phases executed at the start of every scan:

1. Read inputs from the distributed I/O into the process input image (PII). Only addresses inside the configured PII window are refreshed here.
2. Execute program code (OB1). All %IW reads return the image value, not a fresh peripheral read.
3. Write outputs from the process output image (POI) to the distributed I/O.

For the S7-300 CPU 31x and CPU 319 families, the default PII is 128 bytes (input words IW0 … IW126). For CPU 312 the default is 32 bytes; for CPU 315-2 PN/DP and CPU 317-2 it is 128 bytes. The default can be enlarged in HW Config under CPU properties → Cycle / Clock bits → I/O process image size up to the CPU maximum (typically 2048 bytes on CPU 319). See the TIA Portal online help — Configuring an ET 200S.

When STEP 7 auto-assigns an ET 200S analog input starting at PIW 256, two failure modes follow:

• Mode A — symbol not updated: the address is above the PII window. %IW256 returns 0 for every scan because the image is never refreshed in that area.
• Mode B — symbol updated but wrong value: the PII was enlarged (e.g. to 256 bytes) but ET 200S module addresses were not remapped, leaving the analog input just outside the new boundary.

4. Solution 1 — Remap the Module Inside the Process Image

The most efficient fix is to remap the analog input to an address that the PII actually covers. For a default 128-byte PII this means %IW0 through %IW126. Pick a free area, e.g. starting at %IW128 for the ET 200S station:

1. Open the S7 project in STEP 7 (Classic or TIA Portal).
2. Open HW Config / Devices & Networks.
3. Click the ET 200S analog input module in the slot table.
4. In the Addresses tab, change Input start address from 256 to a value inside the PII (e.g. 128).
5. Repeat for every channel of the module (each channel occupies 2 bytes for a 4AI module, so %IW128, %IW130, %IW132, %IW134).
6. Recompile HW Config, download, and update any symbolic references in your code.
7. Open a VAT and confirm IW128 now follows the input current.

5. Solution 2 — Direct Peripheral Access (S7-300 / 400 / 1500)

When the application cannot be recompiled, or when you need an immediate debug confirmation that the module is alive, use the :P suffix to bypass the PII and read the peripheral directly:

L %IW256:P
T MW 200    // raw 16-bit AI value

Behavior of :P on S7-300:

• Read access is performed immediately, one bus cycle at a time.
• Worst-case execution time per :P read is bounded by the PROFIBUS-DP cycle of the slave (typical 1–10 ms per byte). On ET 200S, this is up to ~5 ms for the first word, and the value is then refreshed automatically by the DP master for the next 200 µs.
• The data is not placed in the PII and therefore cannot be used directly as a Boolean contact in the way image addresses are.

Verify in a VAT by entering PIW256:P in the Modify column with Monitor mode, or force the read in a one-shot OB100/OB1 block:

// OB1 — debug helper
CALL "DIRECT_READ"    // FB or FC
  PIW  := 256
  RET_VAL := MW210    // contains raw value

6. Solution 3 — Enlarge the Process Input Image

If you must keep the default STEP 7 auto-assignment at IW256 for legacy reasons:

1. Open CPU properties in HW Config.
2. Navigate to Cycle / Clock bits.
3. Set Size of the process input image to e.g. 512 (covers IW0–IW510).
4. Set Size of the process output image to a matching size if the station also contains DO.
5. Recompile and download.

CPU limits to observe:

7. Scaling: From Raw Counts to Engineering Units

Once the value is visible, scale it. STEP 7 Classic ships the Standard Library / TI-S7 Converting Blocks FC105 SCALE and FC106 UNSCALE. TIA Portal: same names, in Standard library → S7-300/400 → Blocks or in the Convert palette.

FC105 call for 4–20 mA mapped to 0–100 %:

CALL "SCALE"        // FC105
  IN     := MW200        // raw 0..27648
  HI_LIM := 100.0
  LO_LIM := 0.0
  BIPOLAR:= FALSE
  RET_VAL:= MD220        // real, 0.0..100.0

For a live-zero 4–20 mA loop, treat 0 as a fault condition rather than 0 %. Use a clamp:

L     MW200
L     0
<I           // raw < 0 → wire break or underflow
=     M 30.0  // FAULT_4_20
L     MW200
L     27648
>I           // raw > 27648 → overrange
=     M 30.1  // FAULT_OVER

8. Configuration Verification Checklist

1. Open HW Config → ET 200S → 4AI module properties → Inputs: measuring range = 4DMU (4-wire, 4–20 mA) or R-4L (4-wire, 4–20 mA, 4-channel group, live zero). Verify the diagnostic option Wire break is enabled when working in 4–20 mA mode — without it, the value silently underflows to -32768 on a broken wire.
2. Confirm the slot number of the AI module matches the physical DIP / drag-and-drop position on the ET 200S backplane.
3. In CPU properties → Cycle: PII ≥ the highest assigned input address +2 bytes (rounded up).
4. In a VAT, monitor IW<start> and verify it tracks the mA loop input. If it stays at 0, re-check the PII window. If it stays at 16#7FFF or 16#8000, the module has a hardware / wiring fault or is not being polled.
5. For ET 200S with IM 151-1 (PROFIBUS), open Online → Accessible nodes and verify the slave is reachable. If "station failure" appears in the diagnostic buffer (event ID 0x01E3 / 0x01E4 for DP), the analog module is not yet the culprit — fix DP first.

9. Special Case: Non-Siemens PROFIBUS Master

If the ET 200S is being driven by a third-party PROFIBUS master (e.g. Beckhoff CX, Wago 750-820x, Phoenix Axioline, ABB AC500), the GSD file import does not carry the module's parameter data. As a result, Siemens-specific options such as smoothing, interference frequency suppression 50/60 Hz, and diagnostic interrupt enable are not applied. See Siemens support entry 5950650 — Les données de paramétrage d'un module analogique dans un ET200 ne sont pas prises en compte lors de l'utilisation d'un maître non Siemens.

Implications for AI reading:

• The basic 4–20 mA conversion still works because the GSD provides the cyclic I/O mapping.
• Wire-break diagnostics return as channel error in the diagnostic buffer instead of driving the input word to 7FFF; verify with the master's diagnostic API, not via S7 status.
• The interference suppression default of 50 Hz must be set in the GSD configuration tool of the third-party master; without it, 60 Hz noise can ripple the LSB.

10. Troubleshooting Matrix

11. Wiring Notes for 4–20 mA on ET 200S AI

• Each ET 200S AI module has terminal groups 1/2/3/4 for the current loop. The + terminal of the transmitter feeds the + of the AI channel; – returns to the transmitter negative.
• For 2-wire (loop-powered) transmitters, use the 2-wire terminal assignment in HW Config. The ET 200S backplane powers the transmitter through the AI terminals.
• For 4-wire (self-powered) transmitters, use the 4-wire assignment; the transmitter's own 24 V powers the loop and only the signal flows into the AI.
• Shield the cable and ground the shield at the cabinet entry, not at the field device.

12. FAQ