Resolving Open Circuit on Siemens 6ES7336-4GE00-0AB0 FAI Module

1. Problem Overview

When a motorized valve position transmitter is wired to a SIMATIC SM 336 F-AI (6ES7336-4GE00-0AB0) fail-safe analog input module, the field engineer frequently encounters a persistent channel open-circuit fault: the red channel LED illuminates, the diagnostic buffer logs wire break (e.g., diagnostic event 0x0006 for channel value status), and the process value reads as 7FFFh (overflow / no valid signal) — yet a handheld multimeter inserted in series with the loop indicates a healthy 4–20 mA current flow.

The conflict between a good field measurement and a "bad" module reading is the central symptom of an incorrect 2-wire vs 4-wire wiring topology. The 6ES7336-4GE00-0AB0 is a current-input module that does not auto-detect transmitter type; the configuration is purely physical (terminal assignment) and must match the sensor design. A 2-wire loop-powered transmitter cannot be terminated to a 4-wire channel block, and vice versa, without explicit conditioning.

2. Hardware Identification: 6ES7336-4GE00-0AB0 Specifications

The module's full operating manual, including the GSD file and parameter record layout, is published on the Siemens Industry Online Support portal. Pinout and diagnostic-event tables are reproduced in the manual "SM 336 F-AI 6x0/4..20mA HART" entry ID 6ES7336-4GE00-0AB0.

3. Root Cause Analysis: 2-Wire vs 4-Wire Wiring

The physical difference between a 2-wire (loop-powered) and a 4-wire (self-powered) transmitter is fundamental:

• 2-wire transmitter: power and signal share the same pair of wires. The module's VS terminal supplies ~24 V through the transmitter, and the current drawn by the transmitter's internal electronics is proportional to the measured process variable. Typical loop resistance budget: 250 Ω at 20 mA = 5 V drop across the module's internal sense resistor + wiring.
• 4-wire transmitter: two wires for an external 24 V supply, two wires for an isolated current output. The module only reads the signal; it does not feed any power into the loop.

The 6ES7336-4GE00-0AB0 has two physically separate terminal rows on the front connector for each channel — one set labelled for 2-wire termination, one set for 4-wire. The "open circuit" LED lights up because the module's wire-break detection algorithm is a current-window check. With the Siemens default thresholds, the open-circuit diagnostic is raised if the measured loop current falls below approximately 3.6 mA (a value configurable in STEP 7 / TIA Portal between 0.0 and 22.0 mA). If the loop is wired in a topology that leaves the input pin floating relative to VS or -M, the input saturates at zero current and the diagnostic fires immediately.

4. Module Wiring Topology (Inline SVG)

The 20-pin front connector assignments for one channel pair (channels 0 and 1 shown; pattern repeats for 2/3 and 4/5) are:

5. Open-Circuit Detection Mechanism

The 6ES7336-4GE00-0AB0 implements a NAMUR NE43-style diagnostic envelope. With diagnostics enabled in the hardware configuration, the following bit positions are set in the value-status byte of the input channel:

The values are returned in the input word's value status (QI) bit (bit 15 in many STEP 7 symbol definitions) and the corresponding diagnostic event appears in the CPU diagnostic buffer with the slot number of the 6ES7336 module. When using a fail-safe block such as F_AI_8 (or F_AI_RRG for range monitoring), the wire-break event propagates into the safety logic and forces the substituted safe value (default = 0).

6. Step-by-Step Resolution Procedure

1. Isolate the loop and de-energize the backplane. Even though the SM 336's sensor supply (VS) is electronically current-limited, fail-safe modules must be worked on with the F-CPU in safe state when practical. Use STEP 7 to place the F-CPU in "STOP / safe state" if the application allows.
2. Verify the sensor type. Open the motorized valve junction box and check the position transmitter data plate. A 2-wire device will be marked "loop-powered, 4–20 mA" or "2-wire" on the nameplate; a 4-wire device lists a separate supply voltage (e.g., 24 V DC) and a "current output" rating.
3. Measure the loop voltage with a high-impedance voltmeter (≥ 10 MΩ) at the transmitter terminals. For a 2-wire transmitter you should see ~15–22 V DC (24 V minus the 5 V drop across the module's 250 Ω sense and the 0–4 V drop across the transmitter's internal regulator). Reading near 0 V indicates the module is not feeding VS into that pin; reading 24 V indicates the sensor is being fed but the loop is open.
4. Re-terminate the front connector using the 2-wire pinout:
   • Sensor (+) → front connector +VS for that channel (e.g., pin 1 for ch0)
   • Sensor (-) → front connector +M for that channel (e.g., pin 2 for ch0)
   • Bridge +M to -M with a short link on the connector if the transmitter does not provide a separate ground return (most 2-wire sensors do, in which case the link is omitted and the shield goes to PE).
5. Confirm the VS polarity and grounding. Reversed polarity on a loop-powered sensor is a frequent cause of "open circuit" even when the loop draws the right current. Verify with a multimeter: +VS must be positive with respect to -M.
6. Re-seat the front connector and power up. The red channel LED should extinguish within 1–2 scan cycles. If the SF LED on the module still illuminates, read the diagnostic buffer (STEP 7 → CPU → Diagnostic Buffer).
7. Read the analog value from the process image (e.g., IW 288 for the first channel of an SM 336 in slot 4 of an S7-300 station) and confirm a value between 0 and 27648 corresponding to the live current. For a 4–20 mA signal: 4 mA = 0 decimal, 20 mA = 27648 decimal, scaling factor = 27648 / 16 mA = 1728 counts per mA.

7. HART Diagnostic Verification

Because the 6ES7336-4GE00-0AB0 carries HART on each channel, the HART layer is an independent way to verify the loop is healthy:

1. Configure the HART variables in HW Config → Properties of the SM 336 → "HART" tab. Enable at least the primary variable (PV) and the loop current.
2. Use the online "HART device list" view (right-click module → "HART" → "Device list") to read the device tag, manufacturer ID, and revision.
3. A HART device that responds with a non-zero tag indicates the analog loop is functional and digital communication is alive. A HART "no response" with the analog current still present suggests a HART filter setting that is too aggressive or a 250 Ω HART impedance problem (the module has a 250 Ω sense resistor, so no external resistor is normally required for HART).
4. For each HART variable that returns a value, cross-check it against the analog-input value. A discrepancy greater than 1 % of span typically points to a calibration mismatch rather than a wiring issue.

8. Configuration in STEP 7 / TIA Portal

Default hardware configuration that the 6ES7336-4GE00-0AB0 ships with can mask the issue if the diagnostics are disabled. Confirm the following in the hardware configuration:

For TIA Portal users, the module is selected from the catalog under "SM 336 F-AI 6x0/4..20mA HART" (article number 6ES7336-4GE00-0AB0) and configured in the device view. STEP 7 V5.5 users find it under SIMATIC 300 → SM-300 → F-Modules.

9. LED Status and Diagnostic Code Map

The front of the SM 336 has two LED rows: a top row with the module-level status (SF = group error, BF = bus fault if Profisafe is used) and a bottom row of six channel LEDs that light in one of three colours:

10. Multi-Channel Isolation Procedure

If the SF LED persists after the suspect channel is fixed, the problem is often that a single short-circuit on one channel causes the module to latch its internal sensor-supply rail. Use this isolation sequence:

1. Disconnect all channel pairs from the front connector.
2. Power the rack and read the SF LED state. If the SF LED still lights with no sensors connected, the module itself is suspect (rare, but possible after a wiring transient).
3. Reconnect channels one at a time, waiting 5 seconds between each. When the LED comes on, you have identified the problematic channel.
4. For that channel, swap the position transmitter with a known-good 4–20 mA calibrator (e.g., Beamex MC6, Druck DPI 620). If the LED goes off, the field wiring or transmitter is at fault. If the LED remains on, the input circuit on the SM 336 is damaged.

11. Field Verification Checklist

12. Common Pitfalls and Edge Cases

• Single-channel supply latch. A short circuit on one channel can pull down the VS rail for the whole module. The SM 336 will keep the SF LED on even after the short is removed until a power cycle.
• Ex-i entity parameters. When the valve is in Zone 1, the cable run between the sensor and the SM 336 must respect the maximum allowed capacitance and inductance published in the Ex certificate. Long cable runs can cause the loop voltage to collapse, simulating a wire-break condition.
• HART filter capacitor in the transmitter. Some older position transmitters have a large filter capacitor that, combined with long cable capacitance, prevents the loop current from settling within the module's conversion window, producing intermittent diagnostics. Reduce the smoothing time or add a 250 Ω resistor at the transmitter end as a last resort (verify Ex-i compatibility first).
• Reversed shield on a 2-wire loop. If the cable shield is grounded at both ends and a small shield current flows, the resulting common-mode voltage can lift the loop current reading outside the diagnostic window.
• F-CPU passivation. After a wire-break on a fail-safe channel, the F-CPU may passivate the entire safety program. Re-integration requires the F-CPU to be brought out of safe state and the relevant F-block (e.g., F_AI_RRG) to acknowledge the passivation, which can only be done by an operator with the safety password.
• Modular vs Compact wiring. The 6ES7336 uses a 20-pin front connector with push-in or screw terminations. Mixing push-in and screw types in the same connector is not permitted and can produce poor contact on individual pins, leading to intermittent open-circuit alarms.