Resolving S7-300 SM 331 4-20mA Overrange Errors on AI 2x12 bit

1. Problem Description

A field installation using a Siemens SIMATIC S7-300 SM 331 analog input module, part number 6ES7 331-7KB02-0AB0, exhibits an apparent scaling fault on its 4-20 mA current inputs. The module is configured as a 2-wire transducer (2DMU) input and the measuring range sub-module is physically set to position "D" (the 4-20 mA / ±20 mA range).

The two input channels appear at process input words PEW 200 and PEW 202. With a 2-wire vacuum transmitter (0-1100 mbar) connected to channel 0, the following readings are observed in online mode of STEP 7:

The reading crosses the 27648 nominal maximum well before the loop current actually reaches 20 mA. The S7-300 status convention treats 27649-32511 as the legal overrange and 32512-32767 as an error/overflow band. A value of 32000 is therefore not random: it indicates that the input is being measured in the overrange window with a significant positive offset introduced by the analog front end itself, almost always caused by a floating or improperly bonded reference (MANA / M-) at the module.

2. Module Identification: 6ES7 331-7KB02-0AB0

The SM 331 analog input module in question is a 2-channel, 12-bit resolution module from the S7-300 family. Its salient specifications for this troubleshooting case are summarized below. Refer to the S7-300 Automation System Module Data manual on SiePortal for the complete specification.

The 7KB02 revision added improved isolation and a faster conversion core versus the older 7KB01, but the front-end terminal layout for the 2-wire transducer (2DMU) is identical to previous variants: the +24 V loop supply and sense resistor are multiplexed based on the sub-module position.

3. Expected S7-300 4-20 mA Scaling

For every Siemens S7 analog input configured in unipolar current mode (0-20 mA or 4-20 mA), STEP 7 maps the input range to a normalized 16-bit signed integer using the following table:

The linear transfer function for the 4-20 mA range is therefore:

PEW = ((I_loop - 4) / 16) × 27648
I_loop = (PEW / 27648) × 16 + 4

Worked example: at 17.1 mA, the expected PEW = ((17.1 - 4) / 16) × 27648 = 0.8188 × 27648 = 22,641. The field reading of 29,276 is therefore 29.3% above the expected value, which cannot be attributed to tolerance, RTD self-heating, or 12-bit quantization (the LSB step at 20 mA is 4.4 µA, so quantization error is < 0.1% of span).

4. Root Cause: Floating MANA Reference (Ground Loop at the Front End)

The most common reason an S7-300 SM 331 returns readings above 27648 at sub-nominal current is that the analog reference, the MANA terminal (terminal 11 on the front connector), is not bonded to the system ground at the same potential as the 2-wire transmitter's return path. When MANA floats, the input op-amp at the module's front end sees an undefined common-mode voltage. This voltage is added in series with the sense resistor, and the resulting offset is amplified through the same 12-bit ADC used for the signal itself.

The mathematical effect of a floating MANA is:

PEW_measured = (I_loop + I_offset(V_CM,R_Leakage,C_Parasitic)) × 27648 / 16 + 4

Where V_CM is the un-bonded common-mode voltage between the transmitter's loop return and the chassis ground of the SM 331, typically induced by capacitive coupling from adjacent 400 V cables, VFD output conductors, or ungrounded cable shields. The displacement current I_offset is in the order of 0.1 to 5 mA, which matches the field observation of 29276 at 17.1 mA (an apparent extra 1.6 mA / 105% of reading) and 32000 at 17.2 mA (an apparent extra 3.4 mA / 119% of reading).

Two further failure modes present the same symptom and must be ruled out before assuming a floating MANA:

1. Sub-module position mismatch: If the measuring range sub-module (the small insert on the left side of the module) is set to position A/B/C (voltage) but the HW Config in STEP 7 reports the channel as 4-20 mA, the module drives the wrong front-end path and may report 30,000+ for any positive current. Always verify that the sub-module letter matches the HW Config measurement type and range.
2. 4-wire transmitter wired to 2-wire terminal pair: If a 4-wire active sensor (separate +24 V supply and signal output) is connected to the 2DMU terminals (terminals 2/3 on CH0), the module's internal 24 V source fights the sensor's own loop supply, producing a current that exceeds the nominal 20 mA and the reading will saturate to 32767. Per the S7-300 Module Data manual, the 2-wire transducer (2DMU) is the only configuration that expects terminals 2(+) and 3(-) of the channel in question.

5. Hardware Configuration: The Measuring Range Sub-Module

The SM 331 uses a small insertable sub-module (often called the "measuring range module") on the left side of the module body. This sub-module selects the input front-end gain, filter, and terminal routing. For the 6ES7 331-7KB02-0AB0 the four positions are:

If the sub-module is set to C instead of D, the module does not source the 24 V loop supply, the 2-wire sensor does not power up, the current stays at or below 4 mA, and the value will read close to 0 (or 32767 if open-circuit). If the sub-module is set to A or B and the channel is misconfigured to "4-20 mA" in HW Config, the front-end network presents a high impedance to a current source, and small leakage on the ungrounded input can produce 28000-32000 readings on an open terminal.

6. Wiring Correction for the 2-DMU 2-Wire Sensor

For a 2-wire, loop-powered 4-20 mA sensor (the vacuum transmitter in this case), the SM 331 manual specifies the following terminal assignment on the 20-pin front connector. This is the authoritative wiring for the 6ES7 331-7KB02-0AB0 with sub-module in position D, channel CH0:

For a 2DMU loop, the only two terminals that carry signal are 2 (+) and 3 (-). Terminal 11 is the analog ground and must be bonded to terminal 5 (chassis / shield bond). If terminal 11 is left floating, the input op-amp has no defined common-mode reference, and the symptom described in the field report (readings above 27648 with sub-nominal loop current) appears.

7. Step-by-Step Resolution Procedure

Execute the following steps in order. Each step is independently verifiable and isolates one layer of the fault path.

Step 1 - Lock out and de-energize

1. Place the S7-300 in STOP mode from the programming device, or use the mode selector to RUN-to-STOP.
2. Isolate the 24 VDC supply feeding the analog input loop and the module's L+ terminal.
3. Verify zero energy with a calibrated multimeter at the front connector.

Step 2 - Verify the sub-module position

1. Unclip the front connector from the SM 331.
2. Slide the module out of the rack by ~ 5 cm.
3. Read the sub-module letter on the left side of the module. It must be D for 4-20 mA, 2-wire.
4. If the sub-module is not in D, reposition it, and re-seat the module.

Step 3 - Rebuild the wiring per the manual

1. Strip and re-terminate the sensor cable on a NEW 20-pin front connector (do not reuse the suspect one).
2. Connect terminal 2 to the transmitter + (red lead).
3. Connect terminal 3 to the transmitter - (black lead).
4. Connect terminal 11 (MANA) directly to terminal 5 (M / shield bond).
5. Leave terminal 10 (Comp+) unconnected for current mode.
6. Bond the cable shield at the panel gland, do not bond at the sensor end (avoids shield ground loops).

Step 4 - Re-verify HW Config in STEP 7

1. Open HW Config in STEP 7 (V5.x or TIA Portal, depending on the project).
2. Double-click the SM 331 entry in slot 4 (or wherever it is placed).
3. Open Properties > Inputs.
4. Confirm Measurement type = 2DMU (2-wire transducer).
5. Confirm Measuring range = 4 - 20 mA.
6. Save, recompile, and download the HW Config to the CPU.

Step 5 - Power up and verify loop current

1. Re-energize the 24 VDC supply to L+ and the analog loop.
2. Switch the CPU to RUN.
3. Place a calibrated multimeter in SERIES in the loop (break the wire at terminal 3 and insert the meter in mA mode).
4. Read the actual loop current. For a 0-1100 mbar transmitter at atmospheric pressure, expect ~ 4 mA. For full vacuum, expect ~ 20 mA.
5. Go online and monitor PEW 200. It should now scale as 0 to 27648 across the 4-20 mA range.

Step 6 - Add a normalization check in the PLC program (optional)

Add a sanity check that flags any PEW value above 27648 and below 0 as a wiring or sensor fault. Use a simple comparator:

// STL / SCL example for S7-300
L PEW 200                  // Load the analog input
L 27648                    // Compare against nominal max
>I                         // Greater than? (CC1 = 1 if yes)
= M 100.0                  // Set "overrange" marker bit

L PEW 200
L 0
<I                         // Less than zero?
= M 100.1                  // Set "underrange" marker bit

L PEW 200
L 0
==I                        // Equals zero? (could be 4 mA or wire break)
= M 100.2                  // Set "live zero / wire break" marker bit

Wire these markers to the HMI or to the SCADA alarm log so a similar fault in the future is reported in seconds, not at the next calibration visit.

8. Verification Procedure

After applying the correction, perform the following calibration verification to confirm the module is in spec. Use a precision mA source (e.g., Beamex MC6, WIKA CPB5000, or a Fluke 754 with the appropriate module) or a 24 V loop supply with a high-precision decade resistor. Do not rely on the field transmitter for verification - the sensor itself can drift, and you want to verify the module first.

If any reading falls outside the acceptable range, the module is faulty and should be replaced with a new 6ES7 331-7KB02-0AB0. The diagnostic event log will also record a "channel fault" for the affected channel. To view this in STEP 7, open the CPU's diagnostic buffer (PLC > Module Information > Diagnostic Buffer) and look for event ID 0x0502 or 0x0503 shortly after power-up.

9. Related Failure Modes on Other SIMATIC Platforms

The floating-reference symptom is not unique to the S7-300. The same physical phenomenon appears on S7-1200 and S7-1500 systems when the analog common (M on the SM 1231, or the M terminal on the AQ module) is not bonded to the supply 24 V return, or when two analog sensors are powered from different supplies (for example, one from the PLC's 24 VDC sensor supply and one from an external 12 VDC wall adapter). The two rails then develop a few hundred millivolts of potential difference, which the analog front end treats as an offset current.

Symptom signature on S7-1200/S7-1500:

• One or more channels read negative when no signal is applied, or read 32000-32767 at low signal.
• The diagnostic event log records "Analog input wire break" or "Overrange" on channels that are physically intact.
• Replacing the analog module does not resolve the issue; the issue follows the field wiring.

Field-proven fix: tie all analog commons (MANA, M, sensor 0 V, transmitter 0 V) to a single point, the panel-side 24 V return, and only at one point. Do not bond analog common to earth, do not bond to chassis at multiple points, and do not let cable shields carry the return current.

10. Field Commissioning Checklist

Use this checklist on every SM 331 installation that exhibits out-of-range readings. Each item is a single-pass test.

1. Sub-module letter matches the HW Config measurement type (D for 4-20 mA 2DMU).
2. Terminal 11 (MANA) is bonded to terminal 5 (M / shield bond) on the front connector.
3. Terminal 10 (Comp+) is left unconnected for current ranges.
4. Sensor + is on terminal 2 (CH0) or 1 (CH1).
5. Sensor - is on terminal 3 (CH0) or 4 (CH1).
6. Loop current verified with a series ammeter at 4 mA, 12 mA, and 20 mA points.
7. PEW value tracks loop current within ± 0.3% of span.
8. Diagnostic buffer is free of 0x0502, 0x0503, or wire-break events.
9. Cable shield is bonded at the panel gland only, not at the sensor end.
10. PLC program includes an overrange and underrange alarm on the analog word.

11. Frequently Asked Questions