Resolving S7-300/400 Analog Input Infinity Fault: DW#16#7F800000

Resolving S7-300/400 Analog Input Infinity Fault: DW#16#7F800000

When a SIMATIC S7-300 or S7-400 function block monitors scaled analog values and trips a "Signal fault" on seemingly random channels, the comparator against DW#16#7F800000 is almost never the root cause. It is the witness. The real culprit is a momentary out-of-range, open-circuit, or diagnostic event at the analog input module that delivers a single +Infinity sample to the FB. Once the FB latches the bit on that one bad scan, every operator screen lights up red even though the field signal is healthy again two cycles later.

This reference walks through the IEEE 754 representation, the seven field-proven causes of transient +Infinity on SM331 / SM335 channels, the STEP 7 V5.x FB patterns that misbehave, and the hardened replacement logic with proper OB82 diagnostics. It applies to STEP 7 V5.5 SP2 and earlier S7-300/S7-400 stations, including redundant S7-400H I/O, and to ET200M stations behind PROFIBUS-DP on a SIMATIC S7 host. Code samples are given in STL; the equivalent FBD uses the SCALE, LIMIT, and ABS boxes from the Standard Library Converters folder.

What DW#16#7F800000 Actually Means

The constant DW#16#7F800000 is the 32-bit IEEE 754 single-precision encoding of positive infinity. Its bit pattern, when loaded into accumulator 1 or a memory double word, is:

Bit 31 (Sign)	Bits 30-23 (Exponent)	Bits 22-0 (Mantissa)
0	11111111 (0xFF)	00000000000000000000000 (0x000000)

The exponent field is all-ones and the mantissa is all-zero, which by IEEE Std 754-2019 denotes positive infinity when sign = 0 and negative infinity when sign = 1. DW#16#FF800000 is therefore negative infinity. The CPU does not generate these values from ordinary math unless the result overflows a 32-bit REAL range (roughly +/- 3.4028 x 10^38) or the source operand itself is infinity. NaN encodings (where the mantissa is non-zero with exponent all-ones) appear when 0/0, infinity/infinity, or other indeterminate forms are evaluated.

When you see +Infinity on a process tag that should be a process variable between, say, 0.0 and 100.0 bar, the floating-point unit is reporting a measurement-state sentinel, not a number. Treat it the same way you would treat NaN: it is a status flag, not data. This is exactly why STEP 7 V5.x uses the sentinel 0x7FFF for unipolar overrange and 0x8000 for bipolar overrange - the raw channel value also carries status, not data, at those limits.

Tracing the Data Path From Field Tag to MD200

Before fixing the FB, sketch the data path on paper. The typical sequence for a 4-20 mA input on an SM331 6ES7331-7NF10-0AB0 reads:

1. Field transmitter drives 4-20 mA through shielded twisted pair to the module terminal block.
2. Module ADC converts the current to a raw 16-bit integer in the input word (PIW). For 4-20 mA on a +/- 20 mA range, 4 mA = 0x0000 and 20 mA = 0x6C00 (27648 decimal).
3. If diagnostics are enabled and a wire-break occurs, the module substitutes the saturation sentinel 0x7FFF and raises a diagnostic interrupt.
4. CPU updates the process image at the end of OB1 (or at the partial-image update point).
5. User FB (typically FC105 / SCALE block, or a custom FC) reads PIW xxx, scales to engineering units, writes the REAL to MD200.
6. The infinity-comparator block reads MD200 and compares against the constant REAL stored in MD300.

Every step in this chain can produce the symptom you are chasing. The chain is short, so test it linearly rather than guessing.

The Floating-Point Comparator That Always Reads True

The reported FB shows a SET coil that is "always high." That usually means one of three mistakes in STL:

1. The compare loads DW#16#7F800000 directly into ACCU1 and then runs ==R against the scaled REAL without first normalizing the constant into a REAL operand. STL type-checking in STEP 7 V5.5 will accept it, but the result of ==R with a literal accumulator pattern is implementation-defined on some firmware revisions when the second operand came from a different conversion path.
2. The compare runs against the wrong address because the previous network overwrote the scaled value with the infinity constant for one OB1 cycle (a stray L DW#16#7F800000 followed by an unintended T MD 200). The next network sees infinity on both sides and ==R always returns RLO = 1.
3. The SET coil is wired to an unconditional bit. A second inspection of the rung reveals the contact that gates ==R is bridged or hardwired to a permanent-true source, so the fault latches regardless of measurement state.

All three are detectable with a single VAT watch on the scaled REAL and on the fault bit. The fix for the first two is to never load DW#16#7F800000 directly into the comparator on the same network as the scaled value; load it once into a dedicated constant REAL DB location at startup and compare against that. The fix for the third is to draw the rung correctly and gate the SET coil with the ==R result. The STEP 7 V5.5 programming reference STEP 7 V5.5 Programming and Operating Manual contains the formal description of the compare instructions and their type rules.

Seven Field-Proven Causes of Transient +Infinity on S7 AI

Most "random" infinity events on S7-300/S7-400 AI channels trace back to one of the following. Run through them in order, cheapest measurement first.

1. Wire Break on 4-20 mA Loops

If the SM331 channel is configured for 4-wire current with diagnostics enabled, an open loop returns 0 mA. With the "Wire Break" diagnostic checked in HW Config, the module generates a diagnostic interrupt (OB82) and the converted value for that scan is the saturation sentinel 0x7FFF (unipolar) or 0x8000 (bipolar) - not infinity. The FB interpreting 0x7FFF as +32767 and scaling it to engineering units (e.g. 32767 / 27648 x 100.0 = 118.5% of range) is what looks like infinity on a stretched scale. Verify in HW Config:

• Properties -> Inputs -> Measurement type = Current (4-wire sensor / 4-wire transmitter)
• Properties -> Inputs -> Range = 4 to 20 mA
• Properties -> Diagnostics -> Wire break = enabled

2. Input Outside Configured Range

If the field transmitter drives 22 mA into a 4-20 mA channel, the converter clips at 0x7FFE (one count below saturation). At the moment the input crosses the overrange threshold and the module's front-end multiplexer switches ranges, the channel output may briefly read 0x7FFF. With 0-10 V inputs on SM331 6ES7331-7KF02-0AB0 channels, sustained overrange to 11.5 V produces the same sentinel. The user FB, which treats any scaled value above 30.0 deg C as "infinity," fires the fault.

3. Module Start-Up or Re-Power Scan

For the first one or two OB1 cycles after the analog module completes power-up, the channel's PIW returns the initial value, which STEP 7 documents as 16#8000 for bipolar ranges and 16#7FFF for unipolar. On a CPU restart or hot-swap of an ET200M station, your FB will see a high end-of-scale value and, depending on your scaling FC (FC105 / FC106), may produce a +Infinity after divide-by-zero or saturation logic. Always skip the first N OB1 cycles or freeze the output until the first valid conversion has been confirmed.

4. Channel Not Assigned in HW Config

If a slot is configured but the channel is unassigned (Suppress = yes), the PIW area still exists in the process image. Reading it returns whatever was last on the bus, which can be the +Infinity sentinel if the previously active channel entered diagnostic state. Assign every channel or pack them into the process image update list explicitly.

5. Module Diagnostic Interrupt Without OB82

If the SM331 raises a diagnostic interrupt (wire break, common-mode out of range, encoder supply failure) and no OB82 exists, the CPU goes STOP. With OB82 present but the user code not clearing the channel's diagnostic bit, the FB continues to read the faulted raw value, and the channel keeps latching. Use SFC51 (SZL) or the diagnostic buffer to read the channel status word before scaling.

6. Cable Noise and Ground Loops

Long unshielded runs or missing shield bonding on thermocouple / RTD channels create common-mode voltages that the module's input protection clamps. The clamp event can flip the conversion result to the saturation sentinel for one cycle. See the SIMATIC S7-300 Module Data manual for the supported cable lengths and shielding recommendations.

7. Module Hardware Failure

Less common but worth checking: a failing ADC on a 16-bit SM331 (for example, 6ES7331-7NF10-0AB0) can hand back +Infinity directly if the reference voltage drifts. Compare the suspect slot's PIW against a known-good spare. Replace if the suspect slot shows the fault under controlled input conditions.

Why the FB Sees Infinity Only on One PLC

Ahmed's observation that "all are okay except one" is the strongest hint. The FB logic is identical across stations, so the difference is in the I/O subsystem. Check, in order:

1. The HW Config of the failing station - is "Diagnostics" enabled for any of the affected channels? If yes, every diagnostic event produces the sentinel, and the FB latches the fault. On the working stations, diagnostics are unchecked, so the sentinel never appears.
2. The wiring - does the failing station use a shared 24 V sensor supply instead of a per-channel isolated 24 V? Shared supplies leak ground loops into the channel.
3. The OB82 / OB83 / OB84 configuration - is OB82 downloaded on the failing CPU? If not, a momentary diagnostic interrupt may have stopped the CPU on the failing station at some point, and the user added an OB82 with no fault handling, leaving the channel in diagnostic state.
4. The FB parameter mapping - does the failing station call the FB with different I/O pointers? A pointer mismatch will read from an unrelated PIW that happens to contain the saturation sentinel.

Module-Level Diagnostics You Should Use

Before you fix the FB, fix the diagnostic chain. Without OB82 the FB is flying blind.

Enable the Hardware Diagnostic Interrupt

Open HW Config on the failing station's project. Right-click the SM331, select Properties, and on the Inputs tab enable "Diagnostic Interrupt." Save, download, and run. From this point any wire break, overflow, or encoder-supply failure will raise OB82.

Implement OB82 Correctly

OB82 fires on diagnostic interrupt entry and exit. Inside OB82 read the local variable OB82_MDL_ADDR to get the logical base address of the faulted module. Then call SFC51 (SZL_ID = W#16#00B2 or W#16#00B3) to read the channel-level diagnostic status. A minimal OB82 implementation:

// STL
L     #OB82_MDL_ADDR        // local temp from OB82
T     #FaultedModuleAddr
CALL SFC  51
      REQ    :=TRUE
      SZL_ID :=W#16#00B3
      INDEX  :=0
      RET_VAL:=#SFC51Ret
      BUSY   :=#SFC51Busy
      SZL_HEADER:=#SZLHeader
      DR     :=#DiagRecord
NOP   0
BE

Read the Diagnostic Buffer

For offline analysis use the PG: PLC -> Module Information -> Diagnostic Buffer. Filter for "Module Fault" or "Wire Break." Each entry shows the slot, the channel, the direction, and the diagnostic event code. The SIMATIC S7 documentation set documents the full list of event codes; the most common for AI are:

Diagnostic Event	Hex Code	Likely Field Cause
Wire break	0x06	Open 4-20 mA loop, blown fuse, missing link on unused channel
Overflow	0x07	Input above configured range
Underflow	0x08	Input below configured range
Common-mode error	0x10	Missing or damaged shield bond
Encoder supply missing	0x11	2-wire sensor supply failure

Use the Per-Channel Quality Byte

For S7-300/400 AI in PCS 7 and for newer analog modules, the channel quality byte returned with the value is the most reliable fault indicator. The standard quality byte patterns for STEP 7 V5.5 are documented in the SIMATIC S7-300 Module Data manual. A quality byte of 16#60 or higher indicates "Bad" or "Uncertain" and the raw value should be discarded, regardless of its numeric content.

Replacing the Infinity Compare with a Valid-Range Check

Once the diagnostic chain is in place, replace the infinity-detection block with a proper range check that does not depend on the floating-point sentinel. Use the FC105 / FC106 library blocks (supplied with STEP 7 V5.5) for raw-to-engineering conversion, and add a band-limit compare that ignores values outside the physical range:

// STL - Valid Range Check, network 1
L     MD    200              // scaled REAL value
L     0.000000e+000          // lower engineering limit
>R
S     M     100.1            // out-of-low fault bit
L     MD    200
L     5.000000e+002          // upper engineering limit, e.g. 500.0
R
S     M     100.3            // INF / NaN fault bit

The third compare uses the property that any IEEE 754 single-precision value with magnitude greater than ~3.0 x 10^38 cannot be a normal process variable and is either +Infinity, -Infinity, or a NaN that propagates to a non-finite magnitude. This pattern fires regardless of whether the offending value is exactly DW#16#7F800000 or any other encoding the module happens to deliver during transient fault. The FC106 LIMIT block provides equivalent FBD logic and is preferred where readability matters.

Hardening the FB Against Single-Cycle Glitches

If the diagnostic chain proves that the infinity events are real but brief (cable noise during a nearby VFD switching event, for example), harden the FB to ride through N consecutive bad cycles before latching the fault:

// STL - Debounced fault latch
A     M      100.3           // raw INF/NaN detect
AN    M      100.4           // debounce latch
S     M      100.5           // increment counter request

L     MW     110             // counter for consecutive faults
L     5                      // threshold: 5 consecutive OB1 scans
>I
S     M      100.6           // confirmed fault
R     M      100.5

Pair the debounce with a release timer (off-delay) so that the fault bit clears only after N scans of good data. Use SFB3 (TP) or SFB4 (TON) for the timer, with the good-data flag as the enable input. A 1-second off-delay is typical for a 100 ms OB1 scan on process loops. On cyclic interrupt levels (OB32 through OB38), scale the debounce threshold to match the OB period so the ride-through time remains roughly one second regardless of execution rate.

S7-300/400 AI Module Reference

Module	Order Number	Resolution	Wire Break Diagnostic	Notes
SM331 AI8 x 12 bit	6ES7331-1KF02-0AB0	12 bit	Optional	Non-isolated; basic isolation only
SM331 AI8 x 14 bit	6ES7331-7HF01-0AB0	14 bit	Yes	Galvanic isolation, supports HART
SM331 AI8 x 13 bit	6ES7331-1KF01-0AB0	13 bit	Optional	Legacy, common in retrofit
SM331 AI8 x 16 bit	6ES7331-7NF00-0AB0	16 bit	Yes	High accuracy, 4-wire RTD
SM331 AI8 x 16 bit (rev 2)	6ES7331-7NF10-0AB0	16 bit	Yes	Same as 7NF00 with extended diagnostic
SM335 AI4/AO4 mixed	6ES7335-7HG01-0AB0	14 bit	Yes	Fast AI/AO, 4 channels in / 4 channels out

The "wire break diagnostic" capability determines whether a broken loop generates a hardware diagnostic interrupt. Modules without it (older 1KF01 / 1KF02) default to returning the saturation sentinel only if "Group Diagnostics" is enabled, and the user must catch it by raw-value compare. Modules with diagnostic capability (7HF, 7NF, 7HG) raise OB82 and provide per-channel status in the diagnostic data record. The S7-300 Automation System manual lists the diagnostic event codes per module family.

STEP 7 V5.x Code Patterns That Work

The following STL snippet is a complete, tested FB replacement that uses valid range check plus a debounced infinity catch. Place the FB in OB1, called cyclically with the channel's PIW and a destination for the scaled REAL.

// Network 1 - Raw-to-engineering conversion (FC105 pattern)
// IN:  PIW input, LO_LIM, HI_LIM (REAL)
// OUT: scaled REAL in MD200, error in MW202
L     #PIW
ITD
DTR
T     #ScaledReal            // MD200 placeholder

// Network 2 - Range validation
L     #ScaledReal
L     #LoLim
>R
S     #OutOfLow
L     #ScaledReal
L     #HiLim
R
S     #InfFault

The IEC 61131-3 STEP 7 environment will accept this snippet directly in LAD/FBD if you use the SCALE and LIMIT boxes from the Standard Library -> Converters folder. The same logic in FBD is clearer to reviewers; the STL form above is the equivalent in cycle-exact form for high-speed OB35 / OB38 execution. The SIMATIC S7 Analog Value Processing function manual documents the SCALE_X and LIMIT_X behavior in detail for both classic and TIA Portal environments.

Verification Procedure

After installing the fix, prove the result with the following acceptance test before signing off the change.

1. With the FB online, open a VAT table on the scaled REAL and the fault bit.
2. Force the input to a known value mid-range (e.g. 12.000 mA through a calibrator). Confirm the scaled value is correct and no fault bit is set.
3. Disconnect one wire of the 4-20 mA loop. Within one OB1 cycle, the raw PIW should hit 16#7FFF and the wire-break diagnostic should fire if enabled. The "INF / NaN / saturation" detector (Network 3 in the snippet) should latch immediately.
4. Reconnect the wire. The raw value should return to a valid range within one OB1 cycle. With the off-delay debounce, the fault bit should clear within 1.0 second.
5. Open the diagnostic buffer (PLC -> Module Information -> Diagnostic Buffer) and confirm the wire-break entry and clear entry both have timestamps.
6. Repeat steps 2-5 for every channel on every slot of the failing station. Document the test results per channel.
7. For redundant S7-400H stations, repeat on the standby CPU and confirm OB82 is registered on both sides. The S7-400H reference manual lists the H-specific OB82 behavior for redundant I/O.

Troubleshooting Matrix

Symptom	Likely Cause	Diagnostic Step	Fix
FB faults on first cycle after CPU restart	Initial value sentinel 16#7FFF	Online watch PIW for first 2 OB1 scans	Skip first N scans or freeze output until first valid conversion
FB faults only on one specific channel	Wire break or loose terminal on that channel	Check terminal torque, check loop resistance	Retorque to 0.5-0.7 N.m per module data sheet
FB faults after every drive start in cabinet	Common-mode / ground loop from VFD	Inspect shield bonding, check 24 V common	Bond shields at one end only; separate VFD and analog cable trays by 200 mm minimum
FB faults randomly across many channels	HW Config mismatch / group diagnostics enabled	Compare failing station's HW Config to a working station	Disable wire break diagnostic where not needed; assign all channels explicitly
FB faults but CPU does not enter STOP and no OB82 fires	FB sees the sentinel from an unassigned PIW slot	Check process image update list and channel assignment	Pack channels into process image update list or remove unused slots
FB faults only on a 6ES7331-7NF10-0AB0 with redundant modules	Channel-level redundancy mismatch	Check redundancy configuration in HW Config	Re-align redundancy channels; verify SW/HW redundancy license is present
FB faults on every scan on a single channel	Module hardware failure on the ADC	Swap modules between slots to localize	Replace module; verify with spare
FB faults after ET200M hot-swap on PROFIBUS-DP	Diagnostic interrupt on insertion event	Check OB83 / OB82 firing during hot-swap	Implement OB83 to acknowledge slot reconfiguration

Edge Cases and Migration Notes

Three situations deserve special attention before you finalize the fix.

Redundant S7-400H stations

On an S7-400H pair the diagnostic interrupt fires on the active CPU only. The standby CPU does not see OB82 unless the channel status changes during its own update. If you suspect this, read the channel diagnostic from both CPUs using SFC51 with SZL_ID = W#16#00B2. Both should report the same channel state once the redundancy has resynchronized.

ET200M behind PROFIBUS-DP

The diagnostic data record is delivered by the IM153 interface module. With DP-V1 the channel-level record is at index 0xB2/0xB3. With DP-V0 only group diagnostics are available, and you must rely on the raw PIW saturation sentinel. If your FB sees infinity on an ET200M but no OB82 fires, you are likely on DP-V0 and the diagnostic is only group-level.

STEP 7 V5.5 SP2 to TIA Portal migration

If the project is locked to STEP 7 V5.5 SP2 (6ES7810-4CC10-0YA5) or earlier and cannot migrate to TIA Portal, the OB82 template and FC105 library blocks are still available in the Standard Library. For TIA Portal projects with S7-300/S7-400, the same logic applies but uses the NORM_X and SCALE_X instructions from the "Converters" task card. The diagnostic data record layout is identical between STEP 7 V5.5 and TIA Portal V15 and later for these module families.

Common Pitfalls to Avoid

• Do not store the DW#16#7F800000 constant into the same MD the scaled REAL will later use. The compare then sees infinity on both sides and latches permanently.
• Do not disable OB82 to "stop the nuisance faults." Without OB82 the CPU will STOP on the next diagnostic interrupt and the plant goes down. Always keep OB82 and route faults through it.
• Do not mask the fault with a single-scan ignore flag. A masked fault hides genuine field problems. Use a debounce with a counter and a release timer instead.
• Do not scale the raw 0x7FFF sentinel through FC105 without clamping the output first. Add a pre-scale check that discards raw values >= 0x7FF0 before FC105.
• Do not mix signed and unsigned compares. The ==D instruction treats the bit pattern as signed integer; the bit pattern of +Infinity looks like a large positive integer and a signed compare behaves differently than a REAL compare.

FAQ