Resolving SIMATIC OP7 -250 Temperature Display Fault on S7-300

Problem Overview

The SIMATIC OP7 operator panel in an absorption chiller installation reports -250 °C for every temperature process value: cooling water inlet, cooling water outlet, chilled water inlet, and chilled water outlet. The fault appeared on one OP7, returned within approximately twelve months of a complete panel replacement, and persists when the panel is physically swapped with a known-good identical OP7 on a duplicate system. The fault does not follow the panel; it stays with the system.

This is the classic "phantom HMI failure" pattern. The OP7 is blamed because the symptom is visible on the OP7, but the actual fault sits upstream of the panel, in one of the following layers:

• The STEP 7 program and the data block (DB) that holds the process values.
• The ProTool configuration that defines tag pointers, scaling, and display formatting.
• The SM331 analog input module that converts the RTD or 4-20 mA signal into a STEP 7 integer.
• The temperature transmitter power supply, the loop wiring, or the RTD element itself.

The -250 value is the diagnostic fingerprint that links the symptom to a specific set of causes. It is not a random HMI artifact; it is a clamped lower-range or underrange value produced when the analog input goes below the configured minimum. Once that fingerprint is understood, the troubleshooting path becomes deterministic rather than guess-based.

Why the OP7 Displays -250: Engineering Background

-250 °C is the lower measurement limit of a standard PT100 resistance temperature detector (RTD) per IEC 60751. It is also the most common engineering lower-range value (LRV) configured on 4-20 mA temperature transmitters in HVAC and chiller applications, where the scaled range might be -50 to +200 °C for chilled water or 0 to +150 °C for cooling water. When the input to the SM331 module falls below the configured range, the module sets an underrange flag in the diagnostics.

The STEP 7 program can either ignore the flag or pass it through to the process value DB. When ProTool polls the tag, the resulting display depends on three configuration choices made when the project was built:

Because all four temperature readings are showing the same -250 value, the most likely causes collapse to a small subset. The fact that all values are identical rules out individual sensor failures (which would produce a single -250 and three valid readings). It strongly suggests a common mode failure: a shared power supply, a shared configuration, or a shared data path.

Root Cause Analysis: What the Panel Swap Reveals

The user performed a controlled experiment: two identical OP7 panels were physically swapped between two identical systems (same PLC, same input modules, same temperature transmitters). The fault stayed with the original system, not the panel. This is a clean A/B test that conclusively eliminates the following from the suspect list:

• OP7 display hardware failure.
• OP7 internal RAM or flash corruption.
• OP7 battery-backed memory loss.
• OP7 MPI/PPI interface hardware.
• ProTool project file (assuming both panels are loaded with the same project, which is standard practice).

What the swap does not eliminate is the layer between the field device and the OP7. The fault must live in the chain that is shared by both systems: the field wiring, the transmitter power supply, the SM331 module, the STEP 7 program, or the ProTool tag configuration loaded into the panel. Because the panel swap eliminated ProTool, the surviving suspects are:

1. STEP 7 program: the temperature DB words are being overwritten or never written correctly.
2. SM331 analog input module: the module is not converting signals, has a hardware fault, or has a wrong hardware configuration (range card, channel group, measurement type).
3. Temperature transmitter power supply: a shared 24 VDC rail is down, so all 4-20 mA loops read 0 mA.
4. Field wiring: a common shield ground, terminal block, or junction box failure.
5. RTD sensing element: all four RTDs share a common excitation or compensation wire that has failed.

The next sections describe how to distinguish between these candidates with deterministic measurements rather than trial-and-error panel replacement.

Required Tools, Software, and Documentation

Before starting diagnostics, gather the following items. None of the measurements below are guesswork; each requires one of these tools.

Step-by-Step Diagnostic Procedure

Follow the sequence below in order. Each step isolates a layer of the system. Do not skip steps; the order is designed to fail fast on the cheapest, most likely causes before moving to invasive hardware work.

1. Read the OP7 system messages. Press the ESC and then the HELP key on the OP7 to enter the system messages area. The OP7 stores up to 50 events in its internal log, including communication errors, configuration warnings, and stack overflows. A repeating "Tag not found" or "Invalid address" message points to a ProTool tag database error, not a hardware fault.
2. Confirm the ProTool project identity. On the OP7, enter the configuration menu (Setup > OP Information). Record the project name, project ID, and last compile date. Compare these to the ProTool source file on the engineering workstation. If the panel was loaded with a different project than the one in the engineering record, that explains the -250 value without any hardware fault.
3. Back up the OP7 configuration with ProSave. Connect the PC to the OP7 service port with the MPI/PPI cable. Launch ProSave, select OP7 as the target device, choose Backup, and save the file to a known location. This gives you a recovery point before any erase operation.
4. Open STEP 7 online and monitor the temperature DB. With the S7 program online, locate the data block that ProTool reads from (typically DB100 or DB200 in a chiller program). Right-click the DB, select Monitor/Modify, and watch the temperature words in real time. If the DB words already read -250 inside STEP 7, the fault is between the field and the DB, not in ProTool. If the DB words read correctly (e.g., 5.0 °C for chilled water), the fault is in ProTool's tag pointer or scaling.
5. Check the SM331 diagnostic LEDs. On the analog input module, observe the SF (red) and the per-channel indication. A lit SF LED means the module has a diagnostic event stored. Open the module's diagnostic buffer via STEP 7 (PLC > Module Information > Diagnostic Buffer) to read the error code. Common codes include:

6. Measure the 24 VDC supply at each transmitter. With the system powered, measure DC voltage at the transmitter terminals. The reading should be at least 18 VDC and no more than 30 VDC. If a transmitter has less than 12 VDC at its terminals, the loop current cannot reach 20 mA and the analog input will read low or zero. A shared 24 VDC rail that has dropped to 5-8 VDC will produce -250 on every channel simultaneously.
7. Measure the loop current at each transmitter. Break the loop and insert the multimeter in series. The current should track the actual process temperature. If all four transmitters read 0 mA simultaneously, the shared supply is the failure. If one reads 0 mA and the others read normally, that specific transmitter or its wiring is the failure.
8. Inject a known signal into the SM331. Disconnect one of the field transmitters and connect a loop calibrator to the SM331 input. Set the calibrator to 12.00 mA (50% of span). The corresponding temperature reading on the OP7 should jump to the mid-range value (e.g., 50 °C if scaled 0-100 °C). If it does, the SM331, the STEP 7 program, and ProTool are all working. The fault is in the field side, downstream of the input terminals.
9. Inspect the terminal blocks and junction boxes. Corrosion, loose screws, and broken conductors are common on chiller installations that have been in service for over a decade. Pay particular attention to the shield ground: a broken shield can inject 50/60 Hz noise that biases the analog input below 4 mA.
10. Verify the SM331 channel group configuration. Open the S7 hardware configuration in STEP 7. Click on the SM331 module and check the Measuring range tab for each channel group. A common error is to leave the module in the default Voltage mode while the field device is a 4-20 mA transmitter, or to leave the range card in the wrong position. Mismatch between the configured range and the actual signal produces exactly the symptom you see.
11. Cross-check ProTool tag addresses against the STEP 7 symbol table. Open the ProTool project, navigate to Tags > Temperature, and record the DB address, byte offset, and data type for each temperature tag. Then open the STEP 7 symbol table and verify that the same addresses are written by the analog input scaling block (typically FC105 Scale or a custom FC). If the ProTool tag points to DB100.DBD0 but the scaling block writes to DB100.DBD20, ProTool will read uninitialized memory, which often reads as the lowest INT value or zero.
12. Inspect for DB address overlap. Open the STEP 7 program and review the data blocks for overlapping declarations. If DB100.DBD0 is also used as a scratch word by another part of the program, it can be overwritten at any scan. The symptom is then identical values for unrelated tags.
13. Reload the ProTool project from the source file. If all of the above checks pass, the ProTool project on the OP7 may be corrupt. Erase the OP7 via ProSave (OP > Reset), then transfer the source project from the engineering workstation. After reload, cycle power to the OP7 and observe the temperature readings.
14. Define a new tag and test. If the fault persists after reload, define a new temperature tag in ProTool pointing to a different DB word (e.g., DB110.DBD0). Modify the STEP 7 program to write the scaled temperature to DB110.DBD0. Download both the STEP 7 change and the ProTool change. If the new tag reads correctly, the original DB word was the fault; if it still reads -250, the fault is between the field and the STEP 7 program.

Diagnostic Flow

The following flowchart captures the decision logic of the procedure above. Run the OP7 swap test first; it costs five minutes and definitively eliminates the HMI as the cause. From there, follow the branches to the field side or the configuration side based on what STEP 7 online monitoring reveals.

Hardware Verification: SM331, Transmitters, and Field Wiring

The SM331 analog input module family is the most common source of chiller temperature faults. Common part numbers in the field include 6ES7331-1KF01-0AB0 (8 AI, 13-bit), 6ES7331-7KF02-0AB0 (8 AI, 14-bit, with diagnostic interrupt), and 6ES7331-7NF00-0AB0 (8 AI, 16-bit, high precision). Each of these modules is configured in groups of two channels. A configuration error on channel group 0 affects channels 0 and 1 simultaneously, which alone can produce two -250 readings; a configuration error on the module itself (wrong range card position) can affect all four.

For 4-20 mA temperature transmitters, the SM331 range card must be in position D, and the channel group must be configured as Current, 4-20 mA in HW Config. A common error is to set the configuration correctly in HW Config but forget to physically move the range card on the module. The module then reads the wrong range and reports underrange.

For 4-wire RTDs connected directly to the SM331, verify the wiring at the front connector:

• Pin 2: I+ (constant current source, positive)
• Pin 3: I- (constant current source, negative)
• Pin 4: U+ (voltage sense, positive)
• Pin 5: U- (voltage sense, negative)

A break in any of the four conductors registers as a wire break. If two RTDs share a common terminal at the field junction and that terminal has failed, both channels will read underrange simultaneously. This is the most common multi-channel -250 root cause on absorption chillers with daisy-chained RTDs.

Software Verification: ProTool Tag Database and Scaling

ProTool V6.0 SP3 stores the tag database in the project file (.pdb or .fwd extension). The tag definition for a temperature input has the following structure, which can be inspected in the ProTool Tag Editor:

Name:           T_CHW_SUPPLY
Type:           INT (16-bit signed)
DB Number:      DB 100
DB Offset:      0
Length:         2 bytes
Acquisition:    Cyclic, 1 s
Scaling:        LRV = -250.0 degC
                URV = +850.0 degC
Display Format: Decimal, 1 digit after point
Low Limit:      -250 (clamp enabled)
High Limit:     +850 (clamp enabled)

Several failure modes hide in this dialog:

• LRV/URV mismatch. If the LRV is set to -250 and the field signal is at 0 mA, ProTool will display -250 even though the transmitter is healthy but the loop current is out of range. The fix is to set LRV to the real lower process temperature (e.g., -10 °C) and let underrange produce an explicit Out of range message.
• Clamp at -250. ProTool can be configured to clamp any out-of-range value to the LRV. With this option enabled, an intermittent wire break or noisy signal will appear as a stable -250 rather than flickering, which masks the actual fault. Disable the clamp in the tag properties.
• Tag address typo. If the DB offset was entered as 0 instead of 8, two tags can point to overlapping memory. The first tag reads the high byte of one temperature and the low byte of the next, producing nonsense values that may include -250 if interpreted as a signed INT.
• Wrong data type. Defining the tag as INT when the program writes a REAL (32-bit float) produces a value that is a combination of the mantissa and exponent bits, which can decode to -250 by chance on certain inputs.

To audit a ProTool project for these issues, export the tag list to a CSV file (ProTool > Project > Export > Tags) and open it in a spreadsheet. Sort by DB offset and look for overlaps and gaps. The audit takes ten minutes and has caught every ProTool scaling fault seen in absorption chiller systems. A common ProTool pattern that produces simultaneous -250 on all temperature tags is the use of a single template tag copied to all four temperature points without re-binding the DB offset; all four tags then read the same memory location, which is typically the first temperature channel or an uninitialized scratch word.

Configuration Reload Using ProSave

If the diagnostics above do not reveal the cause, reload the ProTool project from the engineering source. The OP7 retains its configuration in flash memory and loads it at power-up, but the flash can be corrupted by brownouts, electrostatic discharge, or battery-backed SRAM failure. The reload procedure is:

1. Connect the PC to the OP7 service port using the MPI/PPI cable (6ES7901-2BF00-0AA0 or equivalent). Set the OP7 transfer mode by pressing ESC and turning the mode key to Stop then back to Run while holding the right arrow key. The OP7 displays Transfer when ready.
2. Launch ProSave on the PC. In the device type dropdown, select OP7.
3. Select the COM port and baud rate (default 9600, can be raised to 187500 for faster transfer).
4. Click Backup to save the current OP7 configuration to a file. This is your safety net.
5. Click Restore and select the .fwd or .pdb source file from the engineering workstation. ProSave will transfer the project, compile it on the OP7, and reboot the panel.
6. After reboot, observe the OP7 display. If the temperature readings remain at -250, the fault is upstream of the OP7, as established by the panel swap test.

SM331 Diagnostic Indicators and Error Codes

The SM331 module has front-panel LEDs that encode the channel and module status. Reading the LEDs correctly is faster than running a STEP 7 online diagnostic session, especially on a panel that is hard to access.

The diagnostic buffer inside STEP 7 records time-stamped events for every fault. To read it: with the S7 project online, right-click the SM331 in the rack, select Module Information, and switch to the Diagnostic Buffer tab. Common entries that produce -250 readings include:

• Wire break at channel 0: the physical RTD or its wiring has failed.
• Underrange at channel 0: the input signal is below 4 mA, often due to transmitter power loss.
• Measuring range module not inserted: the range card on the SM331 is missing or wrong.
• Configuration error: the HW Config setting does not match the range card position.

Each diagnostic event has a hexadecimal error code that can be cross-referenced against the SM331 manual on Siemens SiePortal. Record the code, the timestamp, and the channel number before clearing the buffer; this is the evidence trail that points to the root cause. The diagnostic buffer survives power cycles, so even after a cold start, the last fault before the reset is still recorded.

Common Power Supply and Reference Junction Investigation

On absorption chillers, it is common practice to power all 4-20 mA temperature transmitters from a single 24 VDC rail fed by a dedicated power supply (often a Siemens SITOP 6EP1334-3BA10 or similar). If this supply fails, drops below 18 VDC, or has a blown fuse on the output, every transmitter loses power simultaneously and every channel on the SM331 reads 0 mA. The result is a flat -250 across all temperature tags, which is exactly the symptom in this case.

To verify:

1. Locate the transmitter power supply in the panel. It is usually a DIN-rail mounted unit with screw terminals labelled +24V and 0V.
2. Measure the output voltage at the supply terminals with no load. A healthy supply reads 24.0 to 24.5 VDC.
3. Apply load by leaving the transmitters connected. Measure the voltage again at the supply terminals. The voltage should remain above 23.0 VDC under full load. If it sags to 15-18 VDC, the supply is overloaded or failing.
4. Measure the voltage at the transmitter terminals, not at the supply. Voltage drop on long cable runs can reduce the transmitter terminal voltage below 12 VDC, which prevents the loop from reaching 20 mA. A 24 AWG cable run of 200 metres drops approximately 4 VDC at 20 mA.
5. Check the fuse on the 24 VDC rail. A blown fuse often indicates a short circuit in the field wiring, not a power supply failure. Replace the fuse only after finding and clearing the short; otherwise the new fuse will blow immediately.

Final Verification and Commissioning Checklist

After the root cause is fixed, run through the following checklist before returning the chiller to automatic control.

• All four temperature readings on the OP7 display real process values (cooling water inlet 25-30 °C, cooling water outlet 30-35 °C, chilled water inlet 12-15 °C, chilled water outlet 5-8 °C, depending on operating point).
• No -250, no Out of range, no flickering values.
• OP7 system messages log is empty or contains only normal power-up events.
• SM331 SF LED is off; all channel LEDs are off.
• SM331 diagnostic buffer contains no events newer than the last cold start.
• STEP 7 online monitor of the temperature DB shows values consistent with the OP7 display.
• ProTool project on the OP7 matches the source file in the engineering record.
• ProSave backup of the current OP7 configuration is stored in the engineering database.
• STEP 7 project backup is current and stored with the ProTool project.

Preventive Maintenance for the OP7 and SM331 Loop

The -250 fault in this case is likely to recur if the underlying cause is not addressed. The following preventive maintenance tasks reduce the chance of recurrence and shorten the diagnostic cycle the next time a fault appears.

The OP7 lithium battery (Siemens part number 6AV3678-2AM00 or equivalent) is the most overlooked preventive item. The battery backs up the OP7 SRAM, which holds retentive tags and the project checksum. A weak battery causes random tag pointer corruption that can produce exactly the -250 symptom, especially after a power outage. Replacing the battery on a five-year cycle prevents this failure mode entirely. After battery replacement, reload the ProTool project from the engineering source and verify all tag values match the live DB.

OP7 Hardware Reference and Specifications

The SIMATIC OP7 is a compact text-based operator panel from the Siemens HMI product line. The following specifications are relevant to the diagnostics in this article.

The OP7 is a legacy product. Successors include the OP 77A (6AV6641-0BA11-0AX0), OP 77B (6AV6641-0CA01-0AX0), and the current SIMATIC Comfort Panel line. Migration to a Comfort Panel is a multi-day project because ProTool projects do not import into TIA Portal directly; a re-engineering step is required. The OP7 should be kept in service until the migration can be planned, but its firmware and documentation remain accessible through the official Siemens SiePortal support portal. For active SIMATIC HMI products and successor panels, the SIMATIC HMI product page lists current offerings and migration guides.

Frequently Asked Questions