Resolving SM331 AI 8x13 W#16#7FFF Overflow on Channels 0 and 4

Problem Statement

On a CPU313C-2 DP (6ES7313-6CF00-0AB0) station equipped with an SM331 analog input module 6ES7331-1KF01-0AB0 (8 AI x 13 bit), channels 0 and 4 read W#16#7FFF in the STEP 7 Hardware Monitor / Monitor-Modify view, while channels 1, 2, 3, 5, 6, and 7 read W#16#8000. After the 24 VDC power lead is removed from the front connector, channels 0 and 4 also return to W#16#8000. The fault is therefore not a defective module, not a sensor problem, and not a STEP 7 configuration error in the AI module properties; it is an external 24 VDC supply that is wired directly to the wrong terminals on the front connector of the affected channels.

The 6ES7331-1KF01-0AB0 is not designed to accept an external 24 VDC input. The module generates its own excitation for resistance and RTD measurements internally via constant-current sources on the COMP+ / COMP- terminals. When a 24 VDC source is applied to the front connector of channels 0 and 4, the analog input front end saturates and the SIMATIC driver reports the highest positive value in the diagnostic word, W#16#7FFF. Channels that are not connected to the external supply continue to read W#16#8000 because their inputs are open and below the configured range.

Affected Hardware and Order Numbers

Refer to the official SM331 manual entry at 6ES7331-1KF01-0AB0 product manual (entry ID 8859629), Chapter 6 "Wiring", section 6.6 "Wiring of the 8AI x 13 bit module" for the connector pinout used in this article. The same principles apply to all 1KF01 / 1KF02 / 7KF02 variants, although the exact channel-group count and the number of compensation terminals differ.

SM331-1KF01-0AB0 Module Specifications

The 13-bit resolution places the 1KF01 in the lower-resolution family of the SM331 series. For higher accuracy (15 bit + sign) the 6ES7331-7KF02-0AB0 (8 AI x 14/15 bit) is the direct replacement. For high-speed applications the 6ES7331-7NF00-0AB0 (8 AI, 0.052 ms update) is recommended. The fault behaviour described in this article is the same across the 1KF01 / 1KF02 / 7KF02 / 7NF00 families because they share the same front-connector pinout convention.

Diagnostic Value Reference

SIMATIC S7 analog input drivers encode a 16-bit value in the process image. The values W#16#7FFF, W#16#8000, and a number of additional diagnostic codes have specific meaning that the troubleshooting engineer must memorize before interpreting the AI module behaviour.

The IEC 61131-9 standard ("Single-drop digital communication interface for sensors and actuators (SDCI)") and the SIMATIC convention agree that the full-scale positive raw count is 27648 (0x6C00) for unipolar 4-20 mA / 0-10 V / 0-6 kΩ ranges, and that W#16#7FFF is reserved exclusively for the overrange sentinel. The hardware encoding follows the two's-complement convention, so W#16#8000 is the most-negative value of the signed 16-bit word and is used as the underrange sentinel.

Channel Group Architecture and Front Connector

The 6ES7331-1KF01-0AB0 exposes eight physical inputs but is internally organized as four channel groups of two channels each. The grouping has direct consequences for wiring, configuration, and fault behaviour.

All four groups share the same internal ADC converter; the multiplexed front end selects the active group based on the HW Config setting. Because CH0 and CH4 are the first channel of two of the four groups, any common-mode disturbance or supply injection that lands on a shared terminal of groups 0 and 2 manifests as W#16#7FFF on both CH0 and CH4 simultaneously, while CH1 / CH5 (the second channels of the same groups) and CH2 / CH3 / CH6 / CH7 (in the unaffected groups) all sit at W#16#8000 because they are open or below range.

The 6ES7331-1KF01-0AB0 uses a 20-pin front connector. Six terminals are reserved per channel group; the four groups therefore consume all 20 pins, with the shield terminal at the very end of the connector. The exact terminal assignment is shown in the product manual referenced above. Conceptually, each group exposes the following six logical signals:

Two important rules follow from this layout:

1. The COMP+ and COMP- pins are outputs from the module's internal current source. They must never be connected to an external 24 VDC power supply. Injecting 24 VDC into COMP+ will back-drive the current source and saturate the ADC on the corresponding group.
2. The M pins are the analog signal common. Connecting an external 24 VDC supply between M and AI+ (or M and AI-) is also a fault condition in voltage / current mode. The SM331 expects the differential signal to be inside the configured range, not a 24 VDC bias.

The two channel groups in which CH0 and CH4 live (group 0 and group 2) are physically separated on the front connector, so the 24 VDC lead that causes the problem must land on pins that are unique to those two groups, or be routed through a shared bus bar that crosses both groups. The first field action is therefore to power off the rack, remove the front connector, and trace every conductor from each pin of groups 0 and 2 back to the field. Most field reports of this symptom end with a 24 VDC lead found on either the COMP+ pin of group 0 and group 2, or on the AI+ pin of CH0 and CH4, that the original installer had assumed was an "auxiliary power" output.

Root Cause Analysis

The SIMATIC SM331-1KF01-0AB0 does not require an external 24 VDC supply at the front connector for any of its supported measurement modes. The module is powered from the S7-300 backplane bus (5 VDC logic supply drawn from the CPU / IM) and provides its own excitation for RTD and resistance measurements. There is no field-power input on the AI module front connector.

Common wiring errors that produce the W#16#7FFF pattern on CH0 / CH4 include:

• Sensor power mis-routed to the AI module. A 4-20 mA two-wire transmitter must be powered by an external 24 VDC loop supply, but the loop supply return must land on the M terminal of the AI module, not on the AI+ terminal. If the field installer pulled both 24 VDC conductors to the front connector and landed them on AI+ and M, the AI module sees a 24 VDC drop across its input pins and saturates immediately. The error becomes obvious only on the channel that is wired; unused channels sit at W#16#8000.
• COMP+ pin used as 24 VDC output. On the 1KF01 the COMP+ pin is a constant-current source used for 4-wire RTD measurement. It is not a power output. If a panel builder or contractor "borrowed" COMP+ as a 24 VDC source for a nearby digital sensor, every channel in the affected group reads W#16#7FFF.
• Shield ground bonded to M of one group only. In some retrofits the cable shield is bonded to M of group 0 and group 2 only. If a field-side fault lifts the shield to 24 VDC (for example through a faulty transmitter power supply), channels 0 and 4 read W#16#7FFF while the other groups remain at W#16#8000.
• Test lead left in place during commissioning. A 24 VDC test lead used during loop check is not always removed before the final close-up. The lead sits on the AI+ pin of CH0 and CH4, the front connector is plugged back in, and the symptom appears in the Monitor/Modify view.

The key diagnostic decision point is the question "is the module itself OK?" Remove the front connector with the rack powered, then read channels 0 and 4 in the Monitor/Modify view. If the readings return to W#16#8000 with the connector unplugged, the module is intact; the fault is in the field wiring or the front-connector pinout, not in the module.

Resolution Procedure

1. Stop the CPU (or place the rack in STOP) and open the front connector cover on the SM331-1KF01-0AB0.
2. Power down the loop supply that feeds the 24 VDC conductor on the front connector. Tag and lock out the supply so it cannot be re-energized while you are working on the connector.
3. Remove the 24 VDC lead from the front connector. Identify which pin it was landed on. If it was on AI+ or AI- of CH0 / CH4, or on COMP+ of groups 0 and 2, the lead is the source of the fault. If it was on a pin that should never see 24 VDC (for example a reserved pin), the lead is mis-routed and must be removed entirely.
4. Inspect the field wiring. For 2-wire 4-20 mA transmitters, the 24 VDC loop supply must be wired as follows: 24 VDC+ to transmitter+, transmitter- to AI+ of the SM331, and the SM331 M terminal to 24 VDC-. The SM331 does not provide loop power; the loop supply is external. If you need a Siemens-recommended 24 VDC loop supply, the SITOP PSU100S or LOGO! Power 24 V families are documented in the S7-300 system manual.
5. Reconnect the field wiring without the offending 24 VDC lead. Torque the front connector screws to 0.6 Nm (typical for the 6ES7392-1AJ00-0AA0 20-pin connector).
6. Restore loop power to the 24 VDC loop supply. Restore the CPU to RUN.
7. Open STEP 7 Hardware Monitor / Monitor-Modify and confirm that all eight channels return to W#16#8000 with no field sensor connected. If the field sensors are connected, you should now see scaled engineering values between 0 and 27648 (for unipolar) or -27648 to +27648 (for bipolar).
8. If CH0 and CH4 still read W#16#7FFF, swap the front connector to the spare group. If the overflow follows the channels, the module is damaged and must be replaced. If the overflow stays on the same pins of the connector regardless of which group is active, the wiring is still wrong.

STEP 7 / TIA Portal Configuration

The diagnostic interpretation of the AI module depends on the configuration loaded in HW Config. For the 6ES7331-1KF01-0AB0, open the analog module in HW Config and verify the settings on the "Inputs" tab:

1. Open SIMATIC Manager and load the station to the CPU 313C-2 DP.
2. Open HW Config, double-click the SM331-1KF01-0AB0 in the rail, and switch to the "Inputs" tab.
3. For each channel group (group 0 / 1 / 2 / 3), set the measurement type to "Voltage", "Current", "RTD" or "Resistance" as required. If the group is unused, set the type to "Deactivated" so that the group does not enter overflow when the input is open.
4. For groups configured as voltage, set the range to one of ±50 mV / ±500 mV / ±1 V / ±5 V / ±10 V / 1-5 V / 0-10 V. The 1-5 V and 4-20 mA ranges are preferred for fail-safe 4-wire / 2-wire transmitters because wire break can be distinguished from a live zero.
5. Enable the "Diagnostic Interrupt" checkbox on the "Basic" tab. With diagnostic interrupt enabled, the CPU calls OB82 when the module detects wire break, overrange, or underrange. Without OB82 the CPU will go to STOP on the first diagnostic event.
6. Save and recompile the HW Config. Download the configuration to the CPU.

In the TIA Portal (V13 SP1 and later), the SM331-1KF01-0AB0 appears in the device catalog under "PLC > S7-300 > Analog modules > SM331". The configuration procedure is functionally identical to STEP 7, but the user interface differs:

1. In the project tree, expand the S7-300 station and open "Device view".
2. Drag the SM331 from the catalog to slot 4 of the rail (the S7-300 standard rules apply: slot 1 is reserved for the CPU, slots 2-3 are reserved for IM if used, slot 4 is the first available I/O slot).
3. Select the SM331 and open the "Properties" pane. In the "General" tab, set the module name and the diagnostic interrupt behaviour.
4. In the "AI configuration" tab, configure the four channel groups. For each group, set the measurement type, range, smoothing, and integration time independently. The integration time determines the module update time and the effective noise rejection (50 Hz / 60 Hz mains frequency).
5. Compile and download the device configuration. The portal will warn if the channel-group configuration does not match the physical wiring (for example, RTD selected but COMP+ not wired).

For STEP 7 V5.5 the relevant manual is the STEP 7 V5.5 help system under "Configuring analog input modules" (entry ID 1097517 in the Siemens support database). For TIA Portal V13 and later, the configuration lives in the device view of the project tree; refer to the TIA Portal help "Configuring SM331 analog input modules".

Programmatic Value Handling

Even with the front connector wired correctly, the application code must be ready to receive diagnostic values such as W#16#7FFF and W#16#8000. The standard handling is the FC105 "SCALE" block (STEP 7 V5.5) or the "NORM_X" and "SCALE_X" instructions (TIA Portal). The scaled value is invalid if the raw word matches one of the diagnostic codes. The IEC 61131-3 general scaling formula is:

where IN is the raw input, K1 / K2 are the input range end-points (for example 0 and 27648 for a unipolar 4-20 mA range, or -27648 and +27648 for a bipolar range), and HI_LIM / LO_LIM are the engineering range end-points (for example 0.0 and 100.0 for a 0-100 °C transmitter). The output is invalid when IN equals 0x7FFF (overrange) or 0x8000 (underrange / wire break).

Structured Text (TIA Portal) example for one channel of the 1KF01, configured as 4-20 mA on a 0-100 °C transmitter:

// Raw value from the analog input module
iRaw := "i_AI_CH0";          // IW of CH0 in the process image
// Flag diagnostic codes
bOverrange  := (iRaw = 16#7FFF);
bUnderrange := (iRaw = 16#8000);
bWireBreak  := (iRaw = 16#8000);   // 4-20 mA wire break = below 4 mA = underrange
// Scale only the valid range
IF NOT bOverrange AND NOT bUnderrange THEN
  // FC105 equivalent: 0..27648 -> 0.0..100.0
  rTemp_C := (INT_TO_REAL(iRaw) / 27648.0) * 100.0;
ELSE
  rTemp_C := -9999.0;             // sentinel value for the HMI
END_IF;

For the bipolar ±20 mA range, the raw range is -27648 to +27648 with W#16#8000 still used as the underrange sentinel. The NORM_X instruction normalizes the raw value to a 0.0-1.0 floating-point number, and SCALE_X maps the normalized value to the engineering range. Both instructions must be guarded by the diagnostic check above.

Ladder logic equivalent for the same channel, using STEP 7 V5.5 FC105:

Network 1: Detect overflow / underrange
A   "DB_AI".iRaw_CH0
L   W#16#7FFF
==I
S   "DB_AI".bOverrange_CH0
A   "DB_AI".iRaw_CH0
L   W#16#8000
==I
S   "DB_AI".bUnderrange_CH0

Network 2: Scale only when valid
A   "DB_AI".bOverrange_CH0
O   "DB_AI".bUnderrange_CH0
NOT
SPBNB _001
CALL FC105
  IN      := "DB_AI".iRaw_CH0
  HI_LIM  := 1.000000e+002
  LO_LIM  := 0.000000e+000
  BIPOLAR := FALSE
  RET_VAL := "DB_AI".rTemp_C
_001: NOP 0

If the application uses the channel group as a 4-wire RTD input (Pt100), the same diagnostic codes apply, but the engineering range is the resistance or temperature value after the FC105 / NORM_X / SCALE_X chain. The linearization for Pt100 / Ni100 is handled by the SM331 internally when "RTD" is selected as the measurement type; the application does not need to linearize. For an S7-300 application that requires a TC (thermocouple) input, an SM331-7PF01-0AB0 or SM331-7KF02-0AB0 with thermocouple linearization is required; the 1KF01 in this article does not support TC.

Verification and Commissioning

After the front connector is rewired and the configuration is downloaded, perform the following verification sequence before handing the panel over to operations:

1. With the CPU in STOP and the field sensors disconnected, verify in STEP 7 / TIA Portal Hardware Monitor that all eight channels return to W#16#8000. Document the result on the loop-check sheet.
2. Reconnect one field sensor at a time. After each sensor is connected, verify that the affected channel moves to a value between 0 and 27648 (or the bipolar equivalent). If a channel remains at W#16#7FFF after a sensor is connected, the polarity is reversed or the sensor is at a level above the configured range.
3. Inject a known current (for example 12.000 mA) at the field side using a calibrator. The channel should read 20736 raw counts (12 mA - 4 mA = 8 mA span; 8 mA / 16 mA = 0.5; 0.5 * 27648 = 13824; add the live-zero offset of 6912 = 20736). Compare the result against the loop sheet tolerance.
4. Inject a 4.000 mA signal. The channel should read 0 raw counts (live zero of the 4-20 mA range). If the channel reads 8000, the loop has a wire break, a polarity reversal, or a transmitter that is not powered.
5. Inject a 20.000 mA signal. The channel should read 27648 raw counts. If the channel reads 7FFF, the transmitter output is over-ranged or the loop is not isolated correctly.
6. Cycle the loop power. The channel should return to the same value within ±2 counts after the supply recovers. If the value drifts by more than ±2 counts, the channel grounding is poor.
7. Download the project to the CPU. The diagnostic interrupt OB82 must be present in the project, otherwise the CPU will go to STOP on the first wire-break event.

For a 0-10 V range, the equivalent verification values are 0 V → 0 counts, 5 V → 13824 counts, 10 V → 27648 counts. For a Pt100 input on the climatic range -200 to +850 °C, the equivalent verification values are 100.00 Ω → 0 counts, 200.00 Ω → 13824 counts, 157.33 Ω → 6000 counts (corresponding to 0 °C).

Related Fault Codes and Edge Cases

Other patterns that the commissioning engineer may encounter on the SM331-1KF01-0AB0 are listed below. The list is not exhaustive, but it covers the codes that are most often confused with the W#16#7FFF overflow described in this article.

OB82 (diagnostic interrupt) carries the local data structure OB82_MDL_DEF and the event identification in OB82_EV_CLASS. The local-data word OB82_MDL_ADDR returns the logical base address of the AI module. The local-data word OB82_IO_FLAG is set to 0 for input modules. The local-data bytes OB82_TO_PROC / OB82_TO_LOCAL carry the channel status bits. The status-bit pattern for "overrange" on a 1KF01 channel is documented in the OB82 section of the STEP 7 V5.5 system and standard functions reference manual.

Preventive Wiring Practices

The fastest way to prevent a repeat of the W#16#7FFF pattern is to standardize the wiring practice for the SM331-1KF01 family on the panel:

• Label every conductor at both ends. The label must include the SM331 slot number, the group number, and the channel number (for example "S4-G0-CH0-AI+"). A 24 VDC lead should never be labelled as if it were an analog input.
• Use a dedicated 24 VDC loop supply rail for the 4-20 mA transmitters. The loop supply rail is physically separated from the AI module front connector. The SM331 does not provide loop power; the supply is external. The SITOP PSU100S 6EP1334-3BA10 (24 V / 10 A) or LOGO! Power 6EP3333-8SB00-0AY0 (24 V / 4 A) are typical choices and are UL 508 / NEC Class 2 listed.
• For 4-wire RTD sensors, run a four-conductor shielded cable from the field to the SM331. Bond the shield at the panel end only, to the panel's analog ground bar. Do not bond the shield at the field end (or bond it through a small capacitor) to avoid ground loops.
• Use the Siemens 6ES7392-1AJ00-0AA0 20-pin screw-type front connector. Avoid spring-type connectors for the AI module because vibration can loosen the connection over time and create intermittent overflow conditions.
• After wiring, perform a continuity test from the field side to the SM331 terminal. The test confirms that the AI+ lead is on AI+ and not on a COMP+ pin. The test must be performed with the field device disconnected and the front connector unplugged.
• During commissioning, run the loop-check sequence described above. Document the results on the loop sheet. The signed loop sheet is the only way to prove that the 24 VDC lead was not left on the AI+ pin.
• Cross-check the SM331 wiring against the chapter 6 of the S7-300 module data manual entry ID 8859629 before energizing the panel.

When the SM331 is on a CPU 313C-2 DP rack, the PROFIBUS DP interface of the CPU is not involved in the analog input behaviour described in this article; the AI module is accessed through the backplane bus of the CPU. The PROFIBUS DP master can be a SIMATIC S7-400, an ET 200S, or a third-party controller. The AI module on the 313C-2 DP station is purely a slave to the local CPU, and the diagnostic interrupt OB82 is delivered to the local CPU even when the PROFIBUS DP interface is not used.

FAQ