S7-1500 Analog Value Status: Channel Diagnostics in TIA Portal

Overview

The Value Status function in the SIMATIC S7-1500 analog modules adds a quality bit for every channel directly inside the process image of the inputs. Instead of issuing an RDREC call, polling channel-LED status, or wiring discrete diagnostic inputs, the CPU appends one extra byte (or bytes) to the module's input address range, and each individual bit inside that byte reports whether the corresponding channel is good (bit = 1) or faulted (bit = 0). The mapping is channel-ordered: bit 0 of the value-status byte = channel 0, bit 1 = channel 1, and so on. This makes per-channel analog diagnostics trivial to evaluate in ladder, FBD, or SCL.

Value Status is supported on the S7-1500 and on the ET 200MP / ET 200SP / ET 200AL distributed I/O families. The S7-1200 family does not expose this property; on S7-1200 the same diagnostic data must be read via record 0 or record 192 with RDREC. The same diagnostic philosophy applies to the SIMATIC ET 200AL analog modules, as described in the TIA Portal cloud documentation on analog diagnostics.

Prerequisites

• SIMATIC S7-1500 CPU (any firmware variant that supports the analog module) or ET 200MP / ET 200SP / ET 200AL interface module with PROFINET connection back to the CPU.
• STEP 7 (TIA Portal) V15.1 or later; V16 / V17 / V18 are recommended for full Value-Status support on newer analog modules such as the AI 8xU/I/RTD/TC ST (6ES7531-7KF00-0AB0) and AI 8xU/I/RTD HF (6ES7531-7PF00-0AB0).
• Analog input module with the Value status property exposed in the module parameters. The capability is standard on:

Enabling Value Status in TIA Portal

1. Open the project and switch to Device View of the S7-1500 station (or the ET 200MP / ET 200SP head module).
2. Click the analog module. In the inspector window select Properties > Module parameters.
3. Navigate to AIx > Inputs > Channel n (for the specific channel) and expand Diagnostics.
4. Select Value status in the module-level configuration (or in the channel-level group "Configuration"). The exact path label in the inspector reads Value status in the field labeled "xx Configuration".
5. Compile the hardware configuration and download it to the CPU. After the download, the module reserves one additional byte in the input process image.

Address Mapping and Bit Structure

Once Value Status is enabled, the module's I-address footprint grows. For an 8-channel analog input with a starting input address of I32, the input area is normally 16 contiguous bytes (2 bytes per channel). After enabling Value Status, an additional byte is appended after the channel data. The byte order is little-endian on the S7-1500.

Reading Diagnostic Bits in the User Program

The Value-Status bit is updated every PLC scan by the module firmware. It is valid for the analog value delivered in the same process-image update. Three practical patterns follow.

Pattern 1 — Ladder bit test (FBD/ LAD)

// Channel 0 good?
A I 48.0
= M 100.0   // "AI0_OK"

// Channel 4 good?
A I 48.4
= M 100.4   // "AI4_OK"

Pattern 2 — Word extract in SCL

// ValueStatusByte is the byte appended after the analog channels
#VS_Byte := "AI_8CH".ValueStatus;
FOR #i := 0 TO 7 DO
    IF (#VS_Byte.%X#i) THEN
        // bit i = 1 → channel i healthy
    ELSE
        // bit i = 0 → channel i faulted
    END_IF;
END_FOR;

Pattern 3 — Map to a status word for the HMI

// Pack all 8 channel-good bits into one INT for the HMI status screen
"HMI_AI_Status" := "AI_8CH".ValueStatus;

ET 200MP Distributed I/O

The same feature is available on ET 200MP analog modules plugged into the distributed rack. The Value-Status byte still appears immediately after the channel data in the PROFINET slot, and the mapping (bit = channel) is preserved. Two practical points to keep in mind on a distributed rack:

• If the ET 200MP interface module drops out of PROFINET, the Value-Status byte substitutes the value 16#00 for all channels (all bad). This is identical to the substitute-value behavior of the analog data and is the correct way to detect a station failure without waiting for the I/O fault OB.
• The diagnostic bit clears automatically once the channel returns to a valid range. There is no acknowledge or edge required.

Wire-Break Detection on RTD / TC Channels

For RTD and thermocouple modules, enable Wire break per channel under Diagnostics in addition to Value Status. With both enabled, the diagnostic bit drops to 0 within one PROFINET update cycle (~1 ms) of a broken sensor lead, and the analog value is forced to the configured substitute value (default 0 or 7FFFh overflow). This combination is the standard pattern for an S7-1500 / ET 200MP 8-channel RTD card.

S7-1200 Alternative Using RDREC

On S7-1200 with the SM 231 RTD 8x (6ES7231-5PF32-0XB0) the equivalent function is achieved through the RDREC instruction. The relevant data records are summarized below.

Typical SCL skeleton for the S7-1200 RTD card:

// Trigger: rising edge of diagnostic interrupt OB82 or a 1-Hz cyclic task
#RDREC_REQ := TRUE;
#RDREC_ID   := 50;                 // HW identifier of the SM 231
#RDREC_INDEX := 0;                 // Data record 0 (channel diagnostic)
#RDREC_MLEN  := 34;                // Full record size for 8 channels
#RDREC_RECORD := #AI_Diag_Buffer;  // P#DB100.DBX0.0 BYTE 34

// On done:
IF #RDREC_VALID THEN
    // Bytes 0..1 = channel 0 status (bit 0 wire break, bit 1 short circuit, ...)
    // Bytes 4..5 = channel 1 status
    // etc.
END_IF;

Because the S7-1200 RTD module does not push channel quality into the process image, the engineer should build a small "status word" DB that the HMI can poll in parallel with the analog values.

Distinguishing Fault Types in Data Record 0

For the S7-1500 / ET 200MP analog modules, the data-record-based diagnostics give the same fault detail that the simple Value-Status bit does not. Use it when the application must log which fault occurred. The standard PROFINET channel-diagnosis bit assignments inside each 16-bit channel entry are:

The ET 200AL analog modules share the same channel-diagnosis model, as documented in the SIMATIC ET 200AL function manual — Diagnostics.

Step-by-Step Commissioning Procedure

1. Wire and configure the channel — Choose the measurement type (0..10 V, 4..20 mA, Pt100, TC type K, etc.) and the smoothing settings in the module parameters.
2. Enable per-channel diagnostics — Under Channel n > Diagnostics enable only the fault types you care about (typically wire break and overflow). Enabling all diagnostics can produce nuisance faults during commissioning.
3. Enable Value Status — In the module-level Configuration group tick Value status. Compile the hardware.
4. Note the address — Read the start address of the value-status byte from Device View > Module > I/O addresses > "Address to".
5. Create a Watch Table — Monitor the analog value and the matching value-status bit. Pull a sensor wire and confirm the bit clears.
6. Wire the bit into the application — Use a normally-closed contact (AN I 48.0) on the value-status bit to set a "channel bad" flag, or a normally-open contact to set a "channel good" flag.
7. Mirror the status to the HMI — Pack all value-status bits into one word and expose it on the HMI so the operator can see at a glance which channel is faulted.

Verification

Validate the configuration with a forced fault:

1. Add the analog value and the value-status byte to a Watch Table with monitor ON.
2. With the sensor connected, the bit is 1 and the analog value matches the process variable.
3. Pull one wire from the sensor. Within one PROFINET update the bit drops to 0, the analog value goes to substitute value, and the module's channel error LED turns on (if present on the module variant).
4. Reconnect the wire. The bit returns to 1 automatically, the LED clears, and the analog value resumes normal reading.

For the S7-1200 RDREC path, validate by reading the data record on a 1-Hz task and decoding bytes 0..1 — the wire-break bit (bit 3) must be 1 when the wire is off and 0 when the wire is on.

Troubleshooting Matrix

Field-Proven Caveats

• The value-status byte is updated by the module, not by the CPU. It is therefore valid even when OB1 is not running (e.g. CPU in STOP with configured I/O update). Use it for safe-state evaluation.
• Value Status only carries a 1-bit per-channel summary. To know which fault occurred, read data record 0 with RDREC or use the standard PROFINET channel-diagnosis alarm (OB82) for full detail.
• On 2-wire RTD modules, the wire-break detection requires the diagnostic type to be enabled on the matching channel pair, because the module checks the current injection on both leads. Enabling it on only one channel of a 2-wire pair can produce false negatives.
• On thermocouple channels, enable "Open thermocouple" (wire break) for each channel; the value-status bit will also drop on a missing cold-junction compensation, but the channel-diagnosis record will tell the difference.

FAQ