S7-300 Analog I/O Frozen at 4 mA: TIA Portal V11 Troubleshooting

Problem Description and Symptoms

An S7-300 station built around the SIMATIC S7-300 family (CPU 31x with two racks and Profibus to a TP1200 Comfort HMI) is configured in TIA Portal V11. After downloading the hardware configuration and program, every discrete module operates correctly, but the two analog modules behave as if frozen:

• AI module (6ES7 331-7NF00-0AB0, SM 331, 8 AI × 16 bit): with a calibrator injecting 4–20 mA on a channel, the program-side value reads 0 / 0 % continuously. The CPU diagnostic buffer shows no entry, and no SF (group error) LED is lit on the module.
• AO module (6ES7 332-5HF00-0AB0, SM 332, 8 AO × 12 bit): regardless of what is written through the program, the field output holds a steady 4.0 mA. The user attempts to drive the output via the Force column in the watch table; the field current never moves off 4.0 mA.

The combination of no CPU error + frozen analog signal + valid current at the output terminal is the signature of three independent root causes that converge on the same physical observation: (1) peripheral addressing is being read incorrectly, (2) the channel is configured for a 4-wire transducer without external supply, and (3) the analog output is being driven via Forcing rather than via a MOVE/SCALE block.

Affected Hardware and Module Specifications

Both modules belong to the SIMATIC S7-300 signal-module family. Confirm the exact order number (MLFB) on the front-panel label of each module before applying any of the steps below, because SM 331 variants with similar part numbers behave differently.

Reference the manufacturer's product pages for full electrical and mechanical data: 6ES7 331-7NF00-0AB0 product support and 6ES7 332-5HF00-0AB0 product support. Always cross-check the exact MLFB against the latest manual revision, because successor modules (e.g. 6ES7 331-7NF10-0AB0) and predecessor modules use different channel-group configuration.

Root Cause Analysis

When analog channels "freeze" with no SF LED and no diagnostic event, the cause is almost always one of the following four conditions. The fix must address whichever of these applies; correcting only one leaves the symptom intact.

1. Wrong process-image address. The program reads or writes a symbolic tag that the compiler maps to a different byte pair than the slot's actual peripheral address. On S7-300, analog modules live in the peripheral address area, not in the regular I/PII area — you must read PIW / write PQW with the :P suffix (or the explicit PIW/PQW keyword) to bypass process-image mirroring and see the current hardware value.
2. Wrong measurement type. Channel group is set to "Voltage ±10 V" while the field actually delivers 4–20 mA. The module is hardware-protected against overcurrent and clamps the channel near 0, while still reporting "no error" because the configured range has not been exceeded.
3. 4-wire transducer configured but only 2 wires landed. When the channel measurement type is "Current, 4-wire transducer", the AI module does not source loop power to the field device. If the transmitter has no separate 24 V supply, no current flows and the input sits at 0.
4. Output forced at 0 count. A value of 0 in a 4–20 mA range corresponds to 4 mA at the terminal. Forcing the watch table does not move an analog output because Forcing locks individual bits; an analog output must be driven by a MOVE / SCALE block writing to the PQW address.

Hardware Configuration Verification in TIA Portal V11

TIA Portal V11 (released 2012) introduces the unified Device View that replaces the SIMATIC Manager hardware catalog. Open Project tree → PLC_1 → Device configuration, locate the SM 331 in the rack, and verify the following for each channel group:

1. Select the SM 331 in the rack overview; the inspector pane shows Properties → Analog inputs.
2. Open Channel groups and confirm each group's Measurement type matches the field wiring:
   • 2-wire current loop → Current (4-wire transducer) with separate loop supply, or Current (2-wire transducer) if the module supplies loop power.
   • Active 4–20 mA transmitter with its own 24 V → Current (4-wire transducer).
3. Confirm the Range is 4..20 mA, not 0..20 mA. A range of 0–20 mA treats 0 mA as the live-zero, which can mask a broken loop.
4. Confirm Diagnostics is enabled (wire-break, underflow) — disabled diagnostics hide channel errors from the CPU.
5. Note the starting Input address. For the SM 331, the default starting address in slot 4 of rack 0 is 256; user code can rename this. In the case that motivates this article, the user-confirmed address was IW352:P, indicating the module was placed in slot 10 or a re-address was applied.

Repeat the inspection for the SM 332: confirm Output type = Current, Output range = 4..20 mA, and note the Output address (QW464:P in the reported case).

Peripheral Addressing Scheme for S7-300 Analog Modules

S7-300 analog modules expose their channel values in the process image of the inputs (PII) and process image of the outputs (PIQ), but the values originate from the peripheral (P) area. The two are not the same memory region: PII is updated once per scan by OB1, while the P area holds the live hardware value.

For the SM 331 with starting address 352, the eight 16-bit input words occupy addresses 352 through 366 inclusive. Channel mapping:

For the SM 332 with starting address 464, the eight 12-bit output words occupy addresses 464 through 478 inclusive. A raw output value of 0 produces 4 mA in the 4–20 mA range, 13824 produces 12 mA (mid-scale), and 27648 produces 20 mA. The same scaling rule applies in reverse for SCALE/XNORM conversions.

Use Siemens FAQ on analog value scaling for S7-300/S7-400 to confirm the linear mapping for each range.

Transducer Wiring: 2-Wire vs 4-Wire Transmitter

For 4–20 mA transmitters, the SM 331 supports two wiring modes that look almost identical on the terminal strip but require fundamentally different power arrangements:

If the project has been configured for a 4-wire transducer but the field device has no separate supply, the loop is dead and the AI sits at 0 regardless of any calibration source. To validate with a calibrator such as a Fluke 743B:

1. Disconnect the field wires from the AI terminal block.
2. Set the calibrator to source 4 mA into the AI terminals (observe polarity: + on terminal I+, – on terminal I–, or the equivalents labelled on the front cover).
3. Switch the channel-group measurement type to Current (4-wire transducer) if not already, so the module does not attempt to source power.
4. Read PIW352 (or the channel-specific word) in a VAT. The raw value must be ≥ 0 for 4 mA and rise linearly toward 27648 at 20 mA.

Forcing Analog Outputs vs the MOVE Instruction

The watch-table Force column locks individual I/O bits to a fixed state for safety-critical testing. Forcing a QW word forces each of its 16 bits independently and does not propagate the assembled integer to the analog output as a physical quantity. As a result, forcing every bit to 0 leaves the output at the bottom of its range (4 mA in a 4–20 mA range), which is exactly the symptom in the original incident.

To drive an analog output from a watch table, use the Modify column (or Modify value) instead of Force. Modify writes a value into the process image, and OB1 propagates it to the module on the next scan. Alternatively, drive the output from program code using a MOVE block:

// SCL example — write 12.0 mA to PQW464
#raw_scaled := REAL_TO_INT(12.0 / 16.0 * 27648.0 + 0.5);
// raw_scaled ≈ 20736 for 12.0 mA
MOVE(IN := #raw_scaled, OUT := %QW464:P);

For ladder, use the MOVE box with input integer 20736 and output QW464:P or PQW464. Verify by measuring the loop current with a clamp meter or by breaking the loop and inserting a multimeter in series.

Diagnostic LED and Buffer Interpretation

On the front of the SM 331 and SM 332, four LEDs are diagnostic. Confirm their state before declaring the channel healthy:

If the SF LED is dark but the analog value still reads 0, the configuration is the suspect. If SF is lit, open the CPU's diagnostic buffer (Online → Online & diagnostics → Diagnostic buffer) and look for OB82 entry "Channel fault" or "Wire break". A wire-break on a 4–20 mA channel typically registers as 0x18 at the channel status byte.

Step-by-Step Resolution Procedure

1. Stop the CPU. Switch the CPU to STOP from TIA Portal or the mode selector. This prevents Forcing from being applied mid-reconfiguration.
2. Open the device configuration and click the SM 331 slot. Confirm the module is the MLFB you expect. A wrong MLFB (for example a 6ES7331-1KF02 instead of 7NF00) loads different firmware and accepts different ranges.
3. Configure each channel group:
   • Measurement type: Current
   • Range: 4..20 mA
   • Wiring: 4-wire transducer if the field device has its own supply, 2-wire transducer if the loop is fed from the AI module.
   • Diagnostics: enable wire-break and underflow interrupts.
4. Note the starting I/O addresses. Record the AI start address (PIW352 in the reported case) and AO start address (PQW464).
5. Compile and download the hardware configuration to the CPU. Accept any prompt about overwriting the existing configuration.
6. Update the program:
   • For each AI channel, change the symbolic tag or direct address to use the :P syntax in a watch table: PIW352, PIW354, … for live reads.
   • For each AO channel, replace any Force operation with a MOVE box from a calculated integer to PQW464:P.
7. Test with a calibrator. Inject 4 mA, 12 mA, and 20 mA and confirm the raw integer at the matching PIW is 0, ~13824, and 27648 respectively.
8. Test the output. Place a multimeter in series with the output loop. Use a watch table with the Modify column (not Force) to write 0, 13824, and 27648 to PQW464 and confirm 4 mA, 12 mA, and 20 mA at the terminals.
9. Cancel any leftover Forces via Online → Force → Cancel forcing.
10. Switch CPU back to RUN and validate end-to-end with the connected field transmitters and actuators.

Verification and Commissioning Checks

After the resolution procedure, perform these final verification steps before signing off the station:

• End-to-end mA sweep on every channel. Inject 4, 8, 12, 16, and 20 mA and confirm linear response within ±0.1 % of span (typical 4–20 mA linearity spec for the SM 331).
• Watch-table stability check. Monitor the raw value at 12.000 mA input for at least 60 s. Drift of more than 4 counts (≈ 0.025 % of span) indicates a noisy channel — typically a grounding issue or a long unshielded cable run.
• Output under load. Drive each AO to 20 mA with the field load (e.g. valve positioner, indicator) connected. Confirm the loop voltage at the SM 332 terminals stays inside the module's compliance range (typical ≥ 18 V at 20 mA with 24 V supply).
• Diagnostic-buffer cleanliness. Trigger a deliberate wire-break (disconnect + terminal) on one AI channel and confirm an OB82 entry is generated with channel number and direction. This proves diagnostics are alive.
• Profibus consistency. If the TP1200 Comfort HMI tags are bound to the same PIW/PQW words, validate the HMI faceplate against the same calibration sweep.

For a deeper reference on signal scaling and the S7-300 analog family, see the Siemens S7-300 Automation System module specifications manual and the S7-300 module data reference manual.

Common Pitfalls and Edge Cases

Even with the correct configuration and addressing, several field conditions routinely mimic the "frozen" symptom:

• Channel group disabled. Setting a channel group to "Deactivated" in the device configuration makes its PIW read 0 and prevents the AO from being driven. This is a common "I forgot to enable the new channel" mistake after expanding the I/O list.
• Wrong channel group number. The 6ES7331-7NF00-0AB0 has two channel groups of four channels each. Mixing group 0 and group 1 wiring causes the active channels to read 0 even when the inactive group is wired.
• Substitute MLFB loaded. Some legacy projects reference 6ES7331-7KF02-0AB0 (SM 331 AI 8×12 bit) where the actual hardware is 7NF00. TIA Portal V11 accepts the substitution silently if the slot is occupied; the 12-bit variant cannot be reconfigured to 16-bit ranges and silently drops out-of-range values.
• Module in slot 3 (IM slot). Slot 3 of the S7-300 is reserved for the interface module in a multi-rack configuration. Placing an analog module there is rejected by the CPU but a wrong rack number in the device configuration can mask the error.
• TP1200 Comfort Profibus alias mismatch. When the HMI's Profibus slave address points to a slot that is not populated, all symbolic tags from the HMI show 0 even though the CPU program reads correctly.
• Cold-junction compensation missing on thermocouple channels. Although not relevant to the 4–20 mA case, thermocouples read ambient (≈ 0 °C) without a CJ compensation configured — yet another "frozen at zero" symptom to rule out.
• Subsequent TIA Portal versions change HW config defaults. If the project is later opened in TIA Portal V13/V14/V15, the default measurement type for new modules may differ from V11. Re-validate the configuration after any major version upgrade.