S7-300 SM331 Address 288 Out of CPU Range: PIW Mapping Fix

Problem Overview: PIW 288 Rejected by CPU 313-1AD00

When commissioning an SM 331 analog input module (order number 6ES7331-7KF02-0AB0) on a SIMATIC S7-300 CPU 313-1AD00 (6ES7313-1AD00-0AB0), STEP 7 Hardware Configuration automatically assigns the module's start address at PIW 288 with a length of 16 bytes (channels 0-7, PIW 288 through PIW 303). The first download attempt of an FC that references these addresses returns an error indicating that address 288 is beyond the valid input range of the CPU. The Properties dialog of the SM 331 shows the start address as a grayed-out field, preventing manual re-mapping inside HW Config.

The error is misleading. The CPU 313-1AD00 does support periphery addresses in the 256-1023 range; the actual constraint lies in the way STEP 7 treats process-image versus direct-periphery addressing, combined with the integrated analog I/O already occupied on the CPU itself. This article documents the root cause, the correct LAD/awl pattern, and three field-proven resolutions, and integrates the official SIMATIC S7-300 SM331; AI 8x12 Bit Getting Started commissioning procedure with the modern Input and output addresses in the address overview (STEP 7 / TIA Portal) guidance.

Hardware Context: SM 331-7KF02 and CPU 313-1AD00

Understanding the constraint requires the actual I/O footprint of both devices.

The 16-byte I/O footprint of the SM 331 (8 channels × 2 bytes/channel) is correct. Each analog channel is a 16-bit word regardless of the 12-bit ADC resolution; the lower 3 bits are status/sign and the upper 12 bits carry the converted value. With integrated analog I/O already consuming PIW 256-261 and PQW 256-257, the first external SM 331 cannot start at 256. STEP 7 places the next free address after the integrated range plus any prior slots, which on a 4-slot rack with PS/CPU/IM/SM-1 already populated at slot 4 yields PIW 288 for a slot 5 or slot 6 analog module.

S7-300 Address Space Architecture

The S7-300 input and output address space is partitioned into two functional regions. Misunderstanding this partition is the root cause of the PIW 288 download error.

PIW 288 sits 160 bytes above the top of the PII region. The CPU 313-1AD00 hardware itself accepts this address, but several STEP 7 functions (FC 105, FC 106, system functions that update process-image partitions, and CPU parameter dialogs) interpret an address written in IW/QW syntax as a process-image address and reject it if it lies outside the 0-127 window. The download-time error "address 288 is too high" is generated by this syntax mismatch, not by a real hardware limit.

Default Address Assignment by Slot

For a 4-slot S7-300 rack (PS/CPU/IM/SM-4) without a separate expansion rack, the implicit address layout is:

The user's 288 start address is the standard STEP 7 result for a slot-4 SM 331-7KF02 when the CPU's own 3 AI occupy PIW 256-261. This is correct hardware behavior; the address is not in error.

Root Cause Analysis

Three distinct issues compound to produce the symptom.

Issue 1 - Mnemonic Mismatch

The user wrote the SM 331 channels into the FC source as IW 288, IW 290, ... assuming the process-image access operator. The CPU 313-1AD00 only maintains a 128-byte PII; address 288 falls outside the process image, so the download aborts with the diagnostic entry "Process image area exceeded" or "Invalid address for I/O access." The diagnostic buffer entry is usually Event ID 0xEF41 / 0x457F / 0x49FF depending on firmware version.

Issue 2 - Grayed-Out Start Address in HW Config

In Properties → Addresses of the SM 331, the start address appears as 288 in a non-editable field. The grayed state is caused by one of three settings:

• "System default" is checked (STEP 7 manages the address). Uncheck it to enable manual entry.
• The module is placed in a slot whose address is locked by the CPU's local integrated I/O. Manually relocating a slot-4 SM 331 to a free address requires unchecking "System default" first.
• Address 288 is already occupied by another module (often a hidden module from a previous project). Right-click the rack and select "Edit Ethernet Nodes" / "Address Overview" to detect collisions.

Issue 3 - Process-Image Update Range

Even after switching to PIW syntax, OB1 will not auto-refresh these channels. The CPU 313-1AD00 only updates PII 0-127 at the start of OB1. A direct L PIW 288 instruction in the FC will physically read the SM 331 at the moment the rung executes, bypassing the PII. This is the correct behavior for an analog module that lives in the periphery area, but it must be explicit in the code.

Solution 1: Direct Periphery Read into a Merker Word

The standard, vendor-recommended pattern is to read the periphery word into a Merker (flag) word, then operate on the Merker word inside the rest of the program. This decouples program logic from the physical address and is the pattern Siemens documentation uses in the SM 331 Getting Started PDF.

LAD Source (FC 10 — Read 8 AI Channels)

// Read SM 331 channels into Merker words MW100..MW114
// Author: industrial automation field notes
// 8 channels × 2 bytes per channel
// Each L PIW advances the peripheral pointer

      L     PIW 288        // channel 0 raw value
      T     MW    100      // PIW 288 -> MW 100

      L     PIW 290        // channel 1
      T     MW    102

      L     PIW 292        // channel 2
      T     MW    104

      L     PIW 294        // channel 3
      T     MW    106

      L     PIW 296        // channel 4
      T     MW    108

      L     PIW 298        // channel 5
      T     MW    110

      L     PIW 300        // channel 6
      T     MW    112

      L     PIW 302        // channel 7
      T     MW    114

This pattern is correct for the SM 331-7KF02 in single-channel resolution mode (one 16-bit word per channel). In 4-channel group mode the module packs two channels per word and the address stride changes to 4 bytes; verify this in HW Config → Properties → Inputs → Measuring Mode.

Solution 2: FC 105 SCALE Function for Engineering Units

FC 105 "SCALE" converts the raw 16-bit integer from an analog input into a real engineering value. It is the standard tool in STEP 7 V5.x for normalizing 4-20 mA / 0-10 V signals to user units (e.g., 0.0-100.0 % or 0.0-50.0 bar).

FC 105 Interface

FC 105 Call Example (LAD)

// Convert MW 100 (raw AI channel 0) to engineering value in MD 200
// 4-20 mA -> 0.0-50.0 bar

      CALL  FC   105
        IN     := MW100        // raw value from L PIW 288 / T MW 100
        HI_LIM := 5.000000e+001  // 50.0 bar upper
        LO_LIM := 0.0             // 0.0 bar lower
        BIPOLAR:= FALSE           // 4-20 mA is unipolar
        OUT    := MD200           // 0.0 .. 50.0 result
        RET_VAL:= MW220           // 0 = OK

For 4-20 mA the raw integer follows Siemens convention: 0 mA ≈ 0, 4 mA ≈ 0, 20 mA = 27648, with underrange at -1 (3.999 mA nominal) and overrange at 32767 (overflow). For 0-10 V the same integer range applies. Bipolar -10 V to +10 V uses -27648 to +27648.

FC 105 Error Codes (RET_VAL)

Solution 3: Move SM 331 into the Process Image

If high-frequency, deterministic reading of all 8 channels is required, move the SM 331 into the process-image update range.

Procedure in STEP 7 V5.x

1. Open HW Config, right-click the SM 331-7KF02 module, select Properties.
2. Switch to the Addresses tab.
3. Uncheck the System Default checkbox.
4. Set Start to a free address within the PII region, e.g., 128, 144, 160, or 176. Each SM 331 needs 16 contiguous bytes; pick a multiple of 16 to avoid overlap with other modules.
5. Confirm the new address does not collide with the integrated AI (256-261) or with other digital modules.
6. Click OK, save and recompile the project, and download the HW Config.

For example, setting start address 128 places the module at IW 128 - IW 143, fully inside the PII. The FC source can then use IW 128, IW 130, ... without the "address too high" diagnostic.

Procedure in TIA Portal V20+

1. Open Device Configuration for the S7-300 station.
2. Select the SM 331 module in the rack.
3. In the Inspector window → Properties → General → I/O addresses.
4. Override "System default" and enter a base address within the PII region (0-127).
5. Use Project tree → Devices & Networks → Address overview to confirm there are no conflicts. See the Input and output addresses in the address overview TIA Portal help for the full procedure.

Step-by-Step Implementation (LAD, FC 10)

This procedure implements Solution 1 + Solution 2, the minimum-risk approach for a new project.

Prerequisites

• STEP 7 V5.5 SP4 or later (TIA Portal V13+ also supported for S7-300 projects).
• SM 331-7KF02-0AB0 inserted in HW Config with start address PIW 288.
• Measuring range module on the SM 331 set to "D" (4-20 mA) or "B" (0-10 V) for the channels in use. The A-position is the default for ±10 V; refer to the Getting Started PDF for the A/B/C/D position chart.
• OB1 cycle time verified < 100 ms (typical for CPU 313-1AD00 with one SM 331).

Implementation

1. Create a new FC 10 in the S7 Program / Blocks container.
2. Declare the following IN/OUT/TEMP interface:

   VAR
     ai_raw   : ARRAY[0..7] OF INT;     // raw 16-bit values from PIW
     ai_eng   : ARRAY[0..7] OF REAL;    // engineering values from FC 105
     fc_ret   : ARRAY[0..7] OF WORD;    // FC 105 RET_VAL per channel
   END_VAR
   

3. Insert the eight L PIW 288 + 2*n / T MW 100 + 2*n pairs as shown in Solution 1.
4. Insert eight FC 105 calls, one per channel, mapping each raw word to its engineering value.
5. Call FC 10 from OB1 unconditionally.
6. Save, compile, and download to the CPU. Use Online → Monitor / Modify to inspect MW 100-114 (raw) and MD 200-228 (engineering).

Verification

• Apply a known current (e.g., 12.00 mA) to channel 0. Expect MW 100 ≈ 13824 (12 mA / 16 mA × 27648).
• Apply 4.00 mA. Expect MW 100 ≈ 0 and MD 200 = 0.0 (with 0-50.0 bar scaling).
• Apply 20.00 mA. Expect MW 100 = 27648 and MD 200 = 50.0.
• Check the diagnostic buffer with PLC → Diagnostic Buffer. No Event ID 0x457F or 0x49FF entries should appear.
• Check the SF LED on the SM 331; it must remain off. If it lights, the module has detected a channel fault (broken wire, overrange, measuring range module mismatch). Read the diagnostic interrupt OB82 details with PLC → Module Information.

Troubleshooting Matrix

Analog Value Representation

The SM 331-7KF02 outputs a 16-bit signed integer per channel. For the most common 4-20 mA unipolar range, the bit weighting is:

FC 105 does not interpret overflow or underrange bits; it simply scales the integer linearly. The user's FC must add a check for W#16#7FFF and W#16#8000 to set a sensor-fault flag.

Common Pitfalls and Field-Proven Caveats

Hardware Wiring Reference for 4-20 mA Two-Wire Transmitter

For a standard 2-wire 4-20 mA transmitter on channel 0 of the SM 331-7KF02:

1. Set the measuring range module to position D (4-wire transmitter) or C (2-wire transmitter) per the SM 331 manual.
2. Connect the transmitter positive to terminal M+0 and negative to M-0 on the front connector.
3. Jumper the 24 V sensor supply terminals V+0 and 24 V for 2-wire devices.
4. Connect the cable shield to the grounding bar on the backplane at one end only.
5. Verify polarity with a multimeter at the terminal block; 24 V DC must appear across V+0 and 24 V.

Diagnostic Buffer Event IDs for SM 331 / CPU 313

Summary of Recommended Architecture

For a single SM 331-7KF02 on a CPU 313-1AD00, the recommended pattern is:

1. Keep the SM 331 at its default start address PIW 288 (do not re-map unless the application requires process-image updates).
2. Uncheck "System default" in HW Config only if a manual relocation is unavoidable.
3. Use the L PIW 288 + 2*n / T MW 100 + 2*n pattern in an FC called from OB1.
4. Use FC 105 to convert each raw word to engineering units. Set BIPOLAR = FALSE for 4-20 mA / 0-10 V.
5. Add overflow / wire-break detection on the raw integer (7FFF / 8000 hex).
6. Create OB82 as a real diagnostic handler to prevent CPU STOP on channel faults.
7. Document the Merker word range in the project symbol table so that subsequent programming follows the same convention.