S7-300 SM331 AI8x12 Returns -32768: PIW286 vs %DW286:P Fix

Problem Summary

A SIMATIC S7-300 CPU 315-2 PN/DP (article number 6ES7315-2EH14-0AB0) is being read in TIA Portal V17 with the IEC operand syntax %DW286:P to fetch a 4-20 mA pressure signal wired to channel 0 of an SM331 AI8x12 module (6ES7331-7KF02-0AB0). The tag is permanently locked at -32768 (0x8000 hex) regardless of the current produced by a bench simulator. That single value is the universal SIMATIC S7-300 signature for "underrange / wire break / no signal" and the symptom masks three independent root causes that converge on the same failure mode:

1. The :P slice access qualifier is an S7-1200 / S7-1500 feature and is not implemented on S7-300/S7-400 CPUs. On S7-300 the equivalent is the PIW (Peripheral Input Word) prefix.
2. The default process image of inputs (PII) on the S7-300 is 128 bytes. The configured slot of the SM331 begins at IW272, which is outside the default PII, so the value the application reads is the power-on default 0x8000 rather than a live conversion.
3. The measuring range module (DIP switch) on the back of the SM331 is set to position D (RTD / resistance) while a 2-wire 4-20 mA transducer is connected. The hardware decoder therefore routes the input through the resistance front-end; any current applied is reported as underrange.

Affected Hardware and Software

What -32768 (0x8000) Actually Means on S7-300 Analog Inputs

The SM331 12-bit ADC quantises the input according to the configured range. A 4-20 mA channel has the following nominal mapping and fault states:

A reading of 0x8000 after the module is configured and the channel is enabled is therefore always an indication that the analog front-end is not seeing a valid current, or that the module has lost its 24 V supply and the peripheral access is reading the safe-state default.

Why %DW286:P Does Not Work on S7-300

The IEC 61131-3 absolute operand %prefixDWaddress refers to the input double-word (32-bit) at the given byte offset. The trailing :P is the slice qualifier "process image direct" (also called peripheral access in TIA Portal). It tells the controller to read the input directly from the I/O backplane at the start of the current OB, instead of the value previously copied into the process image of inputs.

On S7-1200 (firmware ≥ V2.0) and S7-1500, this slice qualifier is fully supported. On S7-300 and S7-400 the corresponding functionality is exposed by a different operand prefix:

The STEP 7 compiler will reject %DW286:P on an S7-300 CPU with "Address type not supported in this CPU". If the operand slips through (for example, by being entered as a literal in a watch table or by an FB written on an S7-1500 and pasted into an S7-300 project), the read returns the power-on default 0x8000 — which is exactly the symptom reported.

Process Image Architecture on the S7-300

The S7-300 copies peripheral inputs into a 128-byte (default) RAM area at the start of OB1. The CPU then executes the application using the "PII" snapshot. Outputs are written back to the PIO at the end of OB1. The mechanism is designed to give the application a deterministic view of inputs and to bound OB execution time by avoiding backplane accesses inside the cycle.

Key boundaries for the CPU 315-2 PN/DP:

Peripheral input words above the configured PII size can only be read with the PIW prefix; the IEC %IW view does not exist beyond the configured boundary. If the SM331 is configured at IW272 with the default 128-byte PII, the value IW272 from the process image is stuck at the power-on default 0x8000, and PIW272 returns the live conversion.

Primary Fix — Replace %DW286:P with PIW 286

The simplest, lowest-risk change is to read the peripheral input word directly. PIW 286 returns the live conversion regardless of PII size and works on every S7-300/400 CPU ever shipped.

STL (classic STEP 7)

// Pressure input on SM331 at slot 3, channel 0, address 286
L     PIW 286          // Direct peripheral input word (live)
T     MW  100          // Copy to flag word for further use
NOP   0

SCL (TIA Portal V17)

// Read live peripheral input word and convert to INT
iRawPressure := WORD_TO_INT("PIW_286");

// Detect underflow / wire break
IF iRawPressure = -32768 THEN       // 0x8000
    bWireBreak := TRUE;
    rPressure  := 0.0;
ELSIF iRawPressure = 32767 THEN     // 0x7FFF
    bOverflow  := TRUE;
    rPressure  := 0.0;
ELSE
    bWireBreak := FALSE;
    bOverflow  := FALSE;
END_IF;

LAD

The equivalent LAD implementation is a single move box: MOVE PIW286 → MW100. Combine it with a comparator for the value 0x8000 in a separate network if you need a wire-break flag.

Secondary Fix — Extend the Process Image of Inputs

If the project architecture requires process-image reads (e.g. to feed OB1 consistent bits or for alarm generation), extend the PII in TIA Portal V17 so it covers the SM331 slot:

1. In the project tree, open Devices & networks and double-click the CPU icon (6ES7315-2EH14-0AB0).
2. Select the Properties tab, then Cycle / clock memory.
3. Under Process image increase "Size of process image of inputs" to a value strictly greater than the highest IW byte used. For IW272 (byte 543) set the size to 1024 bytes (the maximum supported by the 6ES7315-2EH14).
4. Download the HW configuration. TIA Portal V17 will request a STOP-to-RUN transition.
5. Replace %DW286:P with %IW286 in every user block.

Hardware Configuration — Set the Measuring Range Module Correctly

The SM331 6ES7331-7KF02-0AB0 has four measuring range modules on the back/side of the module, one per pair of channels (group 0 = channels 0-1, group 1 = 2-3, group 2 = 4-5, group 3 = 6-7). Each module is a small 4-position DIP switch labelled A, B, C, D. The switch position is the hardware decoder for the analog front-end — it must match the type of sensor wired to the channel pair, regardless of what the TIA Portal software says.

For a 2-wire 4-20 mA pressure transducer, the measuring range module for the channel pair must be set to C. Always re-verify the position with the module unplugged; the white plastic cam on the side of the front connector also serves as the switch lever.

Wiring a 2-Wire 4-20 mA Transducer to SM331 6ES7331-7KF02-0AB0

For a 2-wire transmitter the module supplies the 24 V loop voltage through the same terminals that read the current. On the 6ES7331-7KF02-0AB0, with a 40-pin front connector, channel 0 is wired as follows:

If you are using a 20-pin front connector, the terminal numbers for the 2-wire wiring differ (refer to the SM331 manual for your specific pinout). The principle is the same: Ch+ provides the loop supply, Ch− returns the current.

TIA Portal V17 Channel Configuration

Software configuration must agree with the hardware. For the 6ES7331-7KF02-0AB0, channel 0 must be set to current, 4-20 mA, single-ended, with diagnostic interrupts enabled if you want wire-break indication in the diagnostic buffer.

1. In Devices & networks, double-click the SM331 icon in the rack.
2. Switch to the Properties > Inputs tab.
3. Select Channel 0 in the channel overview. Tick "Enable channel".
4. Set Measurement type = Current.
5. Set Current range = 4..20 mA.
6. Under Diagnostics, enable Wire break. The module will then set the diagnostic interrupt when the current drops below 1.185 mA, and the SF LED lights up.
7. Under Trigger, set the interrupt priority high enough that it pre-empts OB1 but does not steal from your fast OB (e.g. priority 16).
8. Compile and download the HW Config.

If the software is set to "Voltage" while the switch is on "C", the module is internally consistent (it does not validate the switch), but the analog front-end will source / sink current through a 1 MΩ voltage divider and produce a meaningless value. The hardware switch is always the ground truth.

Hardware Diagnostics — LED and 24 V Supply Check

The SM331 6ES7331-7KF02-0AB0 has three LEDs per module: SF (group error), BF (bus fault on the backplane, only on the Profibus variant), and the channel-specific indicators integrated into the front connector. A red SF LED is the most important early indicator of misconfiguration:

Always measure the 24 V at terminal 39/40 of the front connector with the connector unplugged from the module. A floating ground (L+ present, M open) will let the green LEDs flicker as the module re-boots every 100 ms.

Scaling 4-20 mA to Engineering Units

The raw integer must be linearised to engineering units (e.g. bar, °C, %) before it is useful. The S7-300 in TIA Portal V17 supports the SCL 1.0 instructions NORM_X and SCALE_X from the standard library; for classic STEP 7 use the legacy blocks FC105 (FC_SCALE) and FC106 (FC_UNSCALE).

Using NORM_X / SCALE_X in SCL

FUNCTION "FC_PressureScaling" : Real
VAR_INPUT
    iRawWord   : INT;     // 0..27648 for 4..20 mA
    rMinEng    : REAL;    // 0.0  bar at 4 mA
    rMaxEng    : REAL;    // 10.0 bar at 20 mA
END_VAR
VAR
    rNorm      : REAL;
END_VAR
BEGIN
    IF iRawWord = 16#8000 OR iRawWord = 16#7FFF THEN
        // Underflow / overflow -> return safe value
        "FC_PressureScaling" := 0.0;
        RETURN;
    END_IF;
    rNorm := NORM_X(MIN := 0.0,
                    VALUE := INT_TO_REAL(iRawWord),
                    MAX := 27648.0);
    "FC_PressureScaling" := SCALE_X(MIN := rMinEng,
                                    VALUE := rNorm,
                                    MAX := rMaxEng);
END_FUNCTION

Using FC105 in classic STL

// FC105 inputs:
//   IN    -> PIW286 (INT)
//   HI_LIM -> 10.0  (REAL, engineering max)
//   LO_LIM -> 0.0   (REAL, engineering min)
//   BIPOLAR -> FALSE (0 = unipolar, 1 = bipolar)
// FC105 output:
//   OUT   -> MD100  (REAL, engineering value)
CALL  FC105
     IN     := PIW286
     HI_LIM := 1.000000e+001
     LO_LIM := 0.000000e+000
     BIPOLAR:= FALSE
     RET_VAL:= MW200
     OUT    := MD100
NOP   0

For 4-20 mA the engineering range and the raw range are always 0 to 27648, and the slope is positive. If the sensor is reverse-acting (20 mA = 0 bar) swap HI_LIM and LO_LIM and let FC105 handle the inversion automatically.

Troubleshooting Matrix

Verification and Commissioning Steps

1. Open TIA Portal V17, connect to the CPU 315-2 PN/DP, and go online.
2. In the project tree, open Watch and force tables and add a new table. Insert "PIW_286" (the symbolic name of the peripheral input word — TIA auto-creates the symbol for the configured slot).
3. Apply 4 mA with the bench simulator. The watch table should show 0 and the SF LED should be off (no underrange, live downscale).
4. Apply 12 mA. The watch table should show 13824 (50 % of 27648). The SF LED should be off.
5. Apply 20 mA. The watch table should show 27648. The SF LED should be off.
6. Reduce the current to 0 mA (open the loop). The watch table should show -32768 (0x8000) and the SF LED should start fast-flashing if the diagnostic interrupt is enabled.
7. In Online & diagnostics > Diagnostic buffer, confirm the events are recorded as expected.
8. Force the raw word in the watch table, then call your scaling FC. Verify the engineering value matches.

Related Edge Cases

Process image size and the OB update rules

On the S7-300, the process image is refreshed automatically by OB1 (and the configured update OBs, if any). If you read PIW286 from inside OB1, you read the live value. If you read it from an OB that is not on the update list (e.g. OB40 hardware interrupt), the process image of inputs is also updated automatically by the S7-300 firmware when the OB is called, so PIW286 is safe. Avoid reading PIW286 inside cyclic OB35 if you do not need the live value — use IW286 and rely on the OB1 update to keep the value consistent.

4-wire transmitter on the same module

If you later add a 4-wire transmitter to a free channel group, set the DIP switch to position B, supply the transmitter with 24 V from a separate rail, and configure the channel in TIA Portal as "Current 4-wire 4..20 mA". Mixing 2-wire and 4-wire transmitters on the same channel pair is impossible because the pair shares one DIP switch.

Module diagnostic in the diagnostic buffer

With the wire-break diagnostic enabled, an open circuit on channel 0 generates event W#16#5301 in the diagnostic buffer. The application can read the diagnostic data via SFC 51 ("RDSYSST") with index 0x00B1 / 0x0131. See the S7-300 system manual, chapter "Diagnostics of the SM331".

Cross-platform portability

If you later port the program to an S7-1500, the PIW prefix is no longer needed; the %IW286:P slice qualifier is the modern equivalent. The peripheral address space is also larger, so the slot can be moved closer to the start of the process image automatically.

Frequently Asked Questions