Siemens S7-300 Analog Module Wiring and Configuration Guide
Analog signal modules are the boundary where physical-world variables (temperature, pressure, flow, level, position) become engineering values inside the PLC. The SIMATIC S7-300 family (CPU 312 through CPU 319) accepts analog inputs through the SM 331 (Analog Input, AI) family and produces analog control signals through the SM 332 (Analog Output, AO) family, with combined SM 334 / SM 335 modules for compact machines. This reference explains the channel-by-channel wiring topology, the module hardware addressing (DIP switches and backplane slot conventions), the configuration path inside STEP 7 V5.x and TIA Portal, and the scaling math that converts the raw 16-bit integer to engineering units.
Unlike digital inputs where a single bit maps to a 24 V contact, every analog channel on an SM 33x has its own measurement type (voltage, current, RTD, thermocouple), its own range, and its own diagnostics behavior. Configuration is therefore per-channel rather than per-module, and most field issues (overflow, underflow, noisy reading, broken wire) trace back to a wrong measurement type or a missing jumper on the terminal block.
Analog Signal Standards Used With SM 33x Modules
Before selecting a module, lock down the sensor signal standard. The SM 331 and SM 332 modules cover the four common industrial signal types:
| Signal | Range | Typical Sensor | Notes |
|---|---|---|---|
| Voltage | 0 to 10 V, ±10 V, 1 to 5 V, ±5 V, 0 to 5 V | Position transducers, panel meters, pyrometers | Shielded twisted pair, ground reference at module |
| Current | 0 to 20 mA, 4 to 20 mA, ±20 mA | Loop-powered 2-wire transmitters, valve positioners | 4–20 mA is the preferred standard; live-zero detects open wire |
| RTD (resistance temperature detector) | Pt100, Pt200, Pt500, Pt1000, Ni100, Ni1000, Cu10 | Temperature probes | 4-wire connection on most modules eliminates lead resistance |
| Thermocouple (TC) | Type B, E, J, K, L, N, R, S, T, U | High-temperature furnaces, exhaust | Internal or external cold-junction compensation (CJC) |
SM 331 Analog Input Module Family
Common SM 331 catalog numbers (full part numbers in the SIMATIC S7-300 Automation System Module Data manual):
| MLFB / Order Number | Channels | Resolution | Signal Types | Use Case |
|---|---|---|---|---|
| 6ES7331-7KF02-0AB0 | 8 AI | 12-bit + sign | U, I, RTD, TC (with range sub-modules) | Cost-optimized universal AI |
| 6ES7331-7NF10-0AB0 | 8 AI | 16-bit | U, I, RTD, TC | High-precision measurement |
| 6ES7331-7PF11-0AB0 | 8 AI | 16-bit | RTD / resistance, 4-wire | Pt100/Pt1000 in process |
| 6ES7331-7PF01-0AB0 | 8 AI | 16-bit | Thermocouples, 4-wire TC | Furnace temperature |
| 6ES7331-1KF02-0AB0 | 8 AI | 12-bit | U, I, RTD | Economy AI for non-critical loops |
| 6ES7336-1HE00-0AB0 | 6 AI | 15-bit + sign | 4-wire RTD, high-accuracy TC | Lab and reference applications |
SM 332 Analog Output Module Family
| MLFB | Channels | Resolution | Signal Types | Load / Compliance |
|---|---|---|---|---|
| 6ES7332-5HD01-0AB0 | 4 AO | 12-bit | ±10 V, 0–10 V, 1–5 V, 0–20 mA, 4–20 mA, ±20 mA | V: 1 kΩ min, I: 500 Ω max |
| 6ES7332-5ND01-0AB0 | 4 AO | 12-bit | Isolated outputs, full ranges | Galvanic isolation per channel |
| 6ES7332-7ND02-0AB0 | 8 AO | 16-bit | ±10 V, 0–10 V, 1–5 V, 0–20 mA, 4–20 mA, ±20 mA | High-density, high-precision |
| 6ES7332-8TF01-0AB0 | 8 AO | 15-bit + sign | Full ranges, 8 channels | Premium precision |
Hardware Installation and Backplane Slot Addressing
The S7-300 I/O address layout is fixed and slot-based. Slot 1 is reserved for the power supply (PS 307); slot 2 is the CPU; slots 3 through 8 are signal modules (SM) and function modules (FM). Address assignment is computed as follows for an S7-300 in STEP 7 V5.x:
- Open HW Config and drag the SM 33x module from the catalog onto the desired slot.
- STEP 7 assigns digital addresses automatically (e.g. PIW 304, PIW 306 … for slot 4, channel 0/1).
- Each analog channel consumes 2 bytes (16 bits) in the process image. 8-channel modules therefore use 16 bytes of input or output space.
- For outputs, the process output word (POW) address is assigned to the slot by the same convention.
Address formula (per S7-300 manual, chapter 4):
- Analog input base address = (slot − 1) × 32 + 256 → first channel: base, second channel: base+2, …, eighth channel: base+14.
- Example: SM 331 in slot 4 → base 352. Channels read at PIW 352, PIW 354, …, PIW 366.
Range Sub-Modules and Per-Channel Jumpering
Most SM 331 modules use plug-in measuring-range sub-modules (sometimes called "range cards") located behind the front cover of each channel group. Two channels share one sub-module, so the practical granularity is 2 channels per range.
Sub-module positions and signal type:
| Sub-module Position | Signal Type |
|---|---|
| A | ±5 V, ±10 V, 1 to 5 V, 0 to 10 V, ±20 mA, 0/4 to 20 mA, 4-wire RTD |
| B | ±5 V, ±10 V, 1 to 5 V, 0 to 10 V, ±20 mA, 0/4 to 20 mA |
| C | 0 to 5 V, ±500 mV, ±1 V, 0/4 to 20 mA, 2-wire RTD/TC |
| D | Thermocouple, mV ranges (J, K, N, E, T, R, S, B) |
Always set the sub-module before applying power; the module reads its position only at startup. A mismatch between the sub-module (hardware) and the STEP 7 configuration (software) will trigger SF (system fault) on the module and a diagnostic interrupt (OB82).
Channel-Wise Wiring Topologies
2-Wire Current Transmitter (4–20 mA)
The transmitter is loop-powered. The SM 33x provides 24 V on the channel screw terminal, the current flows through the field device, and the return path closes at the module's M terminal.
SM 331 terminal (channel 0, 4–20 mA, 2-wire)
Pin 1 (+24 V out) ----[ Tx+ ]----[ 2-wire transmitter ]----[ Tx- ]---- Pin 2 (M in)
Pin 3 (Qv) not connected
Pin 4 (M ana) bonded to Pin 2 at the module
Total loop voltage drop = transmitter drop + line drop. Maximum loop load for SM 331 4–20 mA is 600 Ω; verify that V_trans(min) + (I × R_line) ≤ module supply.
4-Wire RTD (Pt100)
Use the 4-wire method on modules that support it (sub-module position A on most SM 331 AI 8x RTD variants). The constant excitation current is forced through two wires; the voltage drop is measured with two separate high-impedance sense leads to cancel lead resistance.
Pt100 4-wire hookup to SM 331:
I+ (terminal 1) --> RTD lead A
S+ (terminal 2) --> RTD lead B (sense +)
S- (terminal 3) --> RTD lead C (sense -)
I- (terminal 4) --> RTD lead D
Shield --------> PE bar (both ends tied)
3-wire RTD: bridge the S- and I- terminals on the module, connect the two return leads to I+ / S-. The line resistance is halved and approximated.
Thermocouple
Use shielded thermocouple extension wire, terminated to the TC terminals on the SM 331. Cold-junction compensation (CJC) can be selected in HW Config under Measurement Type → Thermocouple → Compensation: Internal / External / None. The internal CJC sensor is a single Pt1000 diode on the front connector; accuracy is typically ±1–2 °C. For higher accuracy, use a separate external CJC probe and select it in software.
Voltage Output Wiring (SM 332)
Voltage outputs are referenced to M_ana. The differential output (Qv / M) drives the load directly. For 4–20 mA, the loop must close through the load: Module Qv (current out) → Load → M_ana (return). Maximum load: 500 Ω for current outputs of SM 332.
Configuration in STEP 7 V5.x (Classic)
- Open the project in SIMATIC Manager. Open HW Config for the S7-300 station.
- Insert the SM 33x from the catalog at the correct slot (3–8). Confirm the order number matches the physical module.
- Double-click the module → Properties → Inputs tab. For each channel group (0–1, 2–3, 4–5, 6–7) select:
- Measurement type: Voltage / Current / RTD / TC / Deactivated
- Measurement range: e.g. 0–10 V, 4–20 mA, Pt100 standard, TC type K
- Interference frequency suppression: 50 Hz, 60 Hz, 400 Hz (matches the mains frequency in your region; 50 Hz recommended for Europe)
- Diagnostic interrupt: enable for broken wire / overrange / underrange
- Click OK and save. The configuration is downloaded with the rest of HW Config.
- Read the raw value in OB1, OB35, or a data block:
L PIW 352 // channel 0 T DB10.DBW 0 // store raw 16-bit - Scale using the S7 standard library FC105 "SCALE" (input range 0–27648 for unipolar signals):
CALL FC 105 IN := DB10.DBW 0 // raw value LO_LIM:= 0.0 // engineering low HI_LIM:= 100.0 // engineering high BIPOLAR:= FALSE // unipolar RET_VAL:= MW100 // error word OUT := MD104 // scaled REAL result - For analog output scaling use FC106 "UNSCALE". For bipolar signals set BIPOLAR := TRUE and the input range becomes −27648 to +27648.
Configuration in TIA Portal (V16 / V17 / V18)
- Open the project in TIA Portal. Open the Device configuration for the S7-300 CPU.
- Drag the SM 33x from the hardware catalog to the correct slot. The TIA Portal uses the same slot convention as STEP 7 V5.x.
- Click the SM 33x → Properties → Analog inputs / Analog outputs section. The Portal exposes the same per-channel configuration (measurement type, range, diagnostics, integration time).
- Use the I/O tags table to declare symbolic names:
"TankLevel"of type INT, address%IW64. - Use the SCALE and UNSCALE instructions from the Extended Instructions palette (TIA V16+) or continue to use the legacy FC105/FC106 blocks copied from the standard library.
- For cyclic acquisition, prefer OB1 (process image) or OB35 (100 ms cyclic interrupt) rather than free-running reads. Update time per channel is set in the module properties and is typically 2.5 / 16.6 / 20 / 100 ms depending on interference frequency selection.
Analog Value Representation (16-Bit Integer)
The S7-300 analog modules return a signed 16-bit integer. The mapping between physical signal and integer value is identical for AI and AO and is defined in chapter 5 of the S7-300 Module Data manual:
| Range | 0–10 V | ±10 V | 0/4–20 mA | ±20 mA |
|---|---|---|---|---|
| Overflow (fault) | 32767 (0x7FFF) | 32767 | 32767 | 32767 |
| Overrange | 32511 (0x7EFF) | 27649 / 32511 | 32511 | 27649 / 32511 |
| Nominal high | 27648 (0x6C00) | 27648 | 27648 (20 mA) | 27648 |
| Nominal low | 0 (0x0000) | −27648 | 0 (0/4 mA) | −27648 |
| Underflow | −1 (0xFFFF) | −1 | −1 (live-zero < 4 mA) | −1 |
| Wire break / overflow | 32767 | 32767 | 32767 | 32767 |
Raw engineering conversion for a unipolar signal (default FC105 input range):
OUT_REAL = (IN_INT / 27648.0) * (HI_LIM - LO_LIM) + LO_LIM
For bipolar: OUT_REAL = (IN_INT / 27648.0) * (HI_LIM - LO_LIM) with the appropriate LO_LIM/HI_LIM sign.
Common Configuration Errors and Diagnostic Codes
| SF LED | Diagnostic Buffer Text | Likely Cause | Fix |
|---|---|---|---|
| ON | Module parameterization error | HW Config range ≠ sub-module position | Match software to physical sub-module; power-cycle |
| ON | Front connector missing | Connector not seated or wiring error | Re-seat connector; check ribbon cable to module |
| OFF but value = 32767 | Overrange / open wire (4–20 mA) | Field loop open, polarity reversed, or signal out of range | Check loop voltage, polarity, line resistance |
| OFF but value = −1 | Underflow / wire break | Loop open at 4–20 mA, TC cold junction broken | Check transmitter power; verify TC extension wire |
| OFF but value flickers ±5 LSB | Mains noise coupling | Interference frequency suppression mis-selected | Set to 50 Hz (EU) or 60 Hz (NA) |
| OFF, value stuck at last value | Diagnostic interrupt pending | OB82 not loaded, so module halts updates | Load OB82 (empty is fine) into the CPU |
Cross-Platform Reference
Different PLC platforms use the same signal types but different terminology and configuration paths. The principles below apply to systems from the Analog Devices software ecosystem for signal-chain evaluation, the AutomationDirect LS Electric XGB line, and the National Instruments FlexLogger channel specification model.
Allen-Bradley CompactLogix / ControlLogix
- Analog module catalog: 1769-IF8 (8 AI, current/voltage), 1769-IF4 (4 AI), 1769-OF8C, 1769-OF4 (AO).
- Configuration: RSLogix 5000 / Studio 5000 Logix Designer → I/O Configuration → Module → Properties → Input / Output tabs. Each channel has a range dropdown and an engineering scaling pair (Input Scaling = 0–100 % → Process Range = 0–10 000 gal).
- CIP tags are read directly as INT or REAL; no FC105/FC106 equivalent is required if scaling is set in the module properties.
AutomationDirect LS Electric XGB (XBM/XBC series)
- Analog input module XEM-AIM8, XBM-AIM8 / AIM4, XBC-AIM4 / AOM4.
- Configuration: XG5000 → I/O Parameter → Analog Input → Channel type / Range / Filter time. Channel 0–7 selectable as voltage (0–10 V) or current (0/4–20 mA) per group.
- Read using "PUT/GET" style data addresses e.g.
%UW0.10.0for the first word of slot 10, then scale with the built-in SCALING library or the dedicated SCALE instruction in the XGB function block library.
National Instruments FlexLogger (Data Acquisition)
- Per-channel Channel Specification drives both AI and AO behaviour. The Configure Analog Output workflow toggles the channel enable, sets the output type (voltage / current) and applies a global scaling function.
- For one-off testing (e.g. bench-validating an SM 332 card) a FlexLogger DAQ device with a current output can drive a 4–20 mA loop while the S7-300 channel is read in STEP 7 online monitor.
Texas Instruments MSPM0 (Embedded MCU Companion)
- The MSPM0-ANALOG-CONFIGURATOR GUI builds a register map for the on-board ADC and DAC chain. While not a PLC analog module, it is the reference tool used by engineers who want to develop their own signal-conditioning front end for a field device that eventually terminates at an SM 33x channel.
Verification and Commissioning Procedure
- Power the rack and check the SM 33x LEDs: SF must be off, BF off, and the per-channel status LEDs (where present) off.
- Open Online → Monitor/Modify in STEP 7 or the Watch table in TIA Portal. Read the raw 16-bit value for each channel at
PIW <base>. - Inject a calibration signal with a precision calibrator (e.g. Beamex MC6, Druck DPI 620) on the field terminal block: 4 mA should read 0; 12 mA should read 13824; 20 mA should read 27648. Tolerance ±2 LSB is acceptable for a 16-bit module; ±10 LSB for a 12-bit module.
- Apply FC105 (or equivalent scale function) and confirm the engineering result at the three test points.
- For RTD / TC channels, use a dry-block calibrator. Compare against the SM 331 internal reference; the SM 331 calibrates itself at 90 s and 30 min intervals.
- Trigger diagnostic interrupts by opening a 4–20 mA loop. Verify that OB82 receives the start and end event and the SF LED toggles correctly.
- Document the as-built configuration (slot, sub-module position, channel, range, scaling LO/HI) in the project's hardware documentation.
Field-Proven Tips
- Always use a sub-module position that matches the first channel of a group, not the second. Many failed startups come from swapping the sub-module between groups after wiring.
- Route analog signal cables in a separate tray, at least 200 mm from VFD output cables. Cross at 90° if a crossing is unavoidable.
- Ground the shield at one end only (the module end) when the source is floating; ground at both ends when the source is grounded, to avoid 50/60 Hz ground loops.
- For long analog runs, verify the total loop resistance at 20 mA against the transmitter compliance.
R_max = (V_supply − V_tx_min) / 0.020. - Set the integration time to the longest available (e.g. 100 ms) for slow processes like level and temperature; this gives the strongest 50/60 Hz rejection.
- Save the HW Config (Classic) or compile the device configuration (TIA) every time the channel assignment changes; a stale offline configuration in the PLC will silently override your changes.
FAQ
What is the difference between the SM 331 and SM 332 module families?
The SM 331 is an analog input (AI) module that converts a physical signal (U, I, RTD, TC) into a 16-bit signed integer in the PLC process image at addresses PIW. The SM 332 is an analog output (AO) module that converts a 16-bit integer from the process output (POW) into a voltage or current signal. Combined SM 334/335 modules offer lower channel count and 8–12 bit resolution for cost-sensitive machines.
Why does my 4–20 mA channel read −1 (0xFFFF) at 0 mA?
For 4–20 mA the S7 range starts at 4 mA = 0. Anything below 4 mA (including a true 0 mA or an open loop) is encoded as a negative number down to −1 at the bottom of the underflow window, signalling a live-zero fault. The 0 mA reading is intentional and lets the diagnostic interrupt fire.
How do I match the hardware sub-module position to the STEP 7 configuration?
Open the front cover of the SM 331 and inspect the 4-position DIP-switch or the small 8-pin range card on each channel group. The positions A, B, C, D map to the same labels in HW Config → Module Properties → Inputs → Measurement range. A mismatch lights the SF LED and posts a parameterization error in the diagnostic buffer until the discrepancy is removed and the module is power-cycled.
What is the correct FC105/FC106 scaling formula for bipolar ±10 V signals?
Set BIPOLAR = TRUE, HI_LIM and LO_LIM as your engineering range (e.g. +10 000 and −10 000), and pass the raw value. FC105 computes OUT = (IN / 27648.0) × (HI_LIM − LO_LIM) internally. For unipolar (0–10 V, 4–20 mA) keep BIPOLAR = FALSE and add LO_LIM: OUT = (IN / 27648.0) × (HI_LIM − LO_LIM) + LO_LIM.
My analog input reads the correct value in STEP 7 Monitor but the field value is wrong. Where do I look?
Check four layers in order: (1) the FC105 LO_LIM / HI_LIM against the sensor datasheet, (2) the sub-module position against the configured measurement range, (3) the wiring polarity and shield termination, and (4) the interference-frequency suppression setting (50 vs 60 Hz). A correct monitor reading with wrong engineering value usually means the scaling block, not the hardware, is the issue.