Siemens S7-300 Analog Module Wiring and Configuration Guide

David Krause15 min read
I/O ModulesSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Siemens S7-300 Analog Module Wiring and Configuration Guide

Analog signal modules are the boundary where physical-world variables (temperature, pressure, flow, level, position) become engineering values inside the PLC. The SIMATIC S7-300 family (CPU 312 through CPU 319) accepts analog inputs through the SM 331 (Analog Input, AI) family and produces analog control signals through the SM 332 (Analog Output, AO) family, with combined SM 334 / SM 335 modules for compact machines. This reference explains the channel-by-channel wiring topology, the module hardware addressing (DIP switches and backplane slot conventions), the configuration path inside STEP 7 V5.x and TIA Portal, and the scaling math that converts the raw 16-bit integer to engineering units.

Unlike digital inputs where a single bit maps to a 24 V contact, every analog channel on an SM 33x has its own measurement type (voltage, current, RTD, thermocouple), its own range, and its own diagnostics behavior. Configuration is therefore per-channel rather than per-module, and most field issues (overflow, underflow, noisy reading, broken wire) trace back to a wrong measurement type or a missing jumper on the terminal block.

Analog Signal Standards Used With SM 33x Modules

Before selecting a module, lock down the sensor signal standard. The SM 331 and SM 332 modules cover the four common industrial signal types:

Signal Range Typical Sensor Notes
Voltage 0 to 10 V, ±10 V, 1 to 5 V, ±5 V, 0 to 5 V Position transducers, panel meters, pyrometers Shielded twisted pair, ground reference at module
Current 0 to 20 mA, 4 to 20 mA, ±20 mA Loop-powered 2-wire transmitters, valve positioners 4–20 mA is the preferred standard; live-zero detects open wire
RTD (resistance temperature detector) Pt100, Pt200, Pt500, Pt1000, Ni100, Ni1000, Cu10 Temperature probes 4-wire connection on most modules eliminates lead resistance
Thermocouple (TC) Type B, E, J, K, L, N, R, S, T, U High-temperature furnaces, exhaust Internal or external cold-junction compensation (CJC)
Live-zero check: 4–20 mA offers a built-in broken-wire diagnostic. If the channel reads below 4 mA (encoded as a negative number in the S7 integer) the transmitter is open or shorted. 0–20 mA cannot distinguish 0 % process from 0 mA caused by a fault.

SM 331 Analog Input Module Family

Common SM 331 catalog numbers (full part numbers in the SIMATIC S7-300 Automation System Module Data manual):

MLFB / Order Number Channels Resolution Signal Types Use Case
6ES7331-7KF02-0AB0 8 AI 12-bit + sign U, I, RTD, TC (with range sub-modules) Cost-optimized universal AI
6ES7331-7NF10-0AB0 8 AI 16-bit U, I, RTD, TC High-precision measurement
6ES7331-7PF11-0AB0 8 AI 16-bit RTD / resistance, 4-wire Pt100/Pt1000 in process
6ES7331-7PF01-0AB0 8 AI 16-bit Thermocouples, 4-wire TC Furnace temperature
6ES7331-1KF02-0AB0 8 AI 12-bit U, I, RTD Economy AI for non-critical loops
6ES7336-1HE00-0AB0 6 AI 15-bit + sign 4-wire RTD, high-accuracy TC Lab and reference applications

SM 332 Analog Output Module Family

MLFB Channels Resolution Signal Types Load / Compliance
6ES7332-5HD01-0AB0 4 AO 12-bit ±10 V, 0–10 V, 1–5 V, 0–20 mA, 4–20 mA, ±20 mA V: 1 kΩ min, I: 500 Ω max
6ES7332-5ND01-0AB0 4 AO 12-bit Isolated outputs, full ranges Galvanic isolation per channel
6ES7332-7ND02-0AB0 8 AO 16-bit ±10 V, 0–10 V, 1–5 V, 0–20 mA, 4–20 mA, ±20 mA High-density, high-precision
6ES7332-8TF01-0AB0 8 AO 15-bit + sign Full ranges, 8 channels Premium precision

Hardware Installation and Backplane Slot Addressing

The S7-300 I/O address layout is fixed and slot-based. Slot 1 is reserved for the power supply (PS 307); slot 2 is the CPU; slots 3 through 8 are signal modules (SM) and function modules (FM). Address assignment is computed as follows for an S7-300 in STEP 7 V5.x:

  1. Open HW Config and drag the SM 33x module from the catalog onto the desired slot.
  2. STEP 7 assigns digital addresses automatically (e.g. PIW 304, PIW 306 … for slot 4, channel 0/1).
  3. Each analog channel consumes 2 bytes (16 bits) in the process image. 8-channel modules therefore use 16 bytes of input or output space.
  4. For outputs, the process output word (POW) address is assigned to the slot by the same convention.

Address formula (per S7-300 manual, chapter 4):

  • Analog input base address = (slot − 1) × 32 + 256 → first channel: base, second channel: base+2, …, eighth channel: base+14.
  • Example: SM 331 in slot 4 → base 352. Channels read at PIW 352, PIW 354, …, PIW 366.
Diagnostic addresses (used for OB82) are separate from the process value addresses and are visible under HW Config → Module Properties → Diagnostics.

Range Sub-Modules and Per-Channel Jumpering

Most SM 331 modules use plug-in measuring-range sub-modules (sometimes called "range cards") located behind the front cover of each channel group. Two channels share one sub-module, so the practical granularity is 2 channels per range.

Sub-module positions and signal type:

Sub-module Position Signal Type
A ±5 V, ±10 V, 1 to 5 V, 0 to 10 V, ±20 mA, 0/4 to 20 mA, 4-wire RTD
B ±5 V, ±10 V, 1 to 5 V, 0 to 10 V, ±20 mA, 0/4 to 20 mA
C 0 to 5 V, ±500 mV, ±1 V, 0/4 to 20 mA, 2-wire RTD/TC
D Thermocouple, mV ranges (J, K, N, E, T, R, S, B)

Always set the sub-module before applying power; the module reads its position only at startup. A mismatch between the sub-module (hardware) and the STEP 7 configuration (software) will trigger SF (system fault) on the module and a diagnostic interrupt (OB82).

Channel-Wise Wiring Topologies

2-Wire Current Transmitter (4–20 mA)

The transmitter is loop-powered. The SM 33x provides 24 V on the channel screw terminal, the current flows through the field device, and the return path closes at the module's M terminal.

SM 331 terminal  (channel 0, 4–20 mA, 2-wire)
   Pin 1 (+24 V out)  ----[ Tx+ ]----[ 2-wire transmitter ]----[ Tx- ]----  Pin 2 (M in)
   Pin 3 (Qv)         not connected
   Pin 4 (M ana)      bonded to Pin 2 at the module

Total loop voltage drop = transmitter drop + line drop. Maximum loop load for SM 331 4–20 mA is 600 Ω; verify that V_trans(min) + (I × R_line) ≤ module supply.

4-Wire RTD (Pt100)

Use the 4-wire method on modules that support it (sub-module position A on most SM 331 AI 8x RTD variants). The constant excitation current is forced through two wires; the voltage drop is measured with two separate high-impedance sense leads to cancel lead resistance.

Pt100 4-wire hookup to SM 331:
   I+ (terminal 1)  -->  RTD lead A
   S+ (terminal 2)  -->  RTD lead B  (sense +)
   S- (terminal 3)  -->  RTD lead C  (sense -)
   I- (terminal 4)  -->  RTD lead D
   Shield  -------->  PE bar (both ends tied)

3-wire RTD: bridge the S- and I- terminals on the module, connect the two return leads to I+ / S-. The line resistance is halved and approximated.

Thermocouple

Use shielded thermocouple extension wire, terminated to the TC terminals on the SM 331. Cold-junction compensation (CJC) can be selected in HW Config under Measurement Type → Thermocouple → Compensation: Internal / External / None. The internal CJC sensor is a single Pt1000 diode on the front connector; accuracy is typically ±1–2 °C. For higher accuracy, use a separate external CJC probe and select it in software.

Voltage Output Wiring (SM 332)

Voltage outputs are referenced to M_ana. The differential output (Qv / M) drives the load directly. For 4–20 mA, the loop must close through the load: Module Qv (current out) → Load → M_ana (return). Maximum load: 500 Ω for current outputs of SM 332.

Configuration in STEP 7 V5.x (Classic)

  1. Open the project in SIMATIC Manager. Open HW Config for the S7-300 station.
  2. Insert the SM 33x from the catalog at the correct slot (3–8). Confirm the order number matches the physical module.
  3. Double-click the module → Properties → Inputs tab. For each channel group (0–1, 2–3, 4–5, 6–7) select:
    • Measurement type: Voltage / Current / RTD / TC / Deactivated
    • Measurement range: e.g. 0–10 V, 4–20 mA, Pt100 standard, TC type K
    • Interference frequency suppression: 50 Hz, 60 Hz, 400 Hz (matches the mains frequency in your region; 50 Hz recommended for Europe)
    • Diagnostic interrupt: enable for broken wire / overrange / underrange
  4. Click OK and save. The configuration is downloaded with the rest of HW Config.
  5. Read the raw value in OB1, OB35, or a data block:
        L PIW 352          // channel 0
        T DB10.DBW 0       // store raw 16-bit
  6. Scale using the S7 standard library FC105 "SCALE" (input range 0–27648 for unipolar signals):
        CALL  FC   105
           IN    := DB10.DBW 0          // raw value
           LO_LIM:= 0.0                  // engineering low
           HI_LIM:= 100.0                // engineering high
           BIPOLAR:= FALSE               // unipolar
           RET_VAL:= MW100               // error word
           OUT   := MD104                // scaled REAL result
  7. For analog output scaling use FC106 "UNSCALE". For bipolar signals set BIPOLAR := TRUE and the input range becomes −27648 to +27648.

Configuration in TIA Portal (V16 / V17 / V18)

  1. Open the project in TIA Portal. Open the Device configuration for the S7-300 CPU.
  2. Drag the SM 33x from the hardware catalog to the correct slot. The TIA Portal uses the same slot convention as STEP 7 V5.x.
  3. Click the SM 33x → Properties → Analog inputs / Analog outputs section. The Portal exposes the same per-channel configuration (measurement type, range, diagnostics, integration time).
  4. Use the I/O tags table to declare symbolic names: "TankLevel" of type INT, address %IW64.
  5. Use the SCALE and UNSCALE instructions from the Extended Instructions palette (TIA V16+) or continue to use the legacy FC105/FC106 blocks copied from the standard library.
  6. For cyclic acquisition, prefer OB1 (process image) or OB35 (100 ms cyclic interrupt) rather than free-running reads. Update time per channel is set in the module properties and is typically 2.5 / 16.6 / 20 / 100 ms depending on interference frequency selection.
TIA Portal V17 is the last release that supports S7-300 / S7-400 as of the standard support cycle. For new installations, S7-1500 is recommended; however S7-300 remains in active service and is fully configurable in TIA Portal V18 for hardware export, with the standard catalog.

Analog Value Representation (16-Bit Integer)

The S7-300 analog modules return a signed 16-bit integer. The mapping between physical signal and integer value is identical for AI and AO and is defined in chapter 5 of the S7-300 Module Data manual:

Range 0–10 V ±10 V 0/4–20 mA ±20 mA
Overflow (fault) 32767 (0x7FFF) 32767 32767 32767
Overrange 32511 (0x7EFF) 27649 / 32511 32511 27649 / 32511
Nominal high 27648 (0x6C00) 27648 27648 (20 mA) 27648
Nominal low 0 (0x0000) −27648 0 (0/4 mA) −27648
Underflow −1 (0xFFFF) −1 −1 (live-zero < 4 mA) −1
Wire break / overflow 32767 32767 32767 32767

Raw engineering conversion for a unipolar signal (default FC105 input range):

OUT_REAL = (IN_INT / 27648.0) * (HI_LIM - LO_LIM) + LO_LIM

For bipolar: OUT_REAL = (IN_INT / 27648.0) * (HI_LIM - LO_LIM) with the appropriate LO_LIM/HI_LIM sign.

Common Configuration Errors and Diagnostic Codes

SF LED Diagnostic Buffer Text Likely Cause Fix
ON Module parameterization error HW Config range ≠ sub-module position Match software to physical sub-module; power-cycle
ON Front connector missing Connector not seated or wiring error Re-seat connector; check ribbon cable to module
OFF but value = 32767 Overrange / open wire (4–20 mA) Field loop open, polarity reversed, or signal out of range Check loop voltage, polarity, line resistance
OFF but value = −1 Underflow / wire break Loop open at 4–20 mA, TC cold junction broken Check transmitter power; verify TC extension wire
OFF but value flickers ±5 LSB Mains noise coupling Interference frequency suppression mis-selected Set to 50 Hz (EU) or 60 Hz (NA)
OFF, value stuck at last value Diagnostic interrupt pending OB82 not loaded, so module halts updates Load OB82 (empty is fine) into the CPU

Cross-Platform Reference

Different PLC platforms use the same signal types but different terminology and configuration paths. The principles below apply to systems from the Analog Devices software ecosystem for signal-chain evaluation, the AutomationDirect LS Electric XGB line, and the National Instruments FlexLogger channel specification model.

Allen-Bradley CompactLogix / ControlLogix

  • Analog module catalog: 1769-IF8 (8 AI, current/voltage), 1769-IF4 (4 AI), 1769-OF8C, 1769-OF4 (AO).
  • Configuration: RSLogix 5000 / Studio 5000 Logix Designer → I/O Configuration → Module → Properties → Input / Output tabs. Each channel has a range dropdown and an engineering scaling pair (Input Scaling = 0–100 % → Process Range = 0–10 000 gal).
  • CIP tags are read directly as INT or REAL; no FC105/FC106 equivalent is required if scaling is set in the module properties.

AutomationDirect LS Electric XGB (XBM/XBC series)

  • Analog input module XEM-AIM8, XBM-AIM8 / AIM4, XBC-AIM4 / AOM4.
  • Configuration: XG5000 → I/O Parameter → Analog Input → Channel type / Range / Filter time. Channel 0–7 selectable as voltage (0–10 V) or current (0/4–20 mA) per group.
  • Read using "PUT/GET" style data addresses e.g. %UW0.10.0 for the first word of slot 10, then scale with the built-in SCALING library or the dedicated SCALE instruction in the XGB function block library.

National Instruments FlexLogger (Data Acquisition)

  • Per-channel Channel Specification drives both AI and AO behaviour. The Configure Analog Output workflow toggles the channel enable, sets the output type (voltage / current) and applies a global scaling function.
  • For one-off testing (e.g. bench-validating an SM 332 card) a FlexLogger DAQ device with a current output can drive a 4–20 mA loop while the S7-300 channel is read in STEP 7 online monitor.

Texas Instruments MSPM0 (Embedded MCU Companion)

  • The MSPM0-ANALOG-CONFIGURATOR GUI builds a register map for the on-board ADC and DAC chain. While not a PLC analog module, it is the reference tool used by engineers who want to develop their own signal-conditioning front end for a field device that eventually terminates at an SM 33x channel.

Verification and Commissioning Procedure

  1. Power the rack and check the SM 33x LEDs: SF must be off, BF off, and the per-channel status LEDs (where present) off.
  2. Open Online → Monitor/Modify in STEP 7 or the Watch table in TIA Portal. Read the raw 16-bit value for each channel at PIW <base>.
  3. Inject a calibration signal with a precision calibrator (e.g. Beamex MC6, Druck DPI 620) on the field terminal block: 4 mA should read 0; 12 mA should read 13824; 20 mA should read 27648. Tolerance ±2 LSB is acceptable for a 16-bit module; ±10 LSB for a 12-bit module.
  4. Apply FC105 (or equivalent scale function) and confirm the engineering result at the three test points.
  5. For RTD / TC channels, use a dry-block calibrator. Compare against the SM 331 internal reference; the SM 331 calibrates itself at 90 s and 30 min intervals.
  6. Trigger diagnostic interrupts by opening a 4–20 mA loop. Verify that OB82 receives the start and end event and the SF LED toggles correctly.
  7. Document the as-built configuration (slot, sub-module position, channel, range, scaling LO/HI) in the project's hardware documentation.

Field-Proven Tips

  • Always use a sub-module position that matches the first channel of a group, not the second. Many failed startups come from swapping the sub-module between groups after wiring.
  • Route analog signal cables in a separate tray, at least 200 mm from VFD output cables. Cross at 90° if a crossing is unavoidable.
  • Ground the shield at one end only (the module end) when the source is floating; ground at both ends when the source is grounded, to avoid 50/60 Hz ground loops.
  • For long analog runs, verify the total loop resistance at 20 mA against the transmitter compliance. R_max = (V_supply − V_tx_min) / 0.020.
  • Set the integration time to the longest available (e.g. 100 ms) for slow processes like level and temperature; this gives the strongest 50/60 Hz rejection.
  • Save the HW Config (Classic) or compile the device configuration (TIA) every time the channel assignment changes; a stale offline configuration in the PLC will silently override your changes.

FAQ

What is the difference between the SM 331 and SM 332 module families?

The SM 331 is an analog input (AI) module that converts a physical signal (U, I, RTD, TC) into a 16-bit signed integer in the PLC process image at addresses PIW. The SM 332 is an analog output (AO) module that converts a 16-bit integer from the process output (POW) into a voltage or current signal. Combined SM 334/335 modules offer lower channel count and 8–12 bit resolution for cost-sensitive machines.

Why does my 4–20 mA channel read −1 (0xFFFF) at 0 mA?

For 4–20 mA the S7 range starts at 4 mA = 0. Anything below 4 mA (including a true 0 mA or an open loop) is encoded as a negative number down to −1 at the bottom of the underflow window, signalling a live-zero fault. The 0 mA reading is intentional and lets the diagnostic interrupt fire.

How do I match the hardware sub-module position to the STEP 7 configuration?

Open the front cover of the SM 331 and inspect the 4-position DIP-switch or the small 8-pin range card on each channel group. The positions A, B, C, D map to the same labels in HW Config → Module Properties → Inputs → Measurement range. A mismatch lights the SF LED and posts a parameterization error in the diagnostic buffer until the discrepancy is removed and the module is power-cycled.

What is the correct FC105/FC106 scaling formula for bipolar ±10 V signals?

Set BIPOLAR = TRUE, HI_LIM and LO_LIM as your engineering range (e.g. +10 000 and −10 000), and pass the raw value. FC105 computes OUT = (IN / 27648.0) × (HI_LIM − LO_LIM) internally. For unipolar (0–10 V, 4–20 mA) keep BIPOLAR = FALSE and add LO_LIM: OUT = (IN / 27648.0) × (HI_LIM − LO_LIM) + LO_LIM.

My analog input reads the correct value in STEP 7 Monitor but the field value is wrong. Where do I look?

Check four layers in order: (1) the FC105 LO_LIM / HI_LIM against the sensor datasheet, (2) the sub-module position against the configured measurement range, (3) the wiring polarity and shield termination, and (4) the interference-frequency suppression setting (50 vs 60 Hz). A correct monitor reading with wrong engineering value usually means the scaling block, not the hardware, is the issue.

Back to blog