SM 331 7KF02 7FFF: Fix Mixed 2-Wire/4-Wire Channel Configuration

Problem Statement

On SIMATIC systems using the SM 331 analog input module 6ES7331-7KF02-0AB0, channels configured with a mix of 2-wire and 4-wire current transducers intermittently report the overrange value 7FFF_hex (decimal 32767) in the process image input word. The overflow reading is sensitive to the wiring state of the other channel in the same group: disconnecting the transducer on one channel returns the value on its partner to a normal reading, while one of the adjacent channels can jump to 7FFF as a result. Swapping the module into a second CPU / project that uses a known-good configuration makes the 7FFF disappear, which isolates the root cause to the channel-group configuration and the wiring of the affected module rather than to the hardware itself.

Module Identification and Specifications

The module in question is the SM 331, AI 8 x 13 Bit, Siemens order code 6ES7331-7KF02-0AB0. It is one of the most widely deployed 8-channel analog input modules in the S7-300 family and is fully described in the SIMATIC S7-300 Module Data manual on Siemens Industry Online Support.

Full electrical and functional data is in the SIMATIC S7-300 Module Data manual (Siemens entry ID 8859629).

What 7FFF_hex Means on a Siemens AI Channel

The value 7FFFhex in the PIW of a Siemens analog input module is the reserved overrange / diagnostic marker. Per the Siemens fail-safe and standard module documentation, a channel can return 7FFF for one of the following reasons:

1. True overrange: the input signal has exceeded the configured measurement range (e.g. current above 20 mA in 4-20 mA mode, or below 4 mA in 4-20 mA mode if underrange is treated as overflow by the application).
2. Wire break: the input source impedance has risen above the wire-break threshold (typically > 5 kOhm in 4-20 mA mode, depending on module family).
3. Configuration / wiring mismatch: the channel is configured for a measurement type that does not match the actual wiring, so the analog-to-digital converter interprets a floating or unpowered input as out of range.
4. Startup transient: valid values are not yet available immediately after module configuration or restart, before the first conversion cycle completes.

This behaviour is documented in the Siemens TIA Portal fail-safe modules manual — measurement ranges of the analog inputs. The 7FFF semantics are consistent across SM 331, SM 431, and the S7-1200/S7-1500 AI families, so the same diagnostic logic applies regardless of whether you are online in STEP 7 or TIA Portal.

Channel Group Architecture

The 6ES7331-7KF02-0AB0 is organised as four channel groups of two channels each. The front connector has 20 screw terminals; the upper row carries the channel pairs and the analog ground reference (MANA), the lower row is reserved for compensation and unused terminals.

Recommended grouping: pairs of channels in the same group share one measurement type. Place 2-wire transducers in groups 0-1 and 4-wire transducers in groups 2-3.

Two-Wire vs Four-Wire Current Transducers

Industrial 4-20 mA transducers come in two common wiring topologies. The two are not interchangeable on the same input terminals of the SM 331 because the analog front-end inside the module is wired differently for each mode.

The labels 2DMU and 4DMU in the Siemens HW Config / TIA Portal dialog represent two different analogue front-end configurations of the same input stage:

• 2DMU — 2-wire differential measurement with internal loop supply. The module sources approximately 24 V across the transducer terminals. The transducer regulates the loop current proportional to the measured process variable.
• 4DMU — 4-wire differential measurement. The module only reads the differential voltage developed across a current-sense resistor; the transducer is powered by an external supply.

Because the analogue front-end is wired differently, a 2DMU input presents a voltage across the transducer terminals that a 4DMU input does not. If a 4-wire transducer is wired to terminals the module believes are 2DMU, the module will source voltage into the transducer's external 24 V supply (causing misreadings, sometimes 7FFF) or, conversely, leave the 2-wire transducer unpowered (which appears as wire break — also 7FFF).

Root Cause: Mixed Measurement Types Across Channel Groups

The classic field failure pattern for the 6ES7331-7KF02-0AB0, and the pattern visible in the source case, is adjacent channel groups configured for different measurement types (2DMU vs 4DMU) while the wiring and the AI module's internal commons are not segregated for that combination. The exact failure sequence is:

1. The STEP 7 / TIA Portal hardware configuration sets Group 0/1 (CH0-CH3) to 2-wire current and Group 2/3 (CH4-CH7) to 4-wire current.
2. Group 2/3 (4DMU) is physically wired with a 2-wire loop-powered transducer, leaving one terminal of the transducer's current loop floating with respect to the module's MANA reference (or vice versa).
3. Because the 4DMU input stage does not source loop current, the floating transducer cannot establish a valid 4-20 mA loop. The input current is either zero or undefined.
4. The module interprets the undefined current as wire break (or out-of-range low) and reports 7FFF_hex on the affected channel.
5. When an adjacent 2DMU channel is disconnected, the small bias currents inside the input stage change, the input current on the 4DMU channel momentarily collapses below the wire-break threshold, and the 7FFF flag is no longer set — but the channel is still not reading the correct process value. The behaviour is therefore "leaky": touching one channel's wiring changes another channel's reading.

A 7FFF reading on a channel whose wiring is intact, in a module that is functional in another project, is the single most reliable indicator that the wiring does not match the configured measurement type for that channel's group. Hardware substitution will not fix it; only re-grouping the wiring and the configuration will.

Diagnostic Procedure

Follow this sequence to isolate the configuration / wiring conflict before assuming a hardware fault.

1. Read the diagnostic buffer. Go online to the CPU and open PLC > Diagnostic Buffer. Look for module-related entries that reference the SM 331's logical address (e.g. PIW 288 ... PIW 303 for the first slot in the standard address area). Common fault codes:
   • 0x0E (decimal 14) — "Parameter assignment error." The module rejected a configuration value, often a mixed measurement type inside one group.
   • 0x1A (decimal 26) — "External channel fault." Wire break on a current input.
   • 0x1F (decimal 31) — "Internal module fault." Only relevant if the same error follows the module to a known-good CPU.
2. Compare physical wiring to HW Config. Open the analog module's properties in HW Config (STEP 7) or the device configuration (TIA Portal). Record the configured measurement type for each group (e.g. 2DMU, 4DMU, R-4L, TC, Voltage). On the cabinet, follow each pair of transducer wires to the front connector and confirm the wiring topology matches.
3. Isolate the channel by disconnection. With the CPU in STOP or with the process in a safe state, unscrew a single transducer's M+ and M- wires from one channel at a time. Observe the PIW value in the VAT / watch table. If the value drops from 7FFF to a plausible engineering value when a specific channel is disconnected, that channel's group is the one whose wiring does not match its configured type.
4. Measure the loop current. With the transducer still connected, break the loop and insert a multimeter in series. For 4-20 mA devices you should see a current between 4 and 20 mA at the process variable. A reading of 0 mA confirms wire break / no loop supply.
5. Check the channel-group common. On the 6ES7331-7KF02-0AB0, MANA is the analog ground common for each group. Verify that the shield / signal common is landed on the correct MANA terminal for the group, and that no bridge exists between MANA terminals of groups configured for incompatible measurement types.
6. Read channel-level diagnostics. Use SFC 59 "RD_REC" to read DS0 / DS1 of the module. Bit-level diagnostic data identifies whether the fault is overrange (bit 0), underrange (bit 1), or wire break (bit 2), which removes the ambiguity of the PIW value.

Step-by-Step Resolution

Once the configuration mismatch is confirmed, apply the following remediation in the order shown.

1. Bring the CPU to STOP. Configuration changes in HW Config / TIA Portal require a download of the new hardware configuration, which will not take effect while the CPU is in RUN.
2. Reassign channels so all channels in a group share a measurement type. A practical re-mapping for the case in the source is:
   • Group 0 (CH0, CH1): 2-wire current transducers (2DMU, 4-20 mA).
   • Group 1 (CH2, CH3): 2-wire current transducers (2DMU, 4-20 mA).
   • Group 2 (CH4, CH5): 4-wire current transducers (4DMU, 4-20 mA).
   • Group 3 (CH6, CH7): 4-wire current transducers (4DMU, 4-20 mA).
   All four transducers previously misallocated in 2/4-wire mix are now grouped by topology, so the module's analogue front-end is consistent for every group.
3. Update HW Config to match. For each group, open the Inputs tab, set the group measurement type to 2-wire transducer (2DMU) or 4-wire transducer (4DMU) as appropriate, set the range to 4-20 mA (or 0-20 mA, depending on the transducer), and enable wire-break monitoring only if the transducer supports it (passive 2-wire loops typically tolerate the test pulse; some 4-wire devices can be mis-triggered by it).
4. Re-wire the front connector. Move the transducers to the terminal pairs that belong to the new groups. The terminal layout for the 6ES7331-7KF02-0AB0 is documented in section 6 of the S7-300 Module Data manual.
5. Save, compile, and download the HW Config to the CPU. Restart the CPU (cold restart recommended if you changed the module's address space).
6. Watch the SF LED. If the SF LED on the module extinguishes and the diagnostic buffer no longer reports a parameter-assignment error, the configuration is accepted.

Verification and Commissioning

After the reconfiguration and rewire, perform the following checks before returning the system to production.

1. Online value check. Open a VAT or watch table in STEP 7 / TIA Portal online. For each channel, the raw PIW value should be inside the configured range (0 to 27648 for the standard Siemens 0/4-20 mA scaling). No PIW should read 7FFF_hex.
2. Engineering-units check. Apply a known test current (e.g. with a calibrator) at 4.000 mA, 12.000 mA, and 20.000 mA. Verify the scaled engineering value tracks within the transducer's accuracy specification.
3. Wire-break simulation. Disconnect the M+ wire from one channel. The module should report 7FFF_hex on that channel and generate a diagnostic interrupt (SFC 59, channel fault, if wire-break diagnostic is enabled). Reconnect; the value should return to normal within one conversion cycle (≤ 100 ms depending on integration time).
4. Cross-channel isolation. Manipulate the wiring on a 2DMU channel and confirm that no 4DMU channel changes its reading, and vice versa. This confirms that the MANA commons and channel groups are properly isolated in the wiring.
5. Diagnostic buffer cleanliness. Operate the system for at least one full scan cycle and re-read the diagnostic buffer. It should contain no module-level fault entries for the SM 331.
6. SFC 59 channel diagnostic readout. Add a small FB that calls RD_REC with MLFB = 0x0B (analog input channel diagnostics) and store the result in a DB. This is the only way to confirm at runtime that 7FFF is wire-break vs. overrange vs. configuration error.

Common Pitfalls and Field Notes

• Assuming wire break when the wiring is fine. 7FFF is not specific to a broken wire. It is the universal "I cannot give you a valid measurement" marker. Always check the configuration first, the wiring second, and the transducer third.
• Treating channels as independent. On the 6ES7331-7KF02-0AB0, channels are paired into groups. A "broken" channel whose neighbour is fine is often a symptom of the neighbour's configuration, not the channel's own wiring.
• Mixing 2-wire and 4-wire in the same group. This is impossible in HW Config (the second channel inherits the first), but it is possible to physically wire a 2-wire loop into a group configured as 4DMU. The result is a 7FFF reading that disappears the moment the loop is closed with an external power supply — a clear signal of the wiring-vs-configuration mismatch.
• Wrong CPU, right module. If the project uses an S7-417 (S7-400 family), confirm whether the SM 331 is in an S7-300 expansion rack via IM 360/IM 361 or in a distributed ET 200M. Putting an S7-300 module in a central S7-400 rack directly is not supported and will generate a different set of errors that can be confused with channel faults.
• Integration time / update time. If 7FFF appears transiently during process transients (e.g. pump start, large step change), the 16.67 ms or 100 ms integration time may not match the loop response. Set the integration time explicitly rather than leaving it on Auto, especially for slow 4-wire loops that take 50-200 ms to stabilise.
• Spare channels. Unused channels in a group are configured along with the group's measurement type. If you do not wire a spare channel, either leave it as the group's configured type (it will read a defined value or 0) or disable the channel entirely. A disabled channel returns 7FFF — by design — which can be alarming if the engineer does not expect it.
• Wire-break test pulse on 2-wire loops. The 4-20 mA wire-break test pulse is a small current perturbation injected by the module. Some 2-wire transducers with very low internal capacitance interpret the pulse as a power-supply dropout and reset. If you see intermittent 7FFF on a 2-wire channel only, disable wire-break diagnostic for that group and confirm whether the reading stabilises.
• Common-mode voltage on 4-wire groups. If multiple 4-wire transducers share a 24 V supply, a ground loop between the supply and the PLC backplane can drive the MANA terminal outside the common-mode range of the input stage. The symptom is 7FFF on the highest-addressed channel of the group. Re-bond the supply 0 V to the panel PE at a single point.

Quick Reference Card