Troubleshooting S7-300 CPU 317-2DP Wago 750-474 Data Transfer

Problem Summary and Symptoms

A SIMATIC S7-300 station built around a CPU 317-2 DP (Siemens order number 6ES7317-2AK14-0AB0) reads a thermocouple temperature through a 4-20 mA head-mounted transmitter. The 4-20 mA loop terminates at a Wago 750-474 four-channel analog input module mounted on a Wago 750 Series Profibus slave coupler. The field value lands in the S7-300 process image at PIW 176 (channel 0, raw 16-bit count) but never shows up in the application data block at DB24.DBD16, where the InTouch Wonderware SCADA expects a scaled, 32-bit REAL temperature value.

Three concrete symptoms appear in the source case:

1. The value seen at PIW 176 in online monitoring is correct, but DB24.DBD16 remains at 0.0 (or stale) on every cycle.
2. When the operator forces PIW 176 above +127 decimal, the SCADA value goes negative instead of continuing to climb.
3. The only candidates that could plausibly write to DB24.DBD16 are FC161 and FC166; both are know-how protected and cannot be inspected without first un-locking them in STEP 7.

All three symptoms point to a single architectural gap: there is no FC or FB in the user program that bridges the S7 process image and the application DB, and the two candidates that could do that work are protected.

Hardware Topology and Signal Path

The end-to-end signal path is:

The Wago coupler is a Profibus-DP slave. Its GSD file (WAGO_750 family) is installed in STEP 7 / HW Config. After DP slave address assignment (for example, station 7) and slot configuration, the analog channel occupies a fixed PIW window on the CPU. In this case the integrator chose PIW 176 as the input word for channel 0.

The S7-300 is then expected to:

1. Read the raw 0-27648 (or 0-32767) count from PIW 176.
2. Scale the count into engineering units (°C, °F, bar, …).
3. Apply any correction (ABS, deadband, averaging).
4. Deposit the final REAL value in DB24.DBD16 for SCADA handover.

Step 4 is what is missing in the source program.

CPU 317-2DP and Wago 750-474 Specifications

The official SIMATIC S7-300 CPU 315-2 DP / CPU 317-2 DP manual describes the BF / BF1 / BF2 LED layout and pin-out that is referenced when validating that the Wago slave is actually exchanging process data with the CPU. Confirm that BF is OFF on the CPU before assuming the PIW is valid. See the Siemens manual portal at SIMATIC S7-300 CPU 317-2 DP manual on support.industry.siemens.com.

Profibus I/O Address Mapping for PIW 176

Profibus-DP slave I/O addresses in S7-300 are not assigned dynamically; they are calculated at HW-config compile time and frozen in the system data (SDB). For a Wago 750 coupler with an analog input submodule starting at slot 2, the starting PIW is determined by the order in which modules are inserted and the configured I/O area.

If PIW 176 is the start of channel 0, then channels 1-3 occupy:

Root Cause Analysis

Three independent root causes line up to explain the behavior:

1. Missing bridging logic. The user program loads PIW 176 into a TEMP variable in FC161 (segment 12 is the only place that touches DB24), but there is no instruction that copies the scaled real value into DB24.DBD16. DBD 16 is a 4-byte REAL slot spanning bytes 16-19. Without an explicit T DB24.DBD16, the slot retains its initialized value of 0.0.
2. Know-how protection on FC161 / FC166. STEP 7 know-how protection hides the code body but does not prevent the block from running. The integrator cannot see where DB24.DBD16 is written because the body is encrypted. The only way to map the data path is either to (a) remove the protection, (b) instrument the DB with a STIME/watchdog, or (c) insert a brand-new FC that performs the transfer explicitly.
3. Signed-int wrap on 8-bit-perceived boundary. Going negative at +127 indicates that the user is observing the high byte of the WORD as a signed 8-bit value (S7 status display shows it as INT), or the scaling math divides by a base that becomes negative when the numerator crosses 127. In STEP 7, the default monitor format for PIW is INT (signed 16-bit), but PIW 176 in the Wago 0-20 mA range is an unsigned 0-27648 count. Display format alone should not flip sign — the most likely cause is that DB24.DBD16 is being written as REAL and the source INT is interpreted as signed.

Combined, the data is available in PIW 176 but never delivered to DB24.DBD16, and the SCADA therefore reads stale data.

STL Implementation: Building the Missing FC Block

The fastest path to a working handover is to add a new FC — for example FC200 — that owns the PIW-to-DB transfer. Wire it from OB1 or OB35 (cyclic interrupt at 100 ms is typical for thermal loops).

Network 1 — Read raw count from PIW 176

FUNCTION FC 200 : VOID
TITLE = 'AI0 PIW176 to DB24.DBD16 with ABS'
VERSION : 0.1

VAR_TEMP
  tRaw     : INT;     // raw count from Wago
  tScale   : REAL;    // engineering unit, °C
  tOffset  : REAL;    // 4 mA trim, default 0.0
  tSpan    : REAL;    // 20 mA span in °C, e.g. 600.0
END_VAR

BEGIN
NETWORK 1  // Read raw
  L     PIW 176;          // 0..27648 for 0..20 mA
  T     #tRaw;

NETWORK 2  // Convert INT to REAL
  L     #tRaw;
  ITD;                   // INT → DINT
  DTR;                   // DINT → REAL
  T     #tScale;

NETWORK 3  // Linear scale (0..27648 → 0..tSpan °C)
  L     #tSpan;          // 600.0
  L     #tScale;         // 0..27648.0
  *R;
  L     2.764800e+004;
  /R;
  T     #tScale;

NETWORK 4  // Add offset (4 mA lift if needed)
  L     #tOffset;
  L     #tScale;
  +R;
  T     #tScale;

NETWORK 5  // Force positive (ABS)
  L     #tScale;
  ABS;
  T     #tScale;

NETWORK 6  // Hand to SCADA DB
  L     #tScale;
  T     DB24.DBD16;
END_FUNCTION

Network 2 — SCL alternative (single block, type-safe)

// SCL equivalent of FC200
IF bEnable THEN
  // 0..27648 → 0..600.0 °C, signed ABS protect
  DB24.DBD16 := ABS( DINT_TO_REAL( WORD_TO_INT( PIW176 ) ) * 6.000e+002 / 2.764800e+004 );
END_IF;

DB24 layout (extract)

DATA_BLOCK DB 24
STRUCT
   dwStatus  : DWORD;     // byte  0..3
   rPV1      : REAL;      // byte  4..7   DBD 4
   rPV2      : REAL;      // byte  8..11  DBD 8
   rPV3      : REAL;      // byte 12..15  DBD 12
   rPV4      : REAL;      // byte 16..19  DBD 16  <-- SCADA reads this
   rPV5      : REAL;      // byte 20..23  DBD 20
END_STRUCT;
END_DATA_BLOCK

If DBD 16 is the SCADA tag, make absolutely sure that bytes 16-19 of DB24 are not re-used by another variable in the same STRUCT. STEP 7 will silently overlap symbols and corrupt the REAL value.

Resolving the Negative-Value Issue at +127 Decimal

The +127 → negative symptom is the result of one of three conditions. Diagnose in this order:

For a thermocouple that physically cannot read negative temperature in the process (for example, a furnace interior), applying ABS to the scaled REAL is legitimate. For a process where negative readings are valid (for example, a cold-junction box below 0 °C), ABS hides real faults — so prefer fixing the scaling instead.

Working with Protected FC161 and FC166

STEP 7 know-how protection is a reversible XOR cipher on the block source. To remove it you need:

1. The original STEP 7 project file (S7 file format .s7p) opened in the version that originally compiled it (typically STEP 7 V5.5 / V5.6 for S7-300).
2. Knowledge of the protection password — without it you cannot recover the body by decryption.
3. If the password is lost, the source cannot be recovered. The block will still execute but cannot be edited.

If the password is available:

1. In SIMATIC Manager, right-click FC161 → Object Properties → Know-how protection.
2. Click Remove protection, enter the password.
3. The block recompiles to plain STL.
4. Save the project, export STL, and audit segment 12 (the only place that writes to DB24).

If the password is not available, do not attempt to brute-force the protection — instead, leave FC161/FC166 in service and bolt a new FC200 alongside. The new FC is the only owner of DB24.DBD16; remove any redundant write in the protected block by re-mapping its source pointer to a scratch DB (for example, DB200.DBD16) before re-compiling.

Indirect Addressing DB26 to DB24

The source case mentions an indirect copy from DB26.DBDxx to DB24.DBDxx that does not seem to put DB26.DBD16 into DB24.DBD16. This pattern is typical of an array-indexed PV buffer (for example, 16 channels) that is bulk-copied by an indexed loop.

STL snippet — indexed copy via AR1 / AR2

NETWORK 1
TITLE = 'Indexed copy DB26[i] → DB24[i]'

  L     0;
  T     #iLoop;                     // iLoop := 0
LOOP: L     #iLoop;
  L     16;                         // 16 channels
  >I;
  JC    DONE;                       // exit if iLoop >= 16

  L     #iLoop;
  SLD   3;                          // *8 (REAL = 8 bytes per element)
  LAR1  ;                           // AR1 := byte offset in DB26

  L     #iLoop;
  SLD   3;
  LAR2  ;                           // AR2 := byte offset in DB24

  OPN   DB26;
  L     DBD [AR1,P#0.0];            // source REAL
  OPN   DB24;
  T     DBD [AR2,P#0.0];            // dest REAL

  L     #iLoop;
  +    1;
  T     #iLoop;
  JU    LOOP;
DONE: NOP   0;

Verify the indirect copy by:

1. Setting a breakpoint on the loop after L DBD [AR1,P#0.0].
2. Online-watch AR1, DB26.DBD[AR1], AR2, DB24.DBD[AR2].
3. Confirm that when iLoop = 2 (third element, zero-based), AR1 = P#16.0 and AR2 = P#16.0. If AR1 or AR2 is off by one element, the loop is reading the wrong source/dest pair.

InTouch Wonderware SCADA Integration

InTouch reads DB24.DBD16 as a 32-bit REAL. The two most common access paths in a legacy SIMATIC/Profibus plant are:

In every path the access item format is the same:

• Database: DB24
• Offset: 16 bytes
• Data type: REAL (4 bytes, IEEE 754 little-endian)

If InTouch shows 0.0 persistently, the most likely cause is not the SCADA tag but the S7 program not writing the DB. Confirm by online-monitoring DB24.DBD16 in STEP 7 — if it is always 0.0 there too, the SCADA is innocent.

If InTouch shows a flickering or noisy value, enable the Deadband and Min/Max Engineering attributes on the tag to suppress jitter below the thermocouple resolution (typically 0.1 °C).

Verification, Commissioning, and Fault Matrix

Commissioning checklist

1. Open HW Config and confirm Wago slave address (e.g., 7) and slot 1 = 750-474 starting at PIW 176.
2. Online → monitor PIW 176; force the loop to 4 mA, 12 mA, 20 mA and verify PIW is in the expected band (typically 0, ~13824, 27648 for 4-20 mA).
3. Online → monitor DB24.DBD16; verify it tracks the engineering unit (e.g., 0.0, 300.0, 600.0 °C).
4. Online → monitor the SCADA tag; verify it tracks DB24.DBD16 to within ±0.1 °C.
5. Power-cycle the station and re-verify — InTouch cache and STEP 7 retentive flags can mask wiring faults during warm restart.
6. Run CPU Information → Scan for Diagnostic Events; capture any SF / BF diagnostic buffer entries.

Diagnostic matrix

FAQ