Troubleshooting SB 1231 RTD: High Limit Exceeded Error and PIW80 = 32768

Problem Overview

A SIMATIC S7-1200 signal board SB 1231 RTD reports a channel fault when a 2-wire Pt100 sensor is connected. The reported symptoms in the field are:

• Red diagnostic LED lit on the SB 1231 RTD signal board.
• CPU error LED (ERROR / SF) flashing on the S7-1200 CPU front panel.
• Online diagnostic in the TIA Portal device view shows "High limit exceeded".
• The process input word for the channel reads PIW80 = 32768 (decimal) or 0x8000 (hex).
• The Pt100 resistance measures correctly at the sensor end (e.g. ~110 Ω at 26 °C, ~107 Ω at 20 °C).

When the wiring and sensor verify correct with a multimeter, the failure path almost always narrows to one of three root causes: a damaged input channel on the SB, a ground potential difference between the sensor and the CPU, or the uncompensated lead resistance inherent to 2-wire mode combined with a marginal hardware state. Each path is documented below with the exact diagnostic steps, Siemens error semantics, and a verified resolution path. The official SB 1231 RTD manual page confirms the signal board supports 2-wire, 3-wire, and 4-wire RTD connections and that 2-wire mode does not compensate for lead resistance (Siemens ID 91696622).

SB 1231 RTD Hardware Identification

Confirm the exact MLFB before you begin diagnostics. Two generations of the SB 1231 RTD ship in the field, and the device configuration in TIA Portal must match the connected hardware.

Both variants plug into the signal board slot of the S7-1200 CPU (CPU 1211C, 1212C, 1214C, 1215C, 1217C). They are configured in the device view under Properties > Analog inputs > Channel 0. The TIA Portal selection tables for the SB 1231 RTD document supported sensor types, temperature ranges, and the rejection frequencies (TIA Portal selection tables for the SB 1231 RTD).

The module is also approved for resistance measurement from 150 Ω to 6000 Ω with 15-bit plus sign resolution, and the diagnostics page enumerates underrange, overrange, wire break, and short-circuit events.

LED Status and Diagnostic Indicators

Two LEDs are relevant to the SB 1231 RTD: the on-board status LED on the signal board itself and the ERROR / SF LED on the CPU front panel. The on-board LED is a single bicolor LED that communicates the channel state.

When the red LED on the SB 1231 RTD is lit and the CPU error LED flashes, the diagnostic event block is raised. In TIA Portal open Online & diagnostics > Diagnostics on the signal board entry to see the current alarm text. The reported string "High limit exceeded" indicates the analog value has crossed the configured upper limit. On a 16-bit channel, the corresponding process input word is clipped to the full-scale overrange value.

PIW80 Overrange Value (32768) Analysis

The user observed PIW80 = 32768 in the online monitoring table. In an S7-1200 16-bit analog input, the value 0x8000 has a precise meaning: it is the overrange sentinel.

For an S7-1200 SB 1231 RTD configured for Pt100 standard range (-200 to +850 °C), the overrange word 0x8000 tells the application that the input has reached the maximum representable resistance. The most common field triggers are:

1. The sensor element is open (wire break). With wire-break diagnostics enabled, the module typically returns the wire-break sentinel 0x8000 on every conversion.
2. The lead resistance plus sensor resistance exceeds the maximum of the configured measurement range.
3. An input channel has been damaged (e.g. by overvoltage, ESD, or miswired actuator voltage), forcing the input past the rails even with a valid sensor connected.

The Siemens specification page for the SB 1231 1 AI RTD notes: "When wire break alarm is disabled and an open wire condition exists in the sensor wiring, the module may report random values." This is the source-of-truth statement to keep in mind when a user reports a strange value rather than a clean overrange sentinel (SB 1231 1 AI RTD specifications).

Root Cause 1: Damaged Input Channel

The user reported that swapping the SB 1231 RTD for another unit resolved the issue. That is the most direct evidence of a damaged input channel. Input channels on a 16-bit signal board can fail for several reasons:

• Overvoltage on the input. Although the SB 1231 RTD is isolated from logic, the inputs are not designed to accept line voltage. A common field failure mode is when a 24 V DC actuator wire is landed on the RTD terminal block, especially if the same multi-conductor cable is reused for both signal and power.
• ESD during commissioning. Touching the terminal block after walking across an insulated floor can inject several kilovolts into the high-impedance input.
• Ground potential differences. When the sensor is bonded to a remote ground (for example, a motor housing) and the CPU is bonded to a different ground, a fault current can flow through the sensor leads. Even tens of volts of potential difference can damage a sensitive input stage.
• Lightning / surge exposure on long cable runs. The SB 1231 RTD ships without integrated surge protection. Long field runs through outdoor conduit need an external surge arrestor.

To confirm a hardware failure after you have eliminated wiring and configuration, isolate the signal board from the system and bench-test it with a precision decade box:

1. Power down the S7-1200 and unplug the SB 1231 RTD.
2. Connect a calibrated decade resistance box to the channel in 4-wire mode for the most accurate result (terminals M0+, M0-, I0+, I0-).
3. Set the box to 100.00 Ω (simulating 0 °C Pt100).
4. Re-seat the SB, power up, go online with TIA Portal, and read the engineering value. Acceptable deviation is 0.1 to 0.5 °C after a 10-minute warm-up.
5. Increment the box to 138.50 Ω (simulating 100 °C Pt100). The reading should be within tolerance of 100.0 °C.
6. If either reading is missing, clipped to the overrange sentinel, or wildly off, the channel is damaged and the signal board must be replaced.

If the bench test passes but the in-cabinet test fails, the fault is in the field wiring, not the board. Continue with the remaining root causes.

Root Cause 2: Ground Potential and Wiring Path

The discussion thread on this case explicitly raised the question of whether all devices share a common ground potential. This is a real and recurring failure mode for instrumentation.

Ground potential problems appear in two flavors:

1. Common-mode voltage on a single-ended input. The SB 1231 RTD expects the sensor and the CPU to share the same 0 V reference. If the sensor housing is grounded at a different point (for example, at a motor frame, a pipe rack, or a remote distribution panel), the resulting potential difference forces a current through the RTD leads. The internal ESD diodes and the analog front end see a voltage that can exceed their absolute maximum ratings.
2. Ground loop on a 4-wire input. A 4-wire connection has separate force and sense pairs. If a ground path exists between the cable shield at both ends, the resulting loop injects noise that can read as an out-of-range value.

To verify, measure AC and DC voltage between the CPU 0 V terminal and the sensor body ground with a true-RMS multimeter. Acceptable practice is below 1 V AC and below 1 V DC; values above 5 V are a serious red flag. If the potential is high, bond the grounds with a heavy-gauge conductor, route the cable away from VFD output cables, or switch to a 3-wire or 4-wire sensor mounted on an isolated bracket.

Root Cause 3: 2-Wire Lead Resistance Error

The user wired the Pt100 in 2-wire mode. 2-wire mode is the simplest wiring option but is the least accurate because the resistance of the copper lead wires is in series with the sensor. The SB 1231 RTD applies no compensation for lead resistance in 2-wire mode. The Siemens selection table is explicit: "The resistance of the connection wires in 2 wire mode will cause an error in the sensor reading and therefore accuracy is not guaranteed."

To estimate the error, use the lead resistance value:

T_error (°C) ≈ R_lead (Ω) / 0.385 (Ω/°C)

A typical installation with 10 m of 24 AWG copper lead has a loop resistance of roughly 1.5 Ω, which corresponds to about 3.9 °C of error. With 50 m of 18 AWG, the error is about 0.5 °C. With 100 m of 24 AWG, the error can exceed 7 °C. If the resulting resistance is just over the configured range maximum, the module reports an overrange value rather than a clipped engineering value, which is what the user saw.

The right fix is either to switch the configuration to 3-wire (the SB will compensate for one side of the lead) or 4-wire (full compensation, plus automatic wire-break detection on both leads), or to add a 4-wire Pt100 if the application allows it. The wiring schematic in the device manual shows the terminal mapping:

If 2-wire is mandatory, use the largest available wire gauge and keep the lead short. Do not exceed 10 m of 24 AWG if you need a 0.5 °C tolerance.

Diagnostic Workflow

The following matrix condenses the failure modes into a single decision tree. Run the steps in order. The first step that passes eliminates that branch of the matrix.

Hardware Replacement Procedure

Once the bench test confirms a damaged channel, replacement is straightforward but the firmware and configuration must be re-verified after the swap.

1. Back up the project and document the current hardware configuration from the device view.
2. Power down the S7-1200. Disconnect the field wiring from the SB terminal block. Label every lead.
3. Remove the two screws that retain the signal board, lift it straight out, and place it on an ESD-safe surface.
4. Inspect the slot for bent pins, debris, or oxidation. Clean with isopropyl alcohol and a lint-free swab if needed.
5. Seat the replacement SB 1231 RTD. Apply even pressure on both ends. Tighten the retaining screws to 0.3 N·m.
6. Reconnect the field wiring. Torque the terminal screws to 0.5 N·m.
7. Power up. TIA Portal should detect the new module automatically if the MLFB matches the configuration. If it does not, perform a hardware re-detect: Online > Accessible nodes or right-click the SB in the device tree and select Detect module.
8. Re-verify the channel configuration: sensor type, temperature unit, smoothing, diagnostics enable, wire-break alarm enable, and limits.
9. Run the bench test from Root Cause 1 before connecting the field sensor.
10. Connect the field sensor. Read PIW80, watch the diagnostic buffer for one minute, and confirm the value tracks the expected process temperature.

If the replacement reports the same overrange, the fault is in the field wiring or the sensor, not the SB. Repeat the bench test on the new SB to rule out a second damaged unit.

Configuration Best Practices

Configure the SB 1231 RTD in TIA Portal to expose the diagnostic bits you need for fast troubleshooting.

1. Set the temperature unit to match the application (°C is the default and avoids unit-conversion bugs in scaling blocks).
2. Enable Diagnostics and Wire break for every active channel. Wire-break detection is the fastest way to catch a broken sensor lead.
3. Set the Temperature coefficient to 0.003851 for IEC 60751 Pt sensors. Do not leave it at the default 0.003850 if the rest of the plant uses the IEC 60751 coefficient.
4. Enable Smoothing only if the process is slow. Heavy smoothing hides a damaged sensor by damping out the noise it injects.
5. Set the high and low limits to the physical extremes of the process, not to the full sensor range. A correctly wired Pt100 will never read -200 °C in a chilled-water plant; if it does, you want the diagnostic to fire.
6. Map the diagnostic interrupt OB82 to a routine that latches a system bit. Use that bit in HMI alarms.

The CPU 1200 firmware 4.x and later expose the per-channel Value status in the process image. Tie this bit into the application logic to suppress control actions on a known-bad input rather than relying on a fixed overrange sentinel.

Verification and Commissioning

After every fix, run a closed-loop verification:

1. Power up, go online, and force PIW80 into a watch table.
2. Confirm the diagnostic buffer is empty: Online & diagnostics > Diagnostics buffer.
3. Apply a known temperature to the sensor end. A slurry of ice and water is a precise 0.00 °C reference for Pt100 calibration. A bench calibrator or a hand-held dry-block at 50 °C is the next best option.
4. Compare the engineering value to the reference. Tolerance is sensor class: Class A Pt100 allows ±0.15 °C at 0 °C, Class B allows ±0.30 °C at 0 °C.
5. Cycle the sensor through 0 °C and 100 °C. Verify the slope is 0.385 Ω/°C equivalent to within tolerance.
6. Watch the CPU ERROR LED for 10 minutes. It must remain off.
7. Power cycle the S7-1200 to confirm the configuration is retained in the PLC. The diagnostic bits must clear and the value must re-appear at the next warm-up cycle.

When to Escalate

Escalate to Siemens Technical Support or your regional distributor when:

• Two consecutive SB 1231 RTD boards fail bench test on the same CPU within 30 days.
• The diagnostic buffer shows the same channel fault across multiple SB replacements.
• The TIA Portal version is older than V13 SP1 and the SB firmware is 4.x or higher; upgrade TIA Portal and CPU firmware before replacing the SB again.
• Multiple S7-1200 stations in the same cabinet show simultaneous overrange on their SBs. This is a cabinet-level ground or surge event, not a sensor problem.

For the official documentation, link the specific entry from the SIMATIC S7-1200 manual collection on TIA Portal Cloud, the SB 1231 RTD product page on Industry Online Support (ID 91696622), and the CPU 1200 system manual version that matches your installed firmware. The selection tables in the TIA Portal manual collection list the exact temperature ranges, integration times, and noise rejection frequencies for each sensor type.

FAQ