Troubleshooting Siemens 6ES7331-7KF02-0AB0 SM 331 SF LED Failure

Problem Description: SF LED on 6ES7331-7KF02-0AB0

The SIMATIC S7-300 SM 331 analog input module, order number 6ES7331-7KF02-0AB0, reports a group fault via the red SF (System Fault) LED while the host CPU (e.g., 6ES7315-2DP) continues to run normally. This fault indicates a configuration, parameterization, or wiring discrepancy on one or more of the module's eight analog input channels. The CPU remains in RUN because the SM 331 is configured for diagnostic interrupt, but the module itself cannot return valid process values until the underlying cause is cleared.

The 6ES7331-7KF02-0AB0 is an 8-channel, 13-bit resolution analog input module with four channels sharing a common measuring range via a side-mounted range selection plug. The SF LED can be triggered by an incorrect range plug position, a transducer wiring fault, a missing or out-of-tolerance supply on the transducer, or incorrect HW Config parameterization (channel deactivated, wrong measurement type, broken-wire detection enabled on a passive sensor).

Module Identification and Specifications

Reference: SIMATIC S7-300 S7-300 Module Data Manual (A5E00105505-06) details all measuring ranges, range-module positions, and diagnostic LED behavior for the 6ES7331-7KF02-0AB0.

Root Causes of the SF LED

For the SM 331 analog input family, the SF LED illuminates whenever the module detects a parameter assignment error or a sensor-side fault. The five most common causes on the 6ES7331-7KF02-0AB0 are:

1. Range module in the wrong position. The four-position selector on the left side of the module must match the HW Config setting. A mismatch (e.g., position D for 4-wire 4–20 mA but HW Config set to voltage) is the most frequent trigger.
2. Four-wire vs. two-wire transducer wired incorrectly. A 4-wire transducer needs its own 24 V supply loop; a 2-wire loop-powered transducer draws power from the measurement wires and only supports 4–20 mA.
3. Unused channels not deactivated. Open inputs default to the last measured value and, if not disabled, can pull the channel below 4 mA and trip wire-break diagnostics on the active channels.
4. Wire break, short, or out-of-range signal. 4–20 mA loops with open circuits, or voltage inputs driven beyond ±10 V, will set the per-channel diagnostic bit and group SF.
5. Backplane connector or grounding fault. Loose front connector, missing or reversed M-ANA ground jumper, or 24 V sensor supply missing will set the module fault byte.

Step 1 — Read the CPU Diagnostic Buffer

Before any hardware work, read the diagnostic buffer of the S7-300 CPU. In STEP 7, open the project online and navigate to:

PLC > Diagnostic/Setting > Diagnostic Buffer

Search for an entry referencing the analog module's logical address (e.g., PIW 256 through PIW 270 for an 8-channel SM 331 at slot 4). The diagnostic event will identify whether the fault is:

• Module parameter assignment error — fix in HW Config and reload.
• Wire break on a specific channel — check the field wiring for that channel.
• Measuring range exceeded / below — sensor signal out of configured range.
• Module not present / failed — hardware or backplane issue.

For systems using a Schneider M580 or Modicon M340, the equivalent status is exposed in the module DDT as MOD_FLT.6 (module missing/failed), as documented in Schneider Electric FAQ FA386501. The same diagnostic philosophy applies across vendors: the module-level fault bit does not report per-channel wiring faults on its own — those surface in the per-channel status word.

Step 2 — Verify the Range Module Position

The 6ES7331-7KF02-0AB0 uses a four-position range module on the left side of the housing. The position is mechanically set and must match the HW Config measuring range assignment. For the 02 firmware version, the typical assignments are:

Key insight from the S7-300 module data manual: a 4-wire transducer has two wires carrying the 4–20 mA measurement signal and two separate wires carrying the loop supply — channels 4–7, range module position C. A 2-wire transducer is powered through the measurement wires themselves — channels 0–3, range module position D, and only 4–20 mA is valid because the open-circuit current is 4 mA by design.

To verify the position, remove the module from the DIN rail and inspect the dial on the side. If the position is wrong, the SF LED cannot be cleared by software reconfiguration alone — mechanically reset the dial to match HW Config.

Step 3 — Deactivate Unused Channels

Unused channels must be disabled in HW Config to prevent the module from interpreting noise on floating inputs as either wire break or out-of-range. In STEP 7:

1. Open HW Config and double-click the SM 331 slot.
2. Select the Inputs tab.
3. For each unused channel, change the dropdown from the measurement type to Deactivated.
4. Click OK and translate / download the hardware configuration to the CPU.

For modern TIA Portal projects, the same steps apply via the device view: Properties > Analog inputs > Channel > Measurement type = Deactivated. Reference: S7-300 Automation System Manual.

Step 4 — Validate 4-Wire vs. 2-Wire Transducer Wiring

Misidentifying a transducer is a leading cause of intermittent SF faults. The 6ES7331-7KF02-0AB0 SM 331 does not source 24 V to the field — the user must supply it. The wiring pattern is:

For a 4-wire transducer wired to channels 4–7, the front connector pinout is:

• Pin 4 (Ch4 M+): signal +
• Pin 5 (Ch4 M−): signal −
• Pin 6 (Ch5 M+): not used / next signal +
• External 24 V: routed to the transducer's supply terminals (not to the SM 331 front connector)

Step 5 — Check the Front Connector and Shielding

1. Power down the S7-300 rack and remove the front connector from the SM 331.
2. Inspect each screw terminal for tightness, strand whisker shorts, and correct wire gauge (0.25–1.5 mm² solid or stranded with ferrule).
3. Confirm the shield terminal is bonded to the grounding bar and that the cable shield is terminated on the field side only, not both ends.
4. Verify the 24 V sensor supply at the transducer is present and within tolerance (typically 18–30 V DC at the device terminals after line drop).
5. Re-seat the front connector until it clicks and power the rack back up.

Step 6 — Reload Hardware Configuration

If the diagnostic buffer indicated a parameter assignment error, correct the configuration in HW Config and download to the CPU with the following sequence:

1. STOP the CPU.
2. PLC > Download to Target Device > Hardware Configuration (STEP 7) or Project > Download to device > Hardware configuration (TIA Portal).
3. After the download, perform a CPU restart (STOP → RUN) to re-initialize the analog module.
4. Monitor the SF LED. If it extinguishes, the parameter assignment is now consistent.

Step 7 — Verify Resolution

Once the SF LED is off, confirm correct operation by:

• Reading each active channel's process image (PIW) in a VAT table. Values should be plausible and within 0–27648 for Siemens S7 raw counts.
• Applying a known reference (e.g., a calibrator sourcing 12.000 mA to a 4–20 mA channel — expect PIW ≈ 13824).
• Monitoring the per-channel status word via SFC 51 / RD_REC on the diagnostic data record set DS0/DS1. No bit should be set in the channel status field.
• Cross-checking the diagnostic buffer for any new entries. It should remain unchanged after the SF LED clears.

Edge Case: Persistent SF After All Checks

If the SF LED persists after the steps above, escalate in this order:

1. Try a known-good module of the same MLFB in the same slot. If the replacement clears the SF, the original module is defective.
2. Check the backplane connector for bent pins, oxidation, or contamination. Clean with isopropyl alcohol and reseat.
3. Verify the rack is properly grounded and the CPU is in RUN with no diagnostic interrupts of its own.
4. Test with the transducer disconnected and the input shorted locally. A shorted current loop should not produce a wire-break diagnostic; if SF persists with the input shorted, the module's input stage is suspect.
5. Inspect the STEP 7 / TIA Portal version: very old projects with the original 6ES7331-7KF02-0AB0 may use a GSD that does not match the firmware of the physical module. Update the HW catalog entry to the latest HSP matching the module's printed firmware (visible on the front label).

Edge Case: Pre-scan Reset of OTE Bits (Cross-Platform Note)

On Allen-Bradley CompactLogix systems, a related failure mode occurs when the CPU pre-scan at power-up resets all OTE bits and the analog module appears to fail because the controlling logic starts in a default state. The mitigation is to use OTL/OTU (latching) instructions rather than OTE in routines that run on the analog module. Reference: Rockwell Automation Knowledge Base 23492. While not a Siemens-specific issue, it is a common engineer-experience pattern: a module fault reported at startup can be configuration-driven rather than hardware-driven.

Edge Case: Sub-2.5 V ADC Range Failure (Cross-Platform Note)

On precision ADC modules such as the AD7984, modules have been observed to latch to a zero reading on any input below 2.5 V after a few operating cycles. The field remedy is to keep the input within the specified common-mode range and to use a buffer amplifier. Reference: Analog Devices EngineerZone Q&A 24458. For the SM 331, the equivalent principle is to keep the measured signal within the configured range (e.g., 1–5 V or 4–20 mA) — operation outside the configured range triggers a measuring-range-exceeded diagnostic bit, which can be confused with a module failure.

Configuration Parameter Reference

Diagnostic Data Record Layout (DS0/DS1)

The SM 331 returns 14 bytes of diagnostic data in DS0 and 16 bytes in DS1 when a diagnostic interrupt is pending. The first two bytes contain the module status in the standard S7 diagnostic record format:

Read with SFC 59 / SFC 58 in STEP 7 or with the standard RD_REC / WR_REC instructions in TIA Portal. The returned payload can be parsed to isolate the failing channel group, which tells you whether to focus the range-module check on C (Ch 4–7) or D (Ch 0–3).

Safety and LOTO Considerations

FAQ