Wiring Siemens SM 431 (6ES7431-1KF10-0AB0) Analog Input Module

David Krause14 min read
S7-400SiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Module Identification and S7-400 Family Context

The 6ES7 431-1KF10-0AB0 is the SIMATIC S7-400 signal module SM 431, AI 8 x 14 Bit — an eight-channel analog input module with 14-bit resolution plus sign. It installs in the S7-400 rack alongside digital I/O, communication processors, and interface modules, and it occupies one slot in the central rack (CR) or expansion rack (ER) of an S7-400 station. The module belongs to the SM 431 family that includes the legacy 6ES7431-1KF00-0AB0 (4-channel voltage/current only) and the higher-precision 6ES7431-7KF00-0AB0 (8-channel, 16-bit, with diagnostic interrupt). The -1KF10- variant was introduced as a cost-effective 14-bit offering that supports voltage, current, resistance, and RTD measurement on all eight channels.

The full Siemens catalog ordering data for the module is:

  • MLFB: 6ES7 431-1KF10-0AB0
  • Function: 8 AI, U / I / RTD / R, 14-bit
  • Front connector: 48-pin, screw-type or spring-type (6ES7492-1CL00-0AA0 screw, 6ES7492-1CL10-0AA0 spring)
  • Required for HW Config: STEP 7 V5.4 SP5 or higher, or TIA Portal V13 SP1 Update 5 and later

Reference the SIMATIC S7-400 SM 431 AI 8 x 14 Bit (6ES7431-1KF10-0AB0) device manual for the complete parameter list, error codes, and configuration screens. The cross-system S7-400 Automation System manual is available at the legacy URL S7-400 Automation System, Module Specifications — see chapter 5.19 for the SM 431 wiring and parameterization rules.

2. Pin Assignments and Front Connector Layout

The 48-pin front connector of the SM 431 is divided into eight channel groups, plus the module's power supply and shield terminations. For the -1KF10-0AB0 module, all eight channels are galvanically isolated from the backplane bus but share a common internal ground reference. The pin map for voltage input on channel 0 (CH0) is:

Pin Label Function CH0 Signal
3 L+ Module supply +24 V DC —
4 M Module supply 0 V (pin 48 internally jumpered) —
11 M+ (CH0) Positive input, channel 0 + 0-10 V
12 M- (CH0) Negative input / ground reference, channel 0 0 V (signal GND)
13 M+ (CH1) Positive input, channel 1 (unused)
14 M- (CH1) Negative input, channel 1 (unused)
15 M+ (CH2) Positive input, channel 2 (unused)
16 M- (CH2) Negative input, channel 2 (unused)
17 M+ (CH3) Positive input, channel 3 (unused)
18 M- (CH3) Negative input, channel 3 (unused)
19 M+ (CH4) Positive input, channel 4 (unused)
20 M- (CH4) Negative input, channel 4 (unused)
21 M+ (CH5) Positive input, channel 5 (unused)
22 M- (CH5) Negative input, channel 5 (unused)
23 M+ (CH6) Positive input, channel 6 (unused)
24 M- (CH6) Negative input, channel 6 (unused)
25 M+ (CH7) Positive input, channel 7 (unused)
26 M- (CH7) Negative input, channel 7 (unused)
40–47 COMP / SENSE Constant-current lines for RTD measurement (unused for 0-10 V)
48 M Module ground (chassis / 0 V return) —
Critical wiring rule: Pin 3 (L+) and pin 48 (M) are the module supply inputs (24 V DC). They are not analog signal inputs. Do not place your analog signal common on pin 48 unless the analog source's signal ground is also tied to that potential. With a 0-10 V source that is not isolated, the M- terminal of the analog channel itself (pin 12 for CH0) is the correct return path.

3. Wiring Procedure for a 0-10 V Source on Channel 0 / Channel 1

The most common panel-side error is to float the M- terminal or to tie signal ground to chassis ground at two different points, creating a ground loop. Follow this procedure for a clean 0-10 V installation on the 6ES7 431-1KF10-0AB0:

  1. Power down the S7-400 rack. Remove the front connector from the SM 431 by pressing the eject tab at the top of the connector and pulling straight out.
  2. Wire module supply: Connect +24 V DC to pin 3 (L+) and 0 V DC return to pin 48 (M). Use a 24 V power supply rated for the rack (a SITOP PSU or equivalent). Confirm polarity with a DMM before re-inserting the connector.
  3. Wire the 0-10 V source: Connect the positive terminal of the test panel's potentiometer wiper (or 0-10 V source) to pin 11 (M+ for CH0). Connect the negative terminal of the source to pin 12 (M- for CH0). For channel 1, use pins 13 and 14.
  4. Keep the 24 V supply and the analog signal grounds separate. Pin 48 is the module's DC return; pin 12 is the analog signal reference. They share an internal connection but should not be cross-bonded at the field device — that creates a ground loop and injects noise into the 14-bit converter.
  5. Verify open-circuit behavior: with the source disconnected, the channel should report -32768 (underflow for 0-10 V unipolar range) or 0 depending on diagnostic enable state. If the channel reports large positive or negative values that drift, the M- terminal is floating.
  6. Re-insert the front connector and torque the locking screws to 0.4–0.6 N·m. Power the rack.
  7. Open HW Config in STEP 7 or the device configuration in TIA Portal and verify the slot order. The SM 431 occupies one slot; the first analog input word is mapped to the configured input address (default IW512 for the first SM 431 in slot 4 of a UR2 rack).
  8. Add an OB1 or VAT/PLC tag table to monitor IW512 (CH0) and IW514 (CH1). With a precision source, calibrate at 0 V and 10 V. The expected full-scale integer for 0-10 V is 27648 (the nominal range end per Siemens analog value representation).

If the readings are stable and you see −32768 or random negative integers, the M- terminal is the most common culprit. A loose crimp on pin 12 (or pin 14 for CH1) is the single most frequent cause of “negative drift” on the 0-10 V input range.

4. STEP 7 / TIA Portal Configuration

The 6ES7 431-1KF10-0AB0 is a software-configurable module — the measuring method (voltage, current, RTD, resistance) and the measuring range are set in the engineering tool, not with DIP switches or solder bridges. Default state is all channels disabled, which is why the source OP reported “Channel 0 disabled” as a required check.

4.1 STEP 7 V5.5 / V5.6

  1. Open the S7 project, then HW Config. Right-click the SM 431 slot and select Object Properties.
  2. Switch to the Addresses tab and note the input address range. With a standard slot assignment (slot 4, AI), the start address is typically PIW512, and the eight channels consume 16 bytes (PIW512…PIW526).
  3. Switch to the Inputs tab. The module is divided into two channel groups of four channels (CH0–CH3, CH4–CH7) and one RTD/TC group.
  4. For each channel, set:
    • Measuring method: U (voltage) for 0-10 V input
    • Measuring range: 0..10 V
    • Integration time / smoothing: default 60 Hz rejection = 16.7 ms / channel
    • Diagnostics: enable “Wire break” only for 1-5 V or 4-20 mA ranges. The 0-10 V range does not support wire-break detection because 0 V is a valid in-range value.
  5. Save and recompile (Station → Save and Compile). Download HW Config to the CPU.

4.2 TIA Portal V15 / V16 / V17

  1. Open the device configuration of the S7-400 station. Select the SM 431 slot.
  2. In Properties → General → Module parameters → Channels, expand Channel 0.
  3. Set Measuring method = Voltage, Measuring range = 0 to 10 V.
  4. Under Diagnostics, ensure that Channel 0 active = enabled and that Diagnostic interrupt is enabled only if you want the CPU to call OB82 on a wire break or overrange condition.
  5. Compile and download the device configuration.
Channel enable: every channel must be explicitly enabled. If you leave a channel disabled, the corresponding input word returns 0 and is not updated by the ADC. On a freshly inserted SM 431 all eight channels are disabled, so you must enable at least channel 0 (or channel 1 if you wired pin 13/14) before reading valid values.

5. Analog Value Representation for the 0-10 V Range

The SM 431 follows the standard SIMATIC S7 analog value convention. For a unipolar 0-10 V range, the mapping is:

Voltage at input Decimal value (INT) Hex Notes
> 11.7589 V 32767 0x7FFF Overflow — set high bit + overrange flag
11.7589 V 32511 0x7EFF Overrange upper end
10.0 V 27648 0x6C00 Nominal full scale
5.0 V 13824 0x3600 Mid scale
2.5 V 6912 0x1B00 Quarter scale
0.0 V 0 0x0000 Nominal zero
-0.176 V -4864 0xED00 Underrange lower end
< -1.176 V -32768 0x8000 Underflow

The transfer function is linear:

Decimal = 27648 × V_in / 10.0    (0 ≤ V_in ≤ 10 V)

Engineers converting to engineering units should scale within the program:

// Ladder equivalent (SCL / STL)
// Input: IW514 (CH1 of SM 431, 0-10 V)
// Output: MD200 (REAL, 0.0 .. 100.0 %)

L IW514            // Load raw 16-bit value
ITD                // Integer to double integer
DTR                // Double to real
L 2.764800e+001    // 27648.0
/R                 // Divide
T MD200            // Store scaled REAL

The reported behavior in the field report (IW514 = 27648 at 10 V, IW514 = 8 at 0 V) is fully within the basic accuracy of the 6ES7 431-1KF10-0AB0. The 8-count offset corresponds to 8 × 10 / 27648 = 2.89 mV, which is well inside the ±0.3% of full-scale basic error limit specified for the module at 25 °C ambient. No recalibration is required.

6. Status LEDs and Diagnostic Interrupts

The front panel of the SM 431 carries four status LEDs that are critical for first-commissioning troubleshooting:

LED Color Meaning
SF Red Group error — module fault, configuration error, or channel diagnostic active
INTF Red Internal fault (module hardware / firmware)
EXTF Red External fault (wire break, overrange, underrange, no front connector)
24 V Green Module supply 24 V DC present on pins 3/48

When Diagnostic interrupt is enabled in HW Config, the CPU calls OB82 on a diagnostic event. The diagnostic buffer (read from STEP 7 under CPU → Module Information → Diagnostic Buffer, or from TIA Portal under Online & Diagnostics) contains entries such as:

Diagnostic event Cause Remedy
Channel 0 wire break M+ or M- line interrupted, source open Inspect crimps, retighten front connector
Channel 0 overrange Voltage > 10.5 V at the input Verify source signal, install a clamp / attenuator
Channel 0 underrange Voltage < -1.18 V at the input Verify polarity, check for miswired 4-20 mA loop on a 0-10 V range
Configuration error Channel 0 enabled but measuring method mismatched (e.g. RTD on a 2-wire) Re-check channel group configuration
Module not parameterized CPU in STOP, or no HW Config download to CPU Download HW Config, perform CPU restart
No front connector Front connector not detected (only available with diagnostic-enabled variants) Re-seat connector

The base -1KF10-0AB0 firmware reports SF for most channel-level events; the higher-end -7KF00-0AB0 with full diagnostic interrupt support is required if you need channel-granular OB82 entry codes (per the S7-400 module manual chapter 5.19).

7. Technical Specifications (6ES7 431-1KF10-0AB0)

Parameter Value
Number of inputs 8
Resolution 14 bits + sign (unipolar: 14 bits; bipolar: 14 bits + sign)
Galvanic isolation Yes — between channels and backplane
Supported measuring methods Voltage, current, resistance, RTD (Pt / Ni)
Voltage ranges ±1 V, ±5 V, 1–5 V, 0–10 V
Current ranges 0–20 mA, 4–20 mA, ±20 mA
RTD types Pt100, Pt200, Pt500, Pt1000 (standard / climatic), Ni100, Ni120, Ni200, Ni500, Ni1000
Resistance ranges 0–600 Ω
Integration time 2.5 / 16.67 / 20 / 100 ms (50 / 60 Hz / 50 Hz / 400 Hz noise rejection)
Basic error limit (@ 25 °C) ±0.3% of full scale (voltage)
Operating temperature 0 °C to +60 °C horizontal mounting; 0 °C to +40 °C vertical
Module supply (L+/M) 24 V DC (20.4 V–28.8 V), 300 mA typical
Power dissipation ~ 4.5 W
Front connector 48-pin, screw or spring (separate order)
Dimensions (W × H × D) 25 × 290 × 210 mm

For the complete datasheet, including the channel-group re-configuration rules (which pairs of channels can be assigned to different measuring methods simultaneously) refer to the device manual at support.industry.siemens.com entry 109781595.

8. Troubleshooting Matrix

Observed value Likely root cause Verification step Fix
Reading stays at 0 Channel disabled in HW Config Open properties of slot, confirm Channel 0 active = enabled Enable channel, re-download HW Config
Reading stuck at -32768 M- terminal open, or M+ on wrong pin DMM between pin 11 and pin 12 with source off — should read 0 Ω Re-crimp connector, retest
Reading drifts negative (-100 to -380) Ground loop or floating signal return Check for dual-ground: signal GND at panel tied to module pin 48 Bond M- to signal GND at the panel only, do not cross-bond
Reading pegged at 32767 Voltage above 11.7 V (overrange) DMM directly at the front connector pins 11/12 Reduce source signal to nominal range
Reading noisy / jittery > ±20 counts Integration time too short, or shielded cable not used Enable 100 ms integration time; verify shield bonded at one end Use shielded twisted pair, lengthen integration, route away from VFD cables
SF LED on, CPU in STOP Wrong module in slot / wrong firmware of CPU Check CPU diagnostic buffer for entry “Module not parameterized” Save and re-download HW Config, perform restart of CPU
Channel 0 reads correctly, channel 1 reads 0 Channel 1 not enabled or wired to wrong pin (15/16 instead of 13/14) Confirm front connector pinout; check wiring against table in section 2 Enable CH1, re-wire to pins 13 (M+) and 14 (M-)
Value at 0 V = 8 counts (~3 mV) Module basic accuracy — within spec Compare to 0.3% of 10 V = 30 mV tolerance No action required
Value at 10 V < 27648 (e.g. 27000) Source cannot drive full 10 V, or output is loaded Measure source with no load — should be 10.00 V ± 1 mV Use a lower-impedance source or a buffer amplifier

9. Field Commissioning Checklist

  1. Confirm rack slot is correct and the module’s 24 V supply is on (green 24 V LED illuminated).
  2. Verify the front connector is fully seated; the SF LED must be off in steady state.
  3. Enable the channels you wired (CH0 … CH7) in HW Config and download to the CPU.
  4. Cycle the CPU to RUN; confirm the SF LED stays off.
  5. Apply a precision 0 V reference (short M+ to M- at the connector end) and record the raw value in the VAT/PLC tag table. Acceptable for the -1KF10- is ±20 counts or ±0.07% of full scale.
  6. Apply a precision 10.000 V reference. Expected raw value: 27648 ± 30 counts (27618…27678).
  7. If a 4-20 mA loop must be re-allocated, switch the channel’s Measuring method to Current and select 4..20 mA; do not change wiring on the same channel (current loop is still on the M+ / M- pair).
  8. Document the input address map (PIW512..PIW526) on the drawing set so that subsequent programmers can use the correct symbolic names.
  9. Save the STEP 7 / TIA Portal project to a versioned archive and back up the EPROM of the CPU if the program is to be retained across a power outage.

10. Frequently Asked Questions

Why does my 0-10 V signal read negative numbers on the 6ES7431-1KF10-0AB0?

Almost always a floating M- terminal. The M- (pin 12 for CH0, pin 14 for CH1) is the signal return for the analog channel and must be tied to the source’s signal ground at the panel. A loose crimp on M- or a missing conductor will show up as drifting negative integers such as -100, -380, or pegged at -32768 underflow. Re-seat the front connector, verify continuity, and confirm that the source is referenced to the same potential as pin 12.

Is a reading of 27648 at 10 V correct for the SM 431?

Yes. The nominal full-scale decimal value for any SIMATIC S7 unipolar voltage range (0-10 V, 1-5 V, 0-5 V) is 27648. The corresponding engineering-unit value is calculated with Decimal = 27648 × V_in / 10.0. A small offset at 0 V (e.g. 8 counts) is within the ±0.3% of full-scale basic error limit and does not require recalibration.

Do I need to connect 24 V DC to pins 3 and 48 if I only have an analog signal?

Yes. Pins 3 (L+) and 48 (M) are the module’s logic-power supply. Without 24 V the SM 431 will not digitize any input; the green 24 V LED will be off and the module will report “module not parameterized.” The 24 V supply is independent of the analog signal and must be present even if only one channel is wired.

How do I read 4-20 mA instead of 0-10 V on the same module?

Change the channel’s Measuring method from Voltage (U) to Current (I) in HW Config / TIA Portal, and select the 4..20 mA range. The wiring is the same (M+ / M- pins of the channel), but you must observe polarity — current flows out of the transmitter and returns to M-. Wire-break detection becomes available at 4-20 mA because 0 mA is out-of-range, unlike 0 V which is a valid signal on the 0-10 V range.

What is the difference between the 6ES7431-1KF10-0AB0 and the 6ES7431-7KF00-0AB0?

The -1KF10-0AB0 is the 14-bit, 8-channel, basic variant used in the example project. The -7KF00-0AB0 is a 16-bit variant with full channel-level diagnostic interrupts, hardware wire-break on all ranges, and extended temperature support. Both are S7-400 SM 431 modules and use the same front connector, but the -7KF00- must be selected in HW Config to gain OB82-granular diagnostics and the higher resolution.

Back to blog