Troubleshooting Analog Input SM 331 16#7FFF Overflow Value on 6ES7331-7KF02-0AB0

An analog input reading 16#7FFF (Hexadecimal 32767) across all channels on an S7-300 / ET 200M SM 331 module (6ES7331-7KF02-0AB0) indicates an Overflow or hardware fault state. In SIMATIC S7, 16#7FFF represents input signal overflow (exceeding 118.519% of nominal range) or open-circuit saturation. The primary root causes are: first, a catalog mismatch in HW Config (selecting 7KF02 when physical hardware is actually 1KF02); second, physical measuring range coding keys (jumpers A/B/C/D on the module side) mismatched with HW Config measuring types; and third, ungrounded floating reference potentials (Mana not connected to M). Verify module MLFB, set side coding keys to match configuration, and bridge Mana to system ground.

S7-300 Analog Representation and the 16#7FFF Overflow State

In SIMATIC S7-300 and ET 200M distributed I/O, analog input modules digitize physical field measurements ($4-20\text{ mA}$, $0-10\text{ V}$, PT100) into 16-bit integer values. Standard measuring ranges are scaled such that nominal $100\%$ equates to integer 27648.

The S7 operating system reserves specific values for out-of-bounds conditions:
- 16#7FFF (+32767): Indicates Overflow (signal $> 118.519\%$) or channel hardware saturation.
- 16#8000 (-32768): Indicates Underflow (signal $< -118.519\%$, wire break on $4-20\text{ mA}$, or unconfigured input).

When a module outputs 16#7FFF across all channels simultaneously—even with no sensors connected or with normal signals applied—the analog-to-digital converter (ADC) front-end is saturated.

Root Causes: Hardware Selection, Side Coding Keys, and Floating Ground

Three technical issues account for project-wide 16#7FFF errors on SM 331 modules:
1. MLFB Catalog Mismatch (7KF02 vs 1KF02): Engineers frequently select 6ES7331-7KF02-0AB0 (AI 8 x 12 Bit) in HW Config when the physical module installed on the DIN rail is actually 6ES7331-1KF02-0AB0 (AI 8 x 13 Bit), or vice versa. The two modules utilize completely different internal address mappings, channel groupings, and parameter structures.
2. Side Measuring Range Coding Plugs: The 7KF02 module features four physical range cubes on its side (labeled A, B, C, D) corresponding to channel pairs 0/1, 2/3, 4/5, and 6/7. If HW Config is set for 2-wire current (2DMU), the physical cube must be aligned to position D. If the cube is set to C (4-wire) or B (voltage), the module's internal 24V loop power supply is disconnected, saturating the channel.
3. Floating Analog Ground ($M_{ANA}$ to $M$): If the analog measuring reference potential ($M_{ANA}$, Pin 11) is not connected to the CPU / power supply ground ($M$, Pin 20), common-mode voltage ($U_{CM}$) floats beyond the allowed threshold ($U_{CM} > 2.5\text{ V}$), driving all differential amplifiers into positive saturation (16#7FFF).

Diagnostic Matrix for SM 331 Channel Status and Fault Codes

The table below details analog input status values, side coding positions, and corrective engineering actions:

Hex Value / StatusChannel StatePrimary Root CauseCorrective Action16#7FFFOverflow / FaultSide coding plug mismatched; $M_{ANA}$ floating; wrong MLFB in HW Config.Align side cubes to match HW Config; bridge Pin 11 ($M_{ANA}$) to Pin 20 ($M$).16#8000Underflow / Wire BreakBroken wire on 4-20 mA loop; unconnected channel with diagnostics enabled.Check sensor loop current; disable unused channels in HW Config.0 to 27648Normal Operating RangeValid process signal ($4-20\text{ mA}$ or $0-10\text{ V}$).Normal operation; linear scaling applied by channel drivers.Side Cube D2-wire transmitter (2DMU)Module supplies 24V loop power; measures current.Set when sensor is passive 2-wire loop-powered.Side Cube C4-wire transmitter (4DMU)External sensor supplies power; module measures current.Set when sensor has independent AC/DC power supply.

Step-by-Step Troubleshooting and Wiring Remediation Procedure

Confirm Exact Hardware Part Number (MLFB):
- Inspect the front door label of the physical module: confirm whether it is 6ES7331-7KF02-0AB0 or 6ES7331-1KF02-0AB0.
- In STEP 7 HW Config, verify that the module inserted in the rack slot matches the physical MLFB character-for-character.
Verify Side Measuring Range Keys (Coding Plugs):
- Remove the module from the rack.
- Locate the four square plastic coding plugs on the left side of the module.
- Set the plugs matching HW Config parameterization: for 2-wire current ($4-20\text{ mA}$ loop-powered), orient marker to D.
- For 4-wire active current sensors, orient marker to C.
Establish Proper Reference Grounding ($M_{ANA}$):
- On the 20-pin front connector, install a jumper wire between Pin 11 ($M_{ANA}$) and Pin 20 ($M$).
- Connect Pin 20 to central cabinet protective earth (PE) ground to eliminate common-mode potential drift.
Deactivate Unused Channels in HW Config:
- In HW Config, double-click the module -> Inputs tab.
- For channels without sensors connected, set the measuring type to Deactivated (this prevents floating inputs from inducing cross-talk on active channels).
Save, Compile, and Download:
- Download the hardware configuration to the CPU in STOP/RUN mode.
- In HW Config, select Monitor/Modify: confirm that channels read within normal ranges (0 to 27648).

Verification

Verify analog input health through the following steps:
1. Connect an active 4-20 mA signal calibrator to Channel 0 (Pins 2 and 3): inject $12.0\text{ mA}$ ($50\%$).
2. In STEP 7 Variable Table (VAT) or HW Config Monitor, inspect the input word (PIW): verify that it reads approximately 13824 ($50\% \pm 0.5\%$).
3. Check the module SF LED: confirm that the red system fault LED is dark.

Limitations and Operational Precautions

Never adjust side coding plugs while the module is powered on in the rack. Changing coding keys while 24V DC is applied can damage internal precision measuring resistors. Always power down the ET 200M rack before extracting modules or re-orienting coding cubes. Additionally, when wiring 2-wire transmitters (2DMU), never connect an external 24V power supply directly across the input pins; the module provides loop power internally on Pin M+.