Accessing Periphery from SCL on Siemens S7-300 and S7-1200

1. Overview — Why Peripheral Access from SCL Requires Special Handling

Engineers frequently hit a wall when they try to read a raw PEW (peripheral input word) or write a raw PAW (peripheral output word) directly from Structured Control Language (SCL). STL handles peripheral I/O with two-character opcodes (L PEW, T PAW), but the SCL compiler — both the legacy STEP 7 V5.x implementation and the TIA Portal variant — does not expose the operator-explicit PEW n / PAW n address syntax in the same way. A request such as

Variable := IW[index];   // reads from the process image, not the peripheral
Variable := PEW400;      // not accepted by the SCL compiler

is the most common source of confusion: IW400 reads the input process image word 400 (which was refreshed at the start of OB1), while PEW400 reads the actual peripheral input — and these two values are not always identical, especially for PROFINET slaves like the SINAMICS G120C.

This article covers the four practical mechanisms for reaching the peripheral layer from SCL:

1. Direct PEEK / POKE instructions on S7-1200 / S7-1500.
2. AT %PEW… / AT %PAW… declarations inside a data block or FB static area.
3. SFC14 (DPRD_DAT) and SFC15 (DPWR_DAT) for consistent telegram reads/writes on PROFIBUS DP and PROFINET IO.
4. A thin STL wrapper called from SCL — the canonical workaround on S7-300 / S7-400 where SCL lacks direct peripheral accessors.

It also explains why an apparent "out of range" condition can surface when address 400 falls outside the configured Process Image Partition (PIP).

2. Prerequisites — Hardware, Firmware, and Software Versions

Confirm the SCL compiler is installed on the engineering station before opening the source. In TIA Portal, the SCL editor is licensed under "SIMATIC SCL"; in STEP 7 V5.x the option package must be installed from the optional software disc.

3. Direct Peripheral I/O Syntax in SCL

3.1 S7-1200 / S7-1500 — %I…, %Q…, and the :P qualifier

The TIA Portal SCL compiler accepts the following declaration syntax in a FB static area, a DB, or an FC temp area:

FUNCTION_BLOCK FB100
VAR
    wPEW400  AT %IW400  : WORD;   // process-image read
    wDirect   AT %IW400:P : WORD;  // direct peripheral read (no :P in SCL)
END_VAR
END_FUNCTION_BLOCK

3.2 S7-300 / S7-400 — limits of SCL

The STEP 7 V5.x SCL compiler does not generate a PEW/PAW access for a plain symbolic assignment. The reference SCL for S7-300/400 Programming Manual confirms that:

• IW 400 in SCL maps to a process-image read (load instruction with area E).
• QW 400 in SCL maps to a process-image write.
• There is no PEW literal in the SCL language; you must reach the peripheral layer via STL inline, an SFC, or a PEEK helper.

This is the underlying reason "the anypointer function found on forums does not work for peripheral inputs and outputs" — many of those helpers build an ANY pointing into the I/Q/M/DB areas, not the P-area. The fix is to either use SFC14/15 or to delegate the access to a small STL function.

4. Process Image vs. Direct Peripheral Access — When to Use Which

For a G120C Telegram 1 you want direct access — the drive updates its process data asynchronously to the PLC OB1, so the image can lag by an entire cycle. This is the architectural reason SFC14/15 exists.

5. S7-300 / S7-400 SCL — PIW/PAW, AT-View, and the STL Wrapper

5.1 Native SCL — process-image only

FUNCTION FC100 : WORD
BEGIN
    FC100 := IW 400;     // process image, OK
    // FC100 := PEW 400; // *** not compilable in SCL ***
END_FUNCTION

5.2 AT-view trick (process-image)

DATA_BLOCK DB100
  STRUCT
    iw400 AT %IW400 : WORD;
    qw400 AT %QW400 : WORD;
  END_STRUCT
END_DATA_BLOCK

This is a clean way to give the address a name but it still maps to EW 400 / AW 400, not to PEW 400.

5.3 STL wrapper — the canonical S7-300 solution

Create a function FC200 in STL that performs the peripheral access, then call it from SCL:

// FC200 in STL
FUNCTION FC200 : WORD
BEGIN
    L   PEW 400;          // read peripheral input word 400
    T   #RET_VAL;         // return to SCL caller
END_FUNCTION

// SCL caller
FUNCTION FC201 : VOID
VAR_TEMP
    wInput : WORD;
END_VAR
BEGIN
    wInput := FC200();    // STL function called from SCL
END_FUNCTION

The wrapper compiles, the SCL call is type-safe, and the generated STL inside FC200 is exactly what the engineer would have written by hand. This pattern is documented in the STEP 7 SCL Programming Manual as the recommended way to expose peripheral I/O to high-level language blocks on S7-300.

6. PEEK and POKE in TIA Portal SCL

The PEEK/POKE instruction family is the cleanest direct-peripheral access from SCL on S7-1200/1500. Each function takes an area code that selects the memory class.

6.1 Area codes

6.2 Reading PEW 400 and writing PAW 400 from S7-1200 SCL

FUNCTION_BLOCK FB_G120C_Tele1
VAR
    wSTW1   : WORD;   // status word 1 from drive
    wActual : WORD;   // actual speed (raw)
END_VAR

BEGIN
    // ---- read peripheral inputs (slot 400 = drive status) ----
    wSTW1   := PEEK_WORD(area := 16#81, byteOffset := 400);
    wActual := PEEK_WORD(area := 16#81, byteOffset := 402);

    // ---- build control word 1 ----
    POKE_WORD(area := 16#82,
              byteOffset := 400,
              value     := wControlWord1);

    // ---- write speed setpoint ----
    POKE_WORD(area := 16#82,
              byteOffset := 402,
              value     := wSpeedSetpoint);
END_FUNCTION_BLOCK

Notes:

• The byteOffset is always in bytes, even for WORD/DWORD reads. PEW 400 = byte 400; PEW 402 = byte 402, etc.
• Use PEEK and POKE inside the cyclic OB only after verifying the CPU firmware supports them. S7-1200 firmware V4.0 introduced them; V4.1 onwards is recommended. Refer to the S7-1200 System Manual.
• PEEK_WORD returns the raw value. Type-cast to INT or REAL as required; for a speed, the SINAMICS reference variable r2006 must be matched in the drive commissioning (p2000).

7. Consistent Data Access with SFC14 (DPRD_DAT) and SFC15 (DPWR_DAT)

For PROFINET/PROFIBUS slaves like the G120C, SFC14 / SFC15 read and write an entire consistent slot in one call. Consistency is the key benefit: 2, 4, 8 or 32 contiguous PZD words are read/written atomically — no torn data.

7.1 Function signatures

7.2 G120C Telegram 1 — full SCL implementation

FUNCTION_BLOCK FB_DriveInterface
VAR
    LADDR_IN  : INT := 400;   // input slot, configured in HWCN
    LADDR_OUT : INT := 400;
    iStatus   : INT;
    arrPZDIn  : ARRAY[0..5] OF BYTE;   // 3 words = 6 bytes
    arrPZDOut : ARRAY[0..5] OF BYTE;
    wSTW1     : WORD;
    wActualSp : INT;
END_VAR

BEGIN
    // ---- read input slot ----
    iStatus := DPRD_DAT(
        LADDR   := UINT#400,
        RET_VAL := iStatus,
        RECORD  := arrPZDIn);

    IF iStatus = 0 THEN
        // bytes 0/1 = status word 1; bytes 2/3 = actual speed
        wSTW1     := WORD_TO_BLOCK(arrPZDIn[0], arrPZDIn[1]);
        wActualSp := WORD_TO_INT(WORD_TO_BLOCK(arrPZDIn[2], arrPZDIn[3]));
    END_IF;

    // ---- build and write output slot ----
    WORD_TO_BLOCK := arrPZDOut, wControlWord1;
    INT_TO_WORD := wSpeedSetpoint;
    WORD_TO_BLOCK(arrPZDOut, wSpeedSetpoint, 2);

    iStatus := DPWR_DAT(
        LADDR   := UINT#400,
        RECORD  := arrPZDOut,
        RET_VAL := iStatus);
END_FUNCTION_BLOCK

On the S7-300, SFC14 and SFC15 are stored in the standard library; the TIA Portal exposes them as system blocks under "Standard > Extended instructions." See STEP 7 SCL Reference Manual for the complete interface.

8. Process Image Partitions (PIP) and Why "Address Out of Range"

The "address of 400 is out of range of your PIP table" comment is the root cause for many peripheral-access mysteries. On S7-1200/1500 the input process image is split into 32 partitions (PIP 0 … PIP 31) that can be assigned to specific OBs. By default the whole image is assigned to PIP 0 (OB1); the others start at byte 0 of the configured size, not at byte 400.

Direct PEEK/POKE and SFC14/15 bypass the PIP entirely — that is why they are the recommended route for fieldbus data even when the image partition appears configured.

9. Step-by-Step — Reading a SINAMICS G120C Telegram 1 from SCL

1. Configure the G120C in TIA Portal HWCN.
   • Drag the G120C PN from the catalog into the PROFINET subnet.
   • Set the I/O addresses. Convention: input 400..403 (Telegram 1, 2 PZD words = 4 bytes), output 400..403.
   • Assign the module to OB1 (PIP 0) or a dedicated OB (e.g. OB82 for diagnostics).
   • In Telegram configuration select Standard Telegram 1 and confirm "Update time = 2 ms, Consistency = Total".
2. Compile the hardware. The compile must finish without errors; the configured addresses populate the device tags DriveInputs and DriveOutputs in the PLC tag table.
3. Create the SCL block.
   • Insert a new Function Block in the program folder and rename FB_DriveTelegram.
   • Paste the SCL snippet from §7.2.
   • Replace WORD_TO_BLOCK helper with the byte swap required by the SINAMICS word order (Big-Endian / Network on the wire, little-endian byte order in the S7 buffer — the snippet already handles this by placing the low byte first).
4. Call the FB from OB1.

   // OB1 (SCL)
   fbDrive();
   DriveControlWord := fbDrive.wControlWord1;   // optional, for HMI

5. Initialise the drive. From the commissioning engineer or via the S7 wizard, set:
   p0015 = 7 (macro, PN interface, Telegram 1),
   p0922 = 1 (IF1 PROFIdrive),
   p2000 = 1500 rpm (reference speed),
   p2051[0] = r2089[0] (status word),
   p2051[1] = r63[0] (actual speed smoothed). See SINAMICS G120C Operating Instructions.
6. Save and download. Use "Download to device > Hardware and software". After the download the FB runs and the drive responds to the control word.

10. Verification, Commissioning, and Online Diagnostics

1. Online Monitor (Ctrl+F7). Highlight the FB instance, press "Monitor All". The status word (wSTW1) must transition through the SINAMICS state diagram: 0480h → 0531h → 0537h → 053Fh (Operation).
2. Watch table. Open a watch table, drag in %IW400 and %QW400. Issue a force on the control word and verify the drive reacts within one PROFINET update cycle (~2 ms by default).
3. LED status. G120C RDY LED green steady = drive healthy. BF (Bus Fault) red flashing = telegram mismatch. See the diagnostic list (r0947) on the BOP-2 if BF lights.
4. PROFINET diagnostics. In the device's Online & Diagnostics view, check the PROFINET port statistics. A high CRC error count indicates cabling problems, not an SCL issue.
5. Buffer the telegram on scope. Connect the SIMATIC S7-PCT or a project trace to monitor the cyclic PZD; this confirms whether the issue is in the SCL read or in the drive's response.

11. Troubleshooting Matrix