Accessing S7-300 I/O Beyond Process Image Limits in Step 7

A common commissioning question on SIMATIC S7-300 / S7-400 stations is: "I uploaded the program, but I cannot see the inputs and outputs in the editor or in Cross References. Only I0.0 and Q0.0 are visible." This is not a programming mistake. It is the natural consequence of how STEP 7 builds the process image, how cross-references are generated, and how the editor displays used symbols. This article explains the underlying addressing model, why some I/O never appears in Cross References, and the standard techniques engineers use to access I/O outside the directly-visible address range, including PIW/PQW peripheral access, L PIW / T PQW direct I/O, and full I/Q buffering to a data block.

1. Problem Definition: I/O Does Not Appear in Cross References

The typical symptom is reproducible:

• You perform an Online → Upload Station to PG in SIMATIC Manager.
• You open the S7 program and look for your input and output bits.
• The online block view shows only a small set of bit addresses, often just I0.0 and Q0.0.
• Cross References (Options → Cross References, or Ctrl+Alt+F7) shows no entries for I1.0, PIW2, PIW4, etc.
• The hardware configuration (HW Config) shows 2, 3 or 4 I/O modules populated in the rack.

Three root causes explain this scenario in 95% of the cases found in the field:

1. Cross References only list addresses actually referenced in the user program. If a module's channels are not addressed in OB1, FB, FC, DB or instance code, they will not show up.
2. The direct I/O area accessible symbolically is the process image (PI). The PI is limited in size. Anything outside it must be reached with peripheral I/O (PIW/PQW) or with absolute I/O (P area) access.
3. Symbolic names are not always uploaded with the station. An Upload to PG retrieves the program blocks but the symbol table is not always reconstructed, so Cross References by symbol appear empty until symbols are re-entered or downloaded from a backup.

2. S7 I/O Addressing Model Overview

The S7-300/400 separates the input/output space into three distinct memory areas, and confusing them is the most common source of "missing I/O" complaints.

Operationally, the rule is: if you see only I0.0 and Q0.0 in your program, you are seeing the process image and not the peripheral area. The peripheral area is reached by explicit L PIW / T PQW statements or by configuring the module's update area.

3. Direct I/O vs Process Image vs Peripheral I/O

The 2-, 4-, 8- and 16-channel digital I/O modules of the S7-300 (SM321 / SM322 / SM323 / SM327) are mapped into both areas. The mapping is fixed by the slot address. As an example, an SM321 DI16x24VDC in slot 4 with starting address 4 yields the following ranges:

If the module sits inside the process-image window, the PII/PIQ is refreshed automatically. If the module sits outside it (typical for a DP slave's first inputs at address 256 and above on a CPU 315-2 DP), the engineer must refresh it explicitly or use peripheral I/O.

4. Process-Image Size Limits per CPU

Process-image size is a CPU property, not a project property. The S7-300 family values are:

Anything you put on PROFIBUS DP starting from the configured DP-slave base address that lies above the PII/PIQ window is not part of the automatic process image. It is only reachable by L PIW/T PQW. This is the most common reason a station with 2-4 I/O modules shows a "short" I/O list inside the editor.

5. Why Some I/O Does Not Appear in Cross References

STEP 7 Cross References is a program-derived index. Its logic is:

1. STEP 7 scans the entire user program (OB, FB, FC, DB, instance DB, SFB, SFC).
2. For every absolute or symbolic address it finds, it records the location (block, network, line) and the access type (read/write).
3. It only indexes addresses that are actually referenced in code.

Consequences for the field engineer:

• An SM322 DQ16 sitting on a remote PROFIBUS DP slave whose channels are physically wired but never addressed in OB1 will not appear in Cross References at all. It is "there" in HW Config and the symbol table, but Cross References does not know.
• If the program accesses the module through L PIW / T PQW, Cross References will show those PIW/PQW addresses - but the engineer must filter on the peripheral area. By default, Cross References groups by block; switch the filter to "Address" to see the peripheral list.
• Peripherally-addressed bytes (e.g. PIB 128 on a DP slave) are not added to the process image and are not visible as I x.y in the editor. They are only visible as PIB/PIW/PID.

6. The Assignment List: How to See ALL Used I/O

When Cross References is empty or misleading, the correct tool is the Assignment List (German: Belegungsplan; menu: Options → Assignment List or Ctrl+Alt+B). It is a different kind of index that shows the bit-by-bit occupation of the I, Q, M, T, C, and P areas and is built from the symbol table plus the program scan.

To open it: in SIMATIC Manager, select the S7 program → right-click → Assignment List. Sort by "Address" and you will see all used bits in I and Q. Bits that are not in the symbol table and not referenced in code appear blank, which is the natural state of any "missing" input or output that has been wired but never addressed.

7. I/Q Buffering Technique (Water / Process Industry Standard)

For stations with more I/O than fits in the process image, or with non-OB1 update requirements, the I/Q buffering pattern is the de-facto industry solution. A dedicated data block (e.g. DB100) holds a struct of BOOL variables that mirror the I/O. The DB is refreshed cyclically by L PIW / T DBW and L DBW / T PQW.

Example layout for DB100 INOUTDB:

The corresponding S7 STL transfer block (OB1 segment or a dedicated FC, e.g. FC100) is:

// ----- Inputs: read PIW0 and PIW2, store into DB100 -----
L     PIW    0                 // read process image input word 0
T     DB100.DBW    0           // store into DB100.DBW0
L     PIW    2                 // read process image input word 2
T     DB100.DBW    2           // store into DB100.DBW2

// ----- Outputs: read DB100 mirror, drive PQW0 and PQW2 -----
L     DB100.DBW    4           // load DB100.DBW4 (output mirror word 0)
T     PQW    0                 // write to peripheral output word 0
L     DB100.DBW    6           // load DB100.DBW6 (output mirror word 1)
T     PQW    2                 // write to peripheral output word 2

After this runs once, all program logic uses DB100.DBX0.0, DB100.DBX2.1, etc. Cross References will now be filled with DB accesses and the symbol table shows the engineered names. Process image can be disabled for those I/O ranges if you no longer need OB1 auto-update (CPU properties → "Process image" → uncheck the byte range).

8. Direct Peripheral Access with PIW/PQW in LAD/FBD/STL

When the I/Q buffering DB is not desired (e.g. for a single time-critical read), access the peripheral area directly. In STEP 7 LAD/FBD you do this by entering the absolute address with a "P" prefix in the operand field:

// STL - direct peripheral read
L     P#I 0.0                  // pointer
L     PIB  100                 // read one byte of input from peripheral address 100
T     MB    200                // store in a flag byte for later use

// STL - direct peripheral write
L     MW    202                // load the output byte(s) from flags
T     PQB  100                 // write one byte to peripheral output address 100

In LADDER the equivalent is to drag a contact / coil and type the address with a leading P (e.g. P I 100.0 for a peripheral-input bit, or P Q 100.0 for a peripheral-output coil). The contact then reads the value of the physical terminal at the time of the scan - no image update is involved.

9. Indirect Addressing and Memory-Indirect Access

For scanning an entire field of digital inputs efficiently, the typical pattern is memory-indirect loop access using a double-word pointer (AR1/AR2). The example below walks PIW0 through PIW14 and packs the bits into a flag area for diagnostics:

// Walk the input field 0..14 by stepping 2 bytes (one PIW) at a time
LAR1   P##InputField           // pointer to source (e.g. P#I 0.0)
LAR2   P##OutputField          // pointer to destination (e.g. P#M 200.0)
L      8                       // loop counter = 8 PIWs = 16 bytes = 128 bits
NEXT: T     #LoopCnt
L      W [AR1,P#0.0]           // read current PIW
T      W [AR2,P#0.0]           // store in flag area
+AR1   P#2.0                   // step pointer by 2 bytes
+AR2   P#2.0
L      #LoopCnt
LOOP   NEXT

Cross References will display such memory-indirect accesses with a "?" annotation, indicating that the address is not known at compile time. This is also a strong clue that the engineer has used peripheral I/O indirectly - it is normal.

10. Step-by-Step Procedure: Locate All I/O on a S7-300 Station

When a station has been uploaded from PG and the engineer cannot see the I/O list, follow this verification procedure:

1. Open HW Config and confirm the slot order. Note the start address of every digital and analog module. The start address is the first byte of the module's PIW/PQW range and is shown in the slot's properties dialog.
2. Open the Symbol Table (Options → Symbol Table) and verify that symbolic names have been uploaded. If empty, you are working with absolute addresses only; rebuild the table from a backup if available.
3. Open the Assignment List (Options → Assignment List). Sort by "Address". Every bit of I and Q that the program touches will be listed with a usage flag. Empty bits are free.
4. Open Cross References (Options → Cross References). Set the filter to "Address". Type an address you expect to exist, e.g. I 4.0. The list will show every block, network and line that touches it.
5. Use the Go To function in the LAD/FBD/STL editor (Edit → Go To → Location or Ctrl+Shift+F5) to jump between references quickly.
6. Use Monitor/Modify (online) to force a PIW/PQW from a peripheral address and confirm the physical wiring. If the LED on the module changes, the addressing is correct even if the bit does not appear in Cross References.
7. If you need bit-level access to large DP I/O fields, build the I/Q buffer DB (Section 7) and copy the entire PIW field in once at OB1 start.

11. Troubleshooting Matrix

12. Field-Commissioning Verification Checklist

After confirming that the I/O list is complete, run the following verification before releasing the station to operations:

1. PI size check: In HW Config, open the CPU properties → Cycle / Clock Memory tab. Note the configured PII and PIQ sizes. They must cover all centrally-installed modules that the program wants to access symbolically.
2. Slot order check: Use HW Config → Station → Check Consistency. The address assignment must be free of overlaps and gaps that are not the user's intent.
3. DP slave scan: From the online view of HW Config, double-click each DP slave. Verify that the slave is reachable (no SF / BF) and that the configured I/O area is identical to the actual slave type.
4. Force / monitor pass: In Monitor / Modify, force each PIW/PQW from the lowest to the highest address and confirm the corresponding LED on the module. Document the test.
5. Cross-reference completeness: Open Cross References with the filter "Address used". The list of I, Q, M, PIW, PQW must be identical to the engineered I/O list. Any discrepancy is a bug.
6. OB1 scan test: Set a breakpoint or use single-scan mode in OB1. Verify that the PII is updated at OB1 start and the PIQ at OB1 end. For modules outside PI, verify that the FC/FB that contains L PIW / T PQW runs every cycle.

13. Notes on S7-400 and ET 200 Distributed I/O

The same addressing model applies, with one important difference: S7-400 has a separate, larger process image, and a configurable PII/PIQ window in HW Config (CPU 41x / 41xH / 416 / 417). For ET 200S / ET 200M / ET 200pro on PROFIBUS DP or PROFINET IO, the slot start address of the head module (IM 153 / IM 154) is what defines the PIW/PQW range. If the slot start address lies above the CPU's PI window, all I/O on the ET 200 must be accessed via PIW/PQW or via the I/Q buffer DB pattern. PROFINET IO devices configured as standard I/O behave identically to PROFIBUS DP for addressing purposes.

14. FAQ