Fixing S7-1200 I/O Write Access Error Q Address 262 in OB 30

1. Problem Summary

A SIMATIC S7-1200 CPU can raise the diagnostic event "Temporary CPU error: I/O write access error (Q address 262) in OB 30 affecting OB 30 execution. Incorrect address, operand ignored. Processing will continue (no OB processing)" when a write instruction inside the cyclic interrupt OB 30 targets an output byte that the controller cannot physically reach. The CPU does not transition to STOP. Instead, it discards the offending write, flags the event in the diagnostic buffer, lights the SF (system fault) LED on the affected module and on the CPU front panel, and continues scanning the remaining program organization blocks. The affected OB 30 cycle is aborted for that pass, so the cyclic time-shared logic on that interrupt is silently dropped, while OB 1 and any other OBs keep running.

This article documents the root cause, the diagnostic event structure, the exact TIA Portal procedure to recover the controller, and the verification steps to confirm the error is gone. The methodology applies to the entire S7-1200 family (CPU 1211C / 1212C / 1214C / 1215C / 1217C and the F-variant fail-safe versions) running firmware V4.0 through V4.6, with TIA Portal V13 SP1 through V18.

2. Anatomy of the Diagnostic Event

The message is a single diagnostic event recorded by the CPU's online diagnostics system. Every word in the string has a precise meaning in the Siemens diagnostic schema. The fields, in order, are:

The corresponding diagnostic event ID in the buffer is typically 0x4572 (I/O access error when writing) with the IO access trigger class set to "Peripheral access error on write". The same buffer entry shows the slot, channel, and rack. Capturing this entry before any rebuild is the fastest path to root cause.

3. Root Cause Analysis

In more than 90% of the field cases seen on the S7-1200 platform, the diagnostic event at QB262 is the symptom of one of three configuration problems:

1. Hardware configuration in TIA Portal does not match the physically mounted module. The project tree declares an analog output module at a starting address that the real backplane does not have. The CPU still evaluates the ladder/ST code because the project compiles, but the write to a non-existent slot returns an access error.
2. The starting address of the analog module was changed in the device configuration (e.g. shifted from QW0 to QW256 to free room for a digital SM) but the OB 30 code was not updated. The code writes the absolute address the developer originally keyed in, while the module now lives elsewhere in the address map.
3. A module was removed or replaced with a different catalog number (e.g. SM 1232 AO2 swapped for SM 1231 AI4) and the device configuration was never refreshed. The analog input module has no output channels, so writes to its assigned output range produce "Incorrect address".

A fourth, less common cause is a hot-swap or backplane fault: a SM pulled while the CPU is in RUN, or a loose connector on the SM front terminal block. The diagnostic buffer entry will then show an additional Module failure (0x4570 / 0x4571) preceding the access error.

4. S7-1200 Process Image and I/O Address Map

Every S7-1200 CPU maintains an automatic process image that the operating system refreshes once per OB 1 cycle. Inputs are read from the modules into the process image input (PII) at the start of OB 1; outputs are written from the process image output (PIQ) to the modules at the end of OB 1. The default partition size is 1024 bytes per direction.

Byte 262 of the output process image sits in the second half of the default partition. If the project uses only a single SM 1232 AO2 (catalog 6ES7232-4HB32-0XB0) with default start address QW0, the module will only physically claim bytes QB0 – QB7. Writing to QB262 therefore has no hardware destination unless the project tree contains a module that has been re-assigned to that address range. This is exactly the case that produces the diagnostic event at hand.

To inspect the address map, in TIA Portal right-click the CPU in the device tree and choose Properties > General > IO addresses. The right-hand pane lists every configured module, its slot, its start address, and its length. Cross-check this list against the real backplane.

5. Cyclic Interrupt OB 30 Execution Context

OB 30 is one of four cyclic interrupt OBs that the S7-1200 supports (OB 30, OB 31, OB 32, OB 33, OB 34, OB 35, OB 36, OB 37, OB 38). Unlike OB 1, which is free-running, a cyclic interrupt OB is launched at a fixed time interval independent of OB 1. The default phase times are:

The phase and priority are edited in Device configuration > CPU > Properties > Cyclic interrupts. Because OB 30 runs at a higher priority than OB 1, an I/O access error inside OB 30 will not stop OB 1. However, OB 30 itself is dropped for that cycle – a subtle but real loss of determinism, especially in control loops where OB 30 is driving a closed-loop PID or a fast analog output refresh.

Open the OB 30 source, search for the absolute output reference %QB262 (or, in classic editor view, QB262). The instruction feeding that address is the candidate root cause. Typical patterns include:

// OB 30 - 1000 ms cyclic interrupt
IF "HMI.bCmd_SetOutput" THEN
    "Analog_out" := "Recipe.rSetpoint";   // symbolic
    %QB262 := 16#0000;                    // absolute: PII/PIQ update target
END_IF;

If the symbolic tag "Analog_out" is mapped to QB262 but the hardware configuration no longer has a module at that address, the error fires every cycle the IF branch is true.

6. Affected Hardware and Software Configurations

The error is firmware-agnostic: it is generated by the same I/O access check that has shipped in S7-1200 since the platform launch. The recovery procedure, however, changed slightly with the introduction of Download to device as a single-step hardware sync in TIA Portal V14 SP1. Both flows are described in the steps that follow.

7. Step-by-Step Resolution Procedure

1. Stop the controller to RUN-mode output of the failing program path. Open the project in TIA Portal, go online, and set the CPU to STOP via Online > CPU operating panel > Stop (STOP). This stops the OB 30 write attempts and prevents the diagnostic buffer from rolling over.
2. Export the diagnostic buffer before anything else. In the project tree, expand Online > Diagnostics > Diagnostics buffer. Right-click the topmost I/O write access error entry and choose Export.... Save the file as diag_buffer_export.csv. The timestamp, the OB context (OB 30), the address (Q 262), and the event ID (0x4572) are needed for the root-cause record.
3. Open the device configuration view. Double-click Device > PLC_1 > Device configuration in the project tree. The slot table appears.
4. Compare the slot table against the real backplane. For every SM in the project, verify the catalog number, the firmware version, and the start address. The most common mismatch is an SM 1232 AO2 sitting at QW0 in the project while the real module is at QW256 in the backplane, or vice versa.
5. Re-align the project with the real backplane. If the project has a module that is not physically present, delete the entry. If a module is missing from the project, drag the correct signal board or signal module from the hardware catalog into the slot. Assign the correct input/output start address to match the rest of the program.
6. Compile the project. Right-click the PLC and choose Compile > Hardware (rebuild all). Resolve any compile warnings about address conflicts; these often flag the very byte that OB 30 is writing to.
7. Download the hardware configuration only. Right-click the PLC in the project tree and choose Download to device > Hardware configuration. This downloads the slot table and the address map to the CPU without disturbing the current OB 1 / OB 30 code. The CPU stays in STOP during the download and re-enters RUN when the download finishes (assuming the configuration is consistent).
8. Re-compile the user program and download the software. Right-click the PLC and choose Download to device > Software (all blocks). This overwrites the OB 30 code if you changed it, and refreshes the symbolic-to-absolute address bindings.
9. Restart the CPU. Use the operating panel: Online > CPU operating panel > Run (RUN). Watch the diagnostic buffer for fresh entries.
10. Verify the SF LED goes off on the CPU and on every SM. The BF (bus fault) LED may flash briefly during restart; if it stays on, there is a separate issue.

8. Hardware Reconfiguration Method

Open Device configuration and zoom in on the rack. The S7-1200 accepts the following slot positions:

• CPU bay (slot 0): the CPU itself, fixed.
• Signal board (right of CPU): SB 1231, SB 1232, SB 1223, SB 1231 TC, SB 1231 RTD – max one per CPU.
• Slots 1–8 (left of CPU when wiring, but addressed 1–8 from the project): SM 1223, SM 1231, SM 1232, SM 1234, CM 1241, CP 1243, etc. Up to 8 signal modules per CPU; CPU 1211C is limited to 1, CPU 1212C to 1, CPU 1214C to 8, CPU 1215C/1217C to 8.

To fix the address binding, click the module, open Properties > IO addresses, and edit the start address. The dialog validates that no other module overlaps the chosen range. The two recommended approaches are:

Symbolic addressing is strongly preferred over absolute addressing for cyclic interrupt code. The only place an absolute address should appear in a multi-SM project is in a per-module UDT (user-defined data type) that is bound to the actual I/O start address; the rest of the program should consume the symbolic name. This makes the QB262-class fault self-correcting the next time the SM is re-addressed.

9. Downloading Hardware to Device

The Download to device wizard is the single most reliable cure for the QB262 diagnostic event. The wizard is reachable from three places:

• Project tree → right-click PLC_1 → Download to device > Hardware configuration.
• Menu Online > Download to device.
• Toolbar lightning-bolt icon (⚡) in the online toolbar.

Step-by-step:

1. Select the PG/PC interface type (e.g. PN/IE).
2. Select the network interface (e.g. Intel(R) Ethernet Connection I219-V).
3. Click Start search. The wizard broadcasts a DCP discovery packet on the subnet and lists every reachable S7-1200 with its MAC, IP, firmware, and slot count.
4. Select the target device, click Load.
5. Choose Download to device > Hardware configuration only (the Software option is also available; pick Hardware for this fix).
6. Confirm the overwrite prompt – the CPU will stay in STOP throughout the download.
7. Watch the Result pane. A green check means the slot table was accepted; a red cross means a firmware mismatch or a topology mismatch (e.g. an SM present on the backplane but absent in the project).

When the download finishes, restart the CPU. Within one OB 1 cycle, the diagnostic buffer will show a Startup of CPU event followed by the first End of startup event. The QB262 entry should not reappear. If it does, repeat the comparison step; the most likely cause is a second SM still misaligned.

10. Verification and Validation

After the download, validate that the diagnostic event is gone. The verification checklist is:

1. Diagnostic buffer is clean. Open Online > Diagnostics > Diagnostics buffer and look for any new entry with the text I/O access error or 0x4572. There should be none since the restart.
2. SF LED is off on the CPU and on every SM. The CPU's SF LED is the right-most of the three top-row LEDs (RUN / STOP / ERROR). On the SM 1231/1232/1234 modules, the SF LED is the rightmost LED on the front label.
3. Force the OB 30 path. From TIA Portal, use Online > Watch & force > Force on the Boolean that enables the OB 30 write (e.g. HMI.bCmd_SetOutput). Watch the QB262 value in the monitor; it should now hold the expected integer.
4. Cycle count of OB 30. Add a tag of type DInt named OB30_Counter in OB 30 and increment it every scan. In Watch table, confirm that the counter increases at the configured phase (e.g. once per 1000 ms for default OB 30).
5. Web server diagnostic page. Browse to http://<cpu-ip>/diag/buffer (S7-1200 with web server enabled). The page mirrors the TIA Portal diagnostic buffer; the QB262 event should not appear here either.

11. Diagnostic Buffer Analysis in TIA Portal

The diagnostic buffer is a ring buffer of timestamped events. The S7-1200 retains the last 50 events by default; older events are overwritten. To inspect, navigate to Online > Online & diagnostics, then select the Diagnostics buffer tab. The columns are:

Right-click any event and choose Open in editor to jump to the block that triggered the access. The Save as... action exports the entire buffer to a CSV file for archival; this is the file the original poster attached to the thread as the "Diagnostic file". Keep this CSV with the project backup; it is the audit trail that proves the error was resolved and the timestamp of the fix.

For S7-1200 firmware V4.4 and later, the buffer entry for QB262 also lists the rack (always 0) and the slot (the SM slot number 1–8). A slot number of 255 means the address is outside any configured module – the classic signature of a misaligned hardware configuration.

12. Prevention and Best Practices

1. Adopt symbolic addressing for cyclic OBs. Bind the analog output to a tag named AO_Slot1_Ch0 and set the tag's address in the PLC tag table, not in the OB 30 code. A re-mapping of the SM never touches the program.
2. Lock the slot table with a project-level comment. Right-click each SM in the device configuration, add a comment with the real backplane slot, the catalog number, and the start address. Future maintainers will see the comment when they right-click the module.
3. Use TIA Portal project version control. Every change to the device configuration must be checked into the project repository. The most common cause of this fault is an offline-only change to the slot table that was never downloaded.
4. Run the consistency check before every download. The wizard's Consistency check step compares the project with the online station. Treat any inconsistency as a hard error, not a warning.
5. Keep the diagnostic buffer export under version control. Add the diag_buffer_export.csv to the project's Documents folder; a quick diff between the before and after the fix proves the event is gone.
6. Use the web server for remote health checks. With the S7-1200 web server enabled and a small embedded dashboard, the diagnostic buffer can be checked without a TIA Portal connection – useful for unmanned panels.

13. Related Errors and Cross-References

The QB262 error is one of a family of non-fatal I/O access events. The other common ones, and their triggers, are:

For background on the S7-1200 diagnostic architecture, see the SIMATIC S7-1200 Programmable Controller System Manual (Siemens ID 109751826) and the S7-1200 Easy Book (Siemens ID 109478121). For the OB 30 cycle time and priority table, see chapter 6.5 of the System Manual. For TIA Portal Online & diagnostics, see the STEP 7 Professional V18 Programming and Operating Manual (Siemens ID 109773720). For the official procedure on Download to device > Hardware configuration, see the Downloading to a Target Device help page (Siemens ID 109798671).

14. Frequently Asked Questions