Modifying Siemens S7 PIW Analog Input Values in STEP 7

Engineers commissioning Siemens SIMATIC S7-300 and S7-400 systems frequently encounter a limitation that surprises newcomers: the peripheral input word (PIW) cannot be modified in the same way as an input word (IW) or a data block word (DBW). This article explains why the restriction exists and provides four field-tested methods to override, simulate, or scale analog input values during commissioning, debugging, and Factory Acceptance Testing (FAT).

1. Overview: PIW, IW, and the Process Image

The SIMATIC S7 architecture separates the physical I/O bus from the CPU's internal memory in a way that affects how analog values flow through user programs.

The Process Image is updated at the start of OB1 (or the configured OB for cyclic execution). When you reference PIW512 in your logic, STEP 7 reads the value directly from the analog input module at that instant. When you reference IW512, STEP 7 reads the snapshot of the value captured at the beginning of the cycle.

2. Prerequisites

Before applying any of the methods below, verify the following:

• SIMATIC STEP 7 V5.5 or later (V5.7 recommended) installed and licensed.
• Established online connection to the target CPU (S7-300 CPU 31x or S7-400 CPU 41x/41xH).
• CPU in STOP or RUN-P mode (RUN-P required for online monitor/modify and forcing).
• Hardware configuration uploaded (Station > Upload to PG) so that the symbol table knows the analog module's address range.
• TI-S7 Converting Blocks library present in your program (required for FC105/FC106). Available at: Siemens Support Entry 1489993 - TI-S7 Converting Blocks
• For forcing: S7-400 CPU with firmware that supports peripheral I/O forcing (CPU 414/416/417 from FW V3.0 or higher recommended). See: Siemens - Force function in S7-400

3. Method 1: Modify the Destination DBW (Recommended)

The most reliable engineering approach is to modify the value at the point where it has been transferred out of PIW into your application data block. If the user program executes L PIW512 / T DB1.DBW90, then DB1.DBW90 is the engineering value used downstream and can be written directly.

Step-by-step

1. Open SIMATIC Manager > Blocks and double-click Monitor/Modify Variable Table (VAT) or create a new VAT (Insert > S7 Block > Variable Table).
2. Type the operand in the address column. Use the format DB1.DBW90 or the symbolic name, e.g. "AI_Channel_0_Raw".
3. Right-click the address row and select Monitor to confirm the current value (e.g. 12000 decimal).
4. Switch the column display to Modify (right-click > Modify).
5. Enter the replacement value (e.g. 10000) and choose the format (DEC for signed integer or HEX).
6. Click the Modify button (or press Ctrl+F9) to write the value to the PLC.
7. Verify the value sticks by selecting Monitor All (Ctrl+F5). The display should show 10000 and remain stable until the user logic overwrites it.

4. Method 2: Program-Level Override Switch

For FAT and commissioning scenarios where you need a temporary simulation that survives the OB1 scan, insert an enable bit that gates the PIW transfer. This is the pattern recommended by Siemens application engineering.

Ladder Logic Example

Network 1: Simulation enable
      "SIM_ENABLE"  --| |--------------------------------( S )---
                                                  "SIM_LATCH"

Network 2: Select source
      "SIM_LATCH"                                    "DB1.DBX0.0"
      --| |---------------| |------------------------( S )---
                          |                           
       "PIW512"         "DB1.DBW90"                 
      --[ MOVE ]-------->|                            
                                                    
      "SIM_LATCH"                                   
      --|/--( MOVE "SIM_VALUE" )-->"DB1.DBW90"     

Structured Text Equivalent

IF "SIM_LATCH" THEN
    "DB1.DBW90" := "SIM_VALUE";       // INT - engineering integer 0..27648
ELSE
    "DB1.DBW90" := "PIW512";          // Read peripheral input word
END_IF;

With SIM_LATCH set, you can now modify SIM_VALUE from a VAT or HMI to drive the scaled analog path without touching the live PIW. This satisfies the typical use case raised in field escalations: "I want to test my scale block at 13000 without disconnecting the field wiring."

5. Method 3: Variable Forcing on S7-400

S7-400 CPUs (and S7-300 CPU 319 from FW V3.2 with limitations) support the Force function, which overrides a peripheral or process image variable and holds it regardless of program writes. Force values are stored retentively in the CPU and remain active across power cycles until explicitly released.

Step-by-step

1. Open a VAT in STEP 7.
2. Enter the operand PIW 512 (or IW 512).
3. Right-click > Force. The Force dialog opens.
4. Enter the force value (e.g. W#16#3200 = 12800 decimal) and click Force.
5. The variable appears with a red 'F' marker in online view.
6. To release: right-click > Force > Stop and Release Force.

Reference: Siemens - Force function in S7-400 CPUs and WinCC flexible

6. Method 4: Simulation via PLCSIM

S7-PLCSIM (bundled with STEP 7 Professional) provides a virtual backplane where you can drive PIW values from a simulated input panel. This is the preferred method for offline development and bench testing without risk to field wiring.

1. Start S7-PLCSIM and download your project (target: PLCSIM).
2. Switch PLCSIM to RUN.
3. Open SIMATIC Manager > PLC > Monitor/Modify.
4. Type the PIW address (e.g. PIW 512) and use the Modify column to write your test value.
5. PLCSIM accepts writes to peripheral addresses because the simulator's I/O model is software-defined.

Reference: Siemens - S7-PLCSIM V5.4 SP8 User Manual

7. Working with FC105 SCALE and FC106 UNSCALE

If the underlying engineering task is to convert the raw 0-27648 integer from a 4-20 mA / 0-10 V module into a REAL engineering value (e.g. 0.0-100.0 percent, or 0.0-150.0 °C), Siemens supplies dedicated conversion blocks in the TI-S7 library.

FC105 SCALE call interface

Sample FC105 call in STL

      CALL FC 105
       IN     := PIW512                  // raw 0..27648
       HI_LIM := 1.000000e+02            // 100.0 degC
       LO_LIM := 0.000000e+00            // 0.0 degC
       BIPOLAR:= FALSE
       RET_VAL:= MW200                    // W#16#0000 expected
       OUT    := DB1.DBD100              // REAL scaled value

FC106 UNSCALE (analog output path)

FC106 converts a REAL engineering value back into the raw 0-27648 integer for an analog output (PQW). Use it when driving a proportional valve or variable-speed drive reference.

FC105/FC106 error codes

Reference: Siemens - TI-S7 Converting Blocks (FC105/FC106) documentation

8. Why STEP 7 Refuses to Write to a PIW

When an operator types PIW 512 into a Monitor/Modify table and presses Modify, STEP 7 responds with the message "The address is not a valid operand or is outside the permissible range for this operation." This is not a bug; it is a hard architectural rule.

• Peripheral addresses map directly onto the I/O bus (PROFIBUS DP, PROFINET, or backplane). On S7-300/400, the CPU performs consistency-checked reads only.
• Writes to peripheral outputs are allowed (PQW) because the CPU owns the output side of the bus.
• Writes to peripheral inputs are physically meaningless: the input module drives the bus, the CPU cannot push a value back to the module.

The same logic applies to TIA Portal with S7-300/S7-400 CPUs. The newer S7-1500 family changes this behavior in some cases by allowing watch table writes to I/O addresses through the optimized process image, but S7-300/400 retain the original restriction.

9. Commissioning Procedure for Analog Input Override

The following 10-step procedure is field-proven for brownfield retrofits where the analog sensor must be electrically isolated while the control logic is validated.

1. Document the original PIW address, scaling, and engineering range in the commissioning plan.
2. Insert the simulation-enable block (Method 2) in OB1 above the FC105 call. Compile and download to the CPU.
3. Switch the CPU to STOP and verify the new block is loaded (online > block comparison).
4. Place the CPU in RUN-P and open the VAT containing SIM_ENABLE, SIM_VALUE, and DB1.DBW90.
5. Set SIM_ENABLE = TRUE. Confirm DB1.DBW90 now mirrors SIM_VALUE.
6. Step SIM_VALUE through 0, 13824 (50%), 27648 (100%), and 30000 (over-range) to validate FC105 clamping.
7. Capture HMI/PID response curves at each setpoint.
8. Reset SIM_ENABLE = FALSE and verify DB1.DBW90 reverts to the live PIW.
9. If force was used (S7-400), execute Force > Stop and Release Force and verify the 'F' markers disappear.
10. Sign off the commissioning checklist with the override removed from active control.

10. Troubleshooting Matrix

11. Verification Checklist

Before declaring the analog input path commissioning complete, confirm each item:

• PIW raw value matches the engineering signal generator at 0%, 25%, 50%, 75%, 100%, 110%.
• FC105 RET_VAL = W#16#0000 at each test point.
• FC106 round-trip error < 1 LSB.
• Simulation switch returns control to PIW path with no residual force.
• HMI tag reflects the scaled REAL value within one scan of the PIW change.
• No 'F' force markers visible in any VAT.
• Commissioning log signed by both commissioning engineer and operations lead.

12. Edge Cases and Field Notes

Distributed I/O on PROFIBUS

If PIW512 belongs to an ET200M or ET200S station on PROFIBUS DP, the peripheral address still cannot be modified directly. However, you can write to the input bytes in the DP slave's process image if the slave is configured with a process image slot. For PROFINET IO, the same rule applies: %IW512 in TIA Portal behaves like PIW512 on S7-300/400.

Consistent Data Access with SFC14/SFC15

For analog modules longer than one word (4-byte consistency, e.g. 6ES7 331-1KF02 modules), use DPRD_DAT (SFC14) to read the peripheral area consistently into a DB. The destination DBW can then be modified. Reference: Siemens - Consistent data access with SFC14/15

Isochronous Mode

If the analog module is configured isochronously (OB61-OB64 with Ti/To synchronization), the peripheral value updates with deterministic timing. Avoid overwriting the scaled value while isochronous interrupts are firing - this can cause cycle-time overruns and OB85 errors.

Mixing S7-300 and S7-400 in a Project

Force values applied to a shared PROFINET device affect only the CPU that issued the force. If your project includes an S7-400 H-station, both CPUs must independently stop and release force before the variable returns to physical behavior.