Monitoring PQW Analog Outputs in Siemens S7 VAT Tables

The Problem: PQW Values Cannot Be Monitored in a VAT

When commissioning an S7-300, S7-400, or compatible S7-1200/1500 project, an engineer typically opens a Variable Table (VAT) and types PQW300 expecting to observe the current value being driven to an analog output module. The watch table returns ---, an asterisk pattern, or a status indicating the value cannot be read. The same is true for PQ byte and PQD double-word references.

Symptom summary:

• Reading PIW in a VAT works without issue and returns the live value from the input module.
• Reading PQW in the same VAT returns ----- or an error indicator; no numeric value is displayed.
• Writing PQW from the VAT works correctly and the actuator responds, but the forced value cannot be displayed back.
• Bit-level PAW, PQB, and PQD aliases behave identically.

This is not a project bug or a defective signal module. It is a fundamental property of the S7 peripheral-access model and the bus cycle architecture of PROFIBUS DP and PROFINET IO.

Root Cause: Why PIW Reads and PQW Reads Behave Differently

The PIW/PQW operand prefix (Peripherie-Eingang/Ausgang) tells the CPU to access the module hardware directly through the backplane bus or field-bus (PROFIBUS DP / PROFINET IO). The CPU does not maintain a shadow copy of PQW values because outputs are write-only from the application's perspective.

When the user program executes L PIW 300, the CPU issues a read on the peripheral backplane and the input module returns the converted analog value. When the user program executes T PQW 300, the CPU issues a write to the output module and the value latches at the DAC.

Reading PQW 300 in a VAT forces the same peripheral read. The peripheral interface only supports read on input modules and write on output modules. There is no read-back path from a write-only output channel, so the result is undefined.

In contrast, QW, QW30, and QW256 address the process image output area (PAE/PAA), which is a memory mirror the CPU updates from your program each OB1 cycle. Because the mirror is read/write, VAT monitoring works.

This distinction is documented in the SIMATIC S7 programming reference and is the root cause of every variation of this question.

The S7 Process Image Architecture

The CPU maintains two process-image tables in work memory:

• Process Image of the Inputs (PII) — refreshed from input modules at the start of each OB1 cycle.
• Process Image of the Outputs (PIQ) — written to output modules at the end of each OB1 cycle.

Addresses inside the PII/PIQ are referred to as I/QW, IB/QB, ID/QD (no P prefix). Addresses outside the configured process image fall through to peripheral access (PIW/PQW).

For VAT monitoring and forcing to work on outputs, the address must be inside the configured process image. Forcing the value through the VAT updates the PII/PIQ mirror, and the user program reads the new value next cycle.

Watch tables, also called Variable Tables in STEP 7, are the standard tool for monitoring and modifying values while the CPU is in RUN or RUN-P. The official TIA Portal documentation describes watch tables as the mechanism to "perform monitoring and control functions on data points as the CPU executes your program." The same limitations on PQW read-back apply in TIA Portal as in STEP 7 Classic. See the SIMATIC S7-1200 manual collection — Watch tables for monitoring the user program for the official description.

Workaround 1: Mirror the PQW to a Memory Word (MW)

This is the fastest, lowest-risk fix and is the universal answer when you cannot modify the hardware configuration.

Principle: every time the program writes to the peripheral output, also write the same value to a marker word in the bit-memory (M) area, a data block (DB), or a temporary area you keep in a global DB for diagnostics.

ST example (SCL):

// FB or OB1
// Drive the analog output
#raw_output := #scaled_value;             // INT, e.g. 0..27648
T  PQW 300;                                // physical write to module
T  MW  200;                                // mirror for VAT monitoring

Ladder example (FBD/ST equivalent):

|    scaled_value    |    PQW300            |
|-----[ MOVE ]------------------( )-----------|
|                                     MW200  |

Monitor in VAT:

Address    Symbol    Display    Modify
MW 200    AO_mirror  ...        0..27648

The MW copy always shows the last value the CPU attempted to output. Because the mirror and the peripheral write happen back-to-back in the same network, you are guaranteed temporal consistency within the cycle.

Disadvantages:

• Doubles the byte count of the instruction.
• If anyone changes the PQW value from another source (HMI forced write, another FB, a second VAT), the MW mirror may go out of sync.
• You do not see the value the module actually converts — only what the CPU wrote. Watch for fieldbus retries, slave diagnostics, or channel faults that could suppress the output even though the MW shows a value.

Workaround 2: Move the PQW Into the Process Image (Recommended)

This is the long-term, "do it once" fix. The CPU mirrors outputs to the process image, the user program reads/writes that mirror, and VAT reads/writes the same mirror.

The procedure depends on the configuration tool you use.

STEP 7 Classic (S7-300/S7-400)

1. Open the SIMATIC Manager and your S7 project.
2. Open HW Config for the station containing the CPU.
3. Double-click the analog output module in the rack or PROFINET/PROFIBUS slave view.
4. Note the current I/O addresses — e.g. PQW 300..303 for one 4-channel AO module.
5. Open the Properties dialog and select the Addresses tab.
6. Uncheck "Process image" for the current range, then re-enter the starting address inside the configured process image — e.g. QW 30 instead of PQW 300.
7. Click OK, then save and recompile (Station → Save and Compile).
8. Download the hardware configuration to the CPU (target system must be in STOP or RUN-P with appropriate privilege).
9. Open your VAT and replace PQW300 with QW30. The value now displays live and can be forced.

Repeat for every analog output module that needs to be monitored. Once inside the process image, your FBD/LAD/SCL programs may continue to use the QW operand (or you can keep PQW if the address still falls inside the process image — the CPU accepts both forms for the same address).

TIA Portal (S7-1200 / S7-1500 / S7-300/400 compatible)

1. Open the project and navigate to Devices & Networks.
2. Select the analog output module in the device view or network view.
3. Open Properties → I/O addresses.
4. Clear "Process image" in the drop-down if it shows "None", or set the start address to a value inside the CPU's process image range.
5. Compile the hardware configuration (Compile → Hardware (rebuild all)).
6. Download to the PLC.
7. In the watch table, monitor %QW30 (absolute) or the symbolic tag.

Process Image Size by CPU Family

The maximum address range that can live inside the process image depends on the CPU. If your analog output module's addresses exceed the configured size, the CPU falls back to peripheral access and the PQW read-back issue returns.

Confirm exact limits in the datasheet for your specific CPU order number (e.g. 6ES7 315-2EH14-0AB0). When the configured process image is too small for your AO addresses, you have three options:

1. Enlarge the process image (if the CPU supports it and free work memory allows).
2. Re-slot the module to a lower address range.
3. Use Workaround 1 (MW mirror).

When to Use Which Workaround

Step-by-Step Verification Procedure

After applying either workaround, verify the result end-to-end before signing off on commissioning.

1. Confirm the operand is in the process image. In STEP 7, hover the address in the editor or check HW Config → module Properties → Addresses tab. In TIA Portal, inspect the I/O addresses tab of the device.
2. Open the VAT / watch table and connect to the target CPU. Establish an online connection. The status column should show green "Monitored".
3. Force the value. Enter 12345 in the Modify column for QW30 (or MW200 for the mirror). Apply with the "Modify now" or "Modify once" button.
4. Observe the field device. Measure the analog output with a calibrated multimeter or HART communicator. The reading should match the forced value within module tolerance (typically ±0.5% of full scale).
5. Read back the value in the same VAT. The Display column must show the forced value. If it shows dashes, the address is still outside the process image.
6. Stop forcing and confirm the program drives the value. Switch the CPU from "Force" to "Monitor" mode. The user program should overwrite the VAT-forced value on the next OB1 cycle.
7. Capture a sequence (trace). For intermittent issues, record the MW mirror with the S7 Trace / TIA Trace function. This is invaluable when debugging PID loops or valve-positioning ramps.

Edge Cases and Field-Proven Caveats

OB1 process image update only — OB3x interrupt priority: Outputs written inside a time-of-day interrupt (OB10) or cyclic interrupt (OB30..OB38) update the peripheral module immediately. The process image is only refreshed by OB1 at its next scan. If your VAT reads QW30 but the AO is being driven from OB35, you will see the OB1 value, not the OB35 value.

Partial process image update with SFC 26 / SFC 27: Calling UPDAT_PI / UPDAT_PO from the program updates only the specified slice. When MW mirroring is used together with these SFCs, be aware that the MW mirror is updated by your MOVE, not by the SFC, so order of operations matters in OB100 (startup).

PROFINET IRT and isochronous mode: Outputs in the isochronous data area are written from the IRT cycle, not OB1. Even if the address is in the process image, the value you read in the VAT is the OB1 cycle value, not the deterministic IRT value. Use Trace for true verification.

Shared outputs on PROFIsafe / F-modules: Do not mirror F-outputs to MW for monitoring; the safety stack manages passivation and read-back through certified channels. An MW mirror can mislead commissioning engineers into believing a channel is active when the F-CPU has passivated it.

HMI / WinCC tag binding: When the HMI polls PQW300, it typically gets the last CPU-written value via OPC DA/UA or the S7 protocol. WinCC does not suffer from the same read limitation as VAT because the driver reads the variable area differently. If your HMI shows the value but the VAT does not, the underlying cause is the same: HMI drivers use the process image by preference, VAT insists on peripheral access for prefixed operands.

Symbolic vs absolute addresses: Always bind the symbolic tag to QW30 rather than PQW300 once the address is inside the process image. Otherwise the cross-reference and watch-table entries become inconsistent.

Project migration STEP 7 → TIA Portal: A migrated project may retain PQW operands. TIA Portal's compiler will warn on every peripheral-output reference because the optimal address form is %QW. Treat the warnings as a checklist: re-address each PQW inside the process image or insert the MW mirror.

Diagnostic Reference: Status Codes in the VAT

Programmatic Equivalent: Reading the Value Without a VAT

If you need to read the last-written AO value programmatically — for example to log it to a historian, or feed it to a supervisory block — the same workaround applies. Mirror in a DB so it is retained across cycles and survives restart OB100.

// FB "AO_Drive"
VAR
  scaled_value : INT;       // -27648..27648 (S7 AO range)
  raw_out      : WORD;
END_VAR
BEGIN
  // Scale, clamp, and ramp logic here ...
  raw_out := INT_TO_WORD(scaled_value);

  // Physical write
  T PQW 300;

  // Mirror for diagnostics / VAT / HMI
  "ao_db".last_raw := raw_out;
  "ao_db".last_scaled := scaled_value;
  "ao_db".timestamp := WORD_TO_INT(%EW0); // system time low word
END_FUNCTION_BLOCK

Reading "ao_db".last_raw in the VAT gives you everything the PQW would have shown, plus a timestamp, plus a place to add engineering units and status flags.

Summary Checklist

• Identify the failing address — confirm it is prefixed with P (peripheral access).
• Decide between the two workarounds based on whether the hardware configuration can be edited.
• Re-address the module so its I/O range falls inside the configured process image, or insert an MW/DB mirror next to every T PQW.
• Recompile, download, and verify in the VAT with a forced value + multimeter on the field terminals.
• Update the project documentation so future engineers know whether QW or PQW is in use and why.
• For PROFINET devices with locked I/O mapping, or F-CPU outputs, retain the MW mirror and never rely on it for safety.