Recovering S7-317 PQW Outputs on Wago PROFIBUS Remote I/O

1. Problem Context: Symptom Set on a Mobile Rig

A Siemens SIMATIC S7-317 (CPU 317-2 PN/DP or equivalent) operates a mobile oil and gas drilling installation with PROFIBUS-DP backbones linking the central PLC to Wago 750-series remote I/O stations and a population of ASTRO MVFDs (Variable Frequency Drives) used for motor control. The PLC and its third-party interfaces exchange speed reference, torque, RPM, and motor status across PROFIBUS, with two dedicated 4–20 mA analog output channels duplicating RPM and torque for downstream contractor instrumentation.

After a rig move, power-down, transport, and recommissioning cycle, one of the redundant analog output cards stopped driving current even though the slot's hardware configuration still listed it as healthy. The fault surface narrowed to the following observable symptoms:

• The Wago 750-552 analog output module is present on the PROFIBUS network and reports no diagnostic interrupt from the master.
• STEP 7 (or TIA Portal) HW Config still shows the slots mapped to PQW 292 and PQW 294 on the suspect module, and PQW 276 / PQW 278 on the adjacent (working) module.
• The Cross-Reference (Ctrl+Alt+F7) listing in the offline program contains roughly 60 PIW/PQW addresses, but the four AO addresses for these channels do not appear in the list at all.
• A variable table (VAT) with these PQW addresses forces successfully but the Status column displays "not monitorable" rather than a numeric word.
• The current loop at the field terminals measures a stable 4.000 mA (zero scale) on all four channels, regardless of what value is forced into the PQW.
• Replacing the Wago AO module with a spare of the same catalog number (e.g., 750-552) does not restore operation.

This symptom cluster is the diagnostic fingerprint of a problem class that the S7-300 platform handles in a way that confuses most engineers the first time they encounter it: indirect or symbolic addressing of peripheral outputs.

2. S7-300 PQW/PIW Addressing Fundamentals

The S7-300 input/output address space is divided into two regions: the process image (I/Q area, addressable as I/QB/QW) and the peripheral area (addressable as PIB/PIW/PQB/PQW or, in German mnemonics, PEB/PAW).

For distributed I/O over PROFIBUS-DP (and PROFINET IO), every input byte is mapped into both the peripheral area and a mirror in the process image. The process image is refreshed once per OB1 scan — at the start of OB1 the inputs are read into the I-area (PII) and at the end of OB1 the Q-area (PIQ) is written to the outputs. Peripheral accesses (PIW/PQW) bypass the process image entirely: each instruction reads or writes directly to the DP slave at execution time. This has two practical consequences:

1. Peripheral outputs are not subject to the OB1 process-image commit phase. A program that uses PQW writes the value to the slave the instant the instruction executes, regardless of where in OB1 (or in which OB) the write occurs.
2. Because the value is written directly to the bus, STEP 7's static cross-reference analyzer — which works on the symbolic and direct address graph of the compiled block — cannot detect writes that use a computed address pointer in AR1 or AR2. The analyzer sees T PQW [AR1,P#0.0] as a generic peripheral write with no specific address.

3. Why PQWs Disappear from the Cross-Reference

The STEP 7 cross-reference tool (and the equivalent "Go to usage location" in TIA Portal) operates on the symbolic and direct-address references stored in the offline block container. It indexes three reference types:

• Direct symbolic references: e.g., L "MotorSpeedRPM" → T PQW 292. These are indexed normally.
• Direct but parameter-passed references: an FC's IN/OUT/IN_OUT parameter typed as WORD or INT that the caller binds to a PQW via the call interface. These are not indexed under the PQW but appear in the FC's parameter view.
• Indirect references: any pointer arithmetic through AR1, AR2, DBW [DIW/DID], or a multi-instance pointer. These are completely invisible to the cross-reference tool.

The original authors of this rig's control code almost certainly used the third form to write the AO channels. A pointer is built in AR1 at run time and the analog value is moved with a single indirect store. This pattern is common on mobile drilling installations where the same FB is reused for many pumps and the output address is passed as a parameter or held in a configuration DB.

4. Indirect Addressing Patterns in S7-300 STL

The following reference snippet, drawn directly from the standard S7 indirect-peripheral-output idiom, illustrates the technique:

// Build a 32-bit pointer to the peripheral word to be written
L P#292.0          // Load area-internal pointer for PQW 292
LAR1               // Move pointer into address register 1

// (Optional: arithmetic on AR1 if the address is computed)
// +AR1  P#2.0      // would advance to PQW 294

// Load the value to be output (RPM or torque scaled to 0–27648)
L  #rPercent        // e.g. INT 0..100 or scaled engineering value

// Write to peripheral output through pointer
T PQW [AR1, P#0.0] // Store ACCU1 to PQW pointed at by AR1

Variants you will encounter on real installations:

The single most important consequence: a missing cross-reference entry is not evidence of absence of the write. The CPU may be writing PQW 292 every 10 ms and STEP 7 still cannot find it. Always treat the cross-reference as a subset of all real references.

5. PROFIBUS Remote I/O and the Wago 750-552 Module

The Wago I/O System 750 is a modular, fieldbus-agnostic remote I/O family that connects to PROFIBUS-DP through a Wago 750-3xx fieldbus coupler (e.g., 750-333 for PROFIBUS-DP, 750-343 for PROFINET, or 750-362 for PROFIBUS-DP with DPV1 diagnostics). The coupler is the DP slave; the analog, digital, and special-function modules downstream are internal to the coupler and are addressed as part of its process image.

For 4–20 mA outputs in this rig's configuration, the typical module is the Wago 750-552 (2-channel, 0–20 mA / 4–20 mA, 12-bit, configurable per channel). The 750-552 occupies 2 output words in the coupler's process image, and these are mapped into the CPU's peripheral output area at the slot offset computed by HW Config.

When STEP 7 places the 750-552 at slot 5 of the remote I/O node, it assigns two consecutive PQWs in the peripheral output area. The exact numerical value depends on the size and slot positions of all preceding slaves on the PROFIBUS subnet — for this rig, the addresses land at 292 and 294. That 292/294 pair and the working 276/278 pair are two physically distinct Wago AO modules sitting in adjacent slots of the same coupler.

6. Tracing PQW 292 / PQW 294 to Their Source: Step-by-Step Procedure

Use the following diagnostic workflow when a PQW does not appear in the cross-reference and the field loop reads 4 mA regardless of force value.

6.1 Verify the hardware is actually present and healthy

1. Open STEP 7 / TIA Portal and go online to the CPU.
2. In HW Config → Module Information on the suspect slot, confirm:
   • Module status = OK (no red X).
   • Diagnostic interrupt buffer is empty for that slot.
   • The I/O addresses displayed match the offline configuration (PQW 292 / PQW 294).
3. From the Monitor/Modify tool, force a value (e.g., W#16#6C00 = 27648 decimal = 20 mA). If the field current does not change, the issue is in the bus path, not the program.

6.2 Confirm whether the CPU is actually writing to PQW 292/294 at runtime

Use the VAT to read what the program is producing. Note the discrepancy first: the VAT's "not monitorable" message means the address is not bound to a static symbol in the offline program. There are two practical workarounds:

• Insert a temporary symbol. In the symbol table, add a row: PQW292 → AO_RPM_MIRROR (WORD). Save, then re-open the VAT. The status column will now show a numeric value updating each cycle if the CPU is writing.
• Use the SFC 14 / SFC 15 direct read of the DP slave's I/O data. This is the most authoritative test.

6.3 Find the indirect writer

1. From the SIMATIC Manager / project tree, generate source for all blocks (File → Generate Source → All blocks). If the project is too large to upload in a single ZIP, regenerate the source from the offline project on the engineering station.
2. Open the generated STL source and search globally for the string PQW or PAW. Each match is a candidate. Mark every site where PQW is used on the right-hand side of an assignment.
3. For each indirect site, identify the source of the pointer:
   • If the pointer is loaded from a literal (LAR1 P#292.0 or L P#292.0; LAR1), the writer is fixed.
   • If the pointer comes from a data block (e.g., L DB100.DBD0; LAR1), open that DB and inspect its contents — the AO pointer is almost certainly a configuration entry written once during commissioning.
   • If the pointer comes from a block parameter, trace back through the call chain to find which FC/FB call passes the PQW pointer.
4. For indexed-loop writes, search for the loop control variable and the array of PQW pointers it steps through.

6.4 Check that the pointer target is the suspect slot, not a stale address

The most common cause of an AO "no longer working" after a rig move is hardware re-mapping after a module replacement. If a DP slave was swapped during the move, HW Config may re-assign the process-image offsets, but the configuration DB still holds the pre-move pointer (e.g., P#292.0 from the old mapping). The writer dutifully writes to the new address, and the old slot sits at 4 mA.

1. Compare the offline HW Config PQW assignments to the online ones (via HW Config → Upload Station to PG on the live PROFIBUS). If they differ, the project is stale.
2. If the offline project came from a re-download after the move, the pointer DB may still hold the old value. Compare each pointer literal in the configuration DB against the live mapping.

6.5 Watch the writer online

1. Open the FC/FB identified in step 6.3 in online view.
2. Set a break-point on the line T PQW [AR1,P#0.0].
3. Single-cycle the CPU and inspect AR1 in the Monitor view. The pointer must equal P#292.0 for the RPM channel and P#294.0 for torque.
4. Inspect the value in ACCU1 (L stack). It must be a non-zero, scaled engineering value (e.g., 0–27648).

7. Why the Wago Module Replacement Did Not Restore Operation

Swapping the 750-552 module is a sound first-line diagnostic when 4 mA appears at the terminals regardless of forced value. However, in this case the module replacement did not change anything because the CPU was never writing to the suspect slot — the field current was the AO module's safe-state value (4 mA = zero of the 4–20 mA range) being driven by the module's own power-on default, not by the program.

The investigation has to move up the stack from hardware to the application program. The fix is one of three patterns, depending on what step 6.3 reveals:

8. Re-Commissioning Procedure After a Mobile Rig Move

Mobile installations are particularly exposed to this class of fault because the disconnect/transport/reconnect cycle disrupts several of the conditions that mask it on a fixed plant:

1. Re-verify the PROFIBUS topology with a bus tester (e.g., Siemens BT 200 or any PROFIBUS analyzer). Check that every node responds, that there are no reflection or shorted-segment issues, and that the bus terminator is enabled at both ends only.
2. Upload the live program from the CPU before doing any offline work. This is your only authoritative snapshot of the as-running state. File → As Station → Upload to PG. Compare timestamps of all blocks against the offline project.
3. Compare HW Config: offline HW Config (the project's master) must match the live DP slave configuration. If there is any discrepancy, the master is wrong.
4. Generate source for all blocks and search for PQW / PAW / P# literals. Build a complete map of which logical signal writes to which physical PQW.
5. Validate the configuration DB: every peripheral pointer in the configuration DB must point to a slot that physically exists in the live HW Config. If the slot mapping changed, every pointer must be re-baselined.
6. Drive each AO channel end-to-end: force a known PQW value via the VAT (with a temporary symbol added to defeat the "not monitorable" state), then measure the loop current with a calibrated mA meter. A 4.000 mA reading when forcing 0 is correct zero; a reading of 0 mA indicates the loop is open.
7. Sign off with a commissioning report listing every forced test value, every measured value, and the resulting pointer/symbol map. This is the document that prevents the next rig move from re-triggering the same investigation.

9. 4–20 mA Signal Verification on the Field Side

With the program-side addressed, validate the analog output stage:

The Wago 750-552 datasheet specifies a maximum load of ≤ 500 Ω in 0–20 mA mode and ≤ 350 Ω in 4–20 mA mode at 24 V loop supply. A field loop that reads 4 mA correctly when the channel is forced but reads 0 mA on the contractor's terminals indicates a wiring issue, not a logic issue. A loop that reads a fixed 4 mA regardless of force value indicates either a logic issue (no program write reaching the AO) or a module in safe-state default — which is exactly the symptom of the case in this article.

10. Diagnostic Tools and What Each One Tells You

The right combination for this class of fault is trace + source-generated STL + online breakpoints. Trace gives you the temporal evidence that something is writing (or is not); the STL source gives you the structural evidence of where; breakpoints give you the synchronous evidence at the moment of the write.

11. Prevention and Documentation

1. Eliminate indirect peripheral addressing where possible. Use statically-bound symbol parameters and the FB multi-instance model. Indirect addressing on outputs is a debugging liability disproportionate to the bytes it saves.
2. Maintain a peripheral-address map as a project artifact (a plain PDF in the project folder). Each PQW/PIW gets a row with: HW Config slot, symbol, source FB, scaling, last-known-good forced value, and the last commissioning technician's initials.
3. Baseline the configuration DBs. After every HW change, export the configuration DB to CSV and store it in the project. A stale configuration DB is the most common cause of "it worked before the move" symptoms on mobile plant.
4. Stamp the project with the bus topology: PROFIBUS addresses, GSD file versions, coupler firmware versions (e.g., Wago 750-333 firmware 01.xx), and DP diagnostic buffer snapshots.
5. Run a controlled end-to-end test as the last step of every move, not the first time someone notices the loop is dead.

12. FAQ