Resolving PCS7 CPU 414-4H PIW to IW Analog Input Address Error

Resolving PCS7 CPU 414-4H PIW to IW Analog Input Address Error

1. Problem Description

On a SIMATIC PCS 7 v7.0 project using a CPU 414-4H fault-tolerant controller, an engineer encountered a configuration error when wiring 18 analog input (AI) modules into the standard signal processing library. The first 16 channels were addressed inside the CPU's process image partition as inputs words IW512, IW514, IW516, ... IW542, and the CFC charts containing the CH_AI (PCS 7 Channel Driver for Analog Inputs) block accepted the connections without complaint.

Starting with the 17th and 18th module slots, the address representation in the SIMATIC Manager variable table and in the HW Config I/O table changed from IW to PIW — for example PIW 780 and PIW 782. When the engineer attempted to wire one of these PIW addresses to the VALUE input of a CH_AI block in the CFC, CFC raised the following compile/runtime error:

"The address entered here is not permitted."

The symbol table entry was defined correctly as WORD and the absolute address was set to PIW 780. The error appeared only when the CFC compiler attempted to bind the I/O driver to a peripheral address that lay outside the CPU's automatic process image.

2. Root Cause

The CPU 414-4H — like every S7-400 CPU — automatically refreshes a contiguous address range called the process image partition (German: Prozessabbild, hence the P prefix). When the user enables the "Automatic update of the process image" option for an analog input module in HW Config, the CPU updates that module's input data in the OB1 / OB35 process image at the start of every cycle.

Input addresses that fall inside the configured process image are written into the I/O area and become accessible as IW (input word). Input addresses that fall outside the process image are not refreshed automatically and are accessed directly on the backplane as PIW (peripheral input word). The two notations refer to the same physical address — only the access mechanism differs.

The default process image for a CPU 414-4H is:

With 18 eight-channel AI modules occupying IW 512 through approximately IW 798, the high-side addresses push past the default 768-byte boundary. From the 17th module onward, the addresses are above the process image and are reported by STEP 7 as PIW 780, PIW 782, etc.

The CH_AI block, like all PCS 7 APL and standard library driver blocks, is typed against a process image input. The block's I/O declarations expect an WORD with the system attribute S7_m_c = true, which in turn forces CFC to refuse any address that is not in the process image. That is the source of the "address entered here is not permitted" message.

3. Prerequisites

Before making the fix, gather the following:

• SIMATIC Manager with the project's HW Config open, or PCS 7 Engineering Station with the project in editable state (offline). The CPU must be stopped or the project reloaded after the change.
• The correct CPU 414-4H firmware version installed. The CPU 414-4H was introduced as the medium-performance member of the S7-400H family and its functionality corresponds to the CPU 417-4H (see the Siemens Support entry 6412542 – New S7-400H CPU for the Medium Performance Range: CPU 414-4H). Confirm the firmware using PLC → Operating Mode → Module Information and compare against the entry in the Siemens Online Support.
• Read/write access to the HW Config and to the S7 program (symbol table, CFC charts, SFC charts).
• Know the total installed I/O footprint: with 18 AI modules of 8 channels each (e.g., 6ES7431-1KF20-0AB0 SM 431 AI 8x16 bit), the input area extends to byte 800. The output area, in this case, is unused by AI and is irrelevant to the fix.
• Backup of the S7 program (File → Archive) before saving the HW Config change.

4. Step-by-Step Solution

The fix is performed entirely inside HW Config by enlarging the size of the process image input (PII) of the CPU 414-4H. The change is non-destructive: it does not alter I/O addresses, symbol table entries, or CFC chart contents. STEP 7 automatically re-evaluates the address classification and re-renders PIW as IW for any address that now lies inside the enlarged process image.

Step 1 — Open HW Config

1. In SIMATIC Manager, select the S7 program folder and double-click the Hardware object.
2. HW Config opens with the rack containing the CPU 414-4H in slot 3.

Step 2 — Open the CPU Properties

1. Double-click the CPU 414-4H (slot 3). The Properties – CPU 414-4H dialog opens.
2. Select the "Cycle/Clock Memory" tab.

Step 3 — Increase the Process Image Input Size

1. Locate the field "Size of the process image input area (bytes)". The default value is 768.
2. Change the value to 1024. This expands the PII to bytes 0 through 1023, with the last input word becoming IW 1022.
3. If the project also has an output image that exceeds the default, raise the "Size of the process image output area (bytes)" field as well. For the 18-AI scenario this is typically not required, but for mixed I/O projects align both fields with the actual highest byte address used.

Step 4 — Save and Compile

1. Click OK to close the CPU properties.
2. From the menu bar choose Station → Save and Compile (or Ctrl+S followed by Ctrl+B if a prompt is shown).
3. STEP 7 reports the system data was rebuilt. The process image change is part of the system data (SDB) and must be downloaded to the CPU.

Step 5 — Download the System Data

1. In HW Config, choose PLC → Download to Module.
2. Confirm the target CPU (the same 414-4H that is currently online).
3. Select "Download system data only" if STEP 7 offers the choice, or accept the default Complete download for a clean state.
4. Wait for the dialog Download to module – finished.

Step 6 — Refresh the Symbol Table and CFC

1. Open the symbol table. The previously PIW entries (e.g. PIW 780) now display as IW 780 once the symbol table is refreshed. If they still appear as PIW, right-click the column header and choose Update or close and reopen the symbol table.
2. Open the CFC chart that contains the affected CH_AI block.
3. Right-click the input pin that previously held the bad address and choose Interconnection to Address. Type IW 780 (or use the symbol browser to pick the renamed symbol).
4. Save the chart. CFC no longer reports the "address entered here is not permitted" error.

Step 7 — Compile the S7 Program

1. In SIMATIC Manager, select the S7 Program folder and run Charts → Compile (or right-click → Compile and Download Objects in PCS 7 ES).
2. Verify the program compilation completes with 0 errors.
3. Download the program to the CPU if it was not already downloaded in step 5.

5. Verification

After the system data and program are downloaded, perform the following checks to confirm the fix is in effect and that online module replacement will work end-to-end.

5.1 Process Image Boundary Check

Open PLC → Monitor/Modify in SIMATIC Manager. Enter the symbolic name of an input previously addressed as PIW 780. The value must update on every OB1 cycle, confirming that the address is now inside the process image. Compare against a peripheral read using L PIW 780 in a one-shot STL snippet — both reads must return the same value because they read the same physical input.

5.2 CH_AI Block Status

Open the CFC chart in the test mode (Chart → Chart in Test Mode or F5). The CH_AI block must show:

• VALUE input: green, showing the current scaled engineering value (e.g. 0.0 to 100.0 %).
• QBAD output: 0 (good quality).
• SUBS_V output: 0 (no substitution active).

5.3 Online Module Replacement Smoke Test

On a non-critical slot, pull the SM 431 AI module out of its socket while the CPU is in RUN. The PCS 7 driver must report QBAD = 1 within one OB1 cycle, and must return to QBAD = 0 when a (different but compatible) module is re-seated. If QBAD does not toggle, the process image is not being updated and the fix has not been applied correctly.

5.4 Cross-CPU Consistency (H-System)

The CPU 414-4H is a fault-tolerant H-CPU. Both the CPU 0 (rack 0) and CPU 1 (rack 1) must be configured with the same process image size. Verify in HW Config → Rack 1 → CPU 414-4H → Properties → Cycle/Clock Memory. A mismatch will cause the H-sync to flag a system error (SF on the CPU and an event in the diagnostic buffer referring to the system data difference).

6. Process Image Partition — Technical Reference

The S7-400 process image partition is a reserved region of the CPU's RAM that mirrors the physical input and output modules. At the start of OB1 (and OB35, if OB35 process image is enabled), the CPU copies the input modules' data into the PII. The same copy is used by the user program for the entire cycle, guaranteeing a consistent snapshot of inputs. At the end of OB1, the PIQ is written back to the output modules.

7. CPU 414-4H — Hardware and Firmware Reference

The CPU 414-4H is the medium-performance CPU of the S7-400H fault-tolerant family. According to the Siemens Support entry 6412542, its functionality and configuration correspond to those of the CPU 417-4H, scaled down to a medium-performance price/performance point. Key characteristics relevant to the analog input scenario:

• Work memory: 4 MB code / 4 MB data (typical for the launch revision; later firmware revisions may differ — always cross-check with the device manual for the exact order number 6ES7414-4HM14-0AB0 or your installed variant).
• Bit memory / retentivity: configurable up to 16 KB of bit memory; default retentive area defined in the CPU properties.
• Maximum number of DP slaves / PROFINET IO devices: specified per firmware version. For a 144-channel AI application (18 × 8 channels), the central rack and up to one expansion rack are usually sufficient; PROFINET IO can be used for remote I/O if the topology demands.
• H-specific features: redundant central racks, redundant PROFIBUS DP master interfaces, redundant PROFINET IO controllers, optical or electrical sync modules, event-synchronized programming.
• Process image: the PII / PIQ sizes are adjustable in 1-byte increments up to the firmware-defined maximum.

8. PCS 7 CH_AI Block — Interface Reference

The CH_AI block is the standard PCS 7 driver block for a single analog input. It belongs to the PCS 7 Standard Library (under Drivers → CH_AI) and provides scaling, signal status, substitution, and module diagnostics in a single Function Block. The relevant I/O pins for this article:

The block's VALUE input carries the system attribute S7_m_c = true, which is the actual reason the CFC compiler rejects PIW addresses: the attribute marks the input as must be in the process image. The attribute is set automatically by the PCS 7 driver library; it cannot be removed from the block instance without modifying the library itself, which is not supported and would break PCS 7's compilation rules.

The fix is therefore always performed on the CPU side (process image size), never on the block side.

9. PCS 7 v7.0 Specific Considerations

PCS 7 v7.0 was released in 2008 and supports the S7-400H family with both PROFIBUS DP and PROFINET IO (the latter with the appropriate CP). For a CPU 414-4H project on PCS 7 v7.0 the following points apply to the analog input scenario:

• HW Config entry point: the path SIMATIC Manager → Hardware opens the same HW Config editor as in STEP 7 classic. There is no separate "PCS 7 Hardware Config"; the difference is in the catalog profile, which by default shows the PCS 7-approved modules first.
• CFC / SFC: PCS 7 v7.0 uses CFC (Continuous Function Chart) and SFC (Sequential Function Chart) for the application program. The CH_AI blocks are normally inserted by the PCS 7 driver wizard (Insert → Driver Wizard in the CFC chart), which automatically creates the symbol table entry and the process tag.
• Driver wizard limitation: in some early v7.0 service packs the driver wizard allowed selecting modules outside the default process image and the wizard would create the symbol with a PIW address. The fix in this article (raise the PII size) is the only official remedy.
• Online module replacement prerequisite: the modules in question must support online replacement. For SM 431 AI modules, this requires that the CPU has the "module replacement during operation" option enabled in HW Config under CPU Properties → Startup. Without this option, the driver still works, but the swap will not be hot — a STOP/RUN transition may be required.
• Diagnostic blocks: the PCS 7 standard also installs OB_BEGIN, OB_END, OB_DIAG1, CTRL_PID, and similar blocks. They are not affected by the process image size but are part of the same compile unit — after a process image change, always run Compile Charts → All Charts to refresh the entire unit.

10. Why the Address Was a PIW in the First Place

Understanding the root cause requires a closer look at how STEP 7 assigns the address type. The S7-400 design does not allow an input to be "in the process image" by default — the property is decided module by module at HW Config time, with the additional constraint that the address must fit in the CPU's PII region.

For the 18-AI scenario starting at IW 512:

• Modules 1 through 14 (assuming 8 channels each) occupy IW 512 to IW 558 (14 modules × 8 channels × 2 bytes/channel = 224 bytes; last word = 512 + 14×16 − 2 = 734). All within the default 768-byte PII.
• Module 15 occupies IW 560 to IW 574 (last word 574, still inside the PII).
• Module 16 occupies IW 576 to IW 590 (last word 590, still inside).
• Module 17 occupies IW 592 to IW 606 (last word 606, still inside).

The exact threshold depends on the slot assignment, but the principle holds: once the cumulative byte address of an input crosses 768, the input becomes a PIW. The shift is purely a function of the configured PII size; nothing about the physical module changes.

11. Common Pitfalls and Field-Proven Cautions

1. Process image was reduced, not increased. When a project is migrated from an older CPU (e.g. CPU 414-3) to a CPU 414-4H, the PII default may be reset to 768 bytes. Always check the value on every CPU properties dialog after a hardware upgrade.
2. OB35 process image is not enlarged. STEP 7 maintains two process images (OB1 and OB35). Both must be sized to cover the highest input byte. If you only enlarge the OB1 PII, modules above byte 767 will be updated once per OB35 cycle but read twice per OB1 cycle — producing the classic "staircase" waveform on a slowly changing input.
3. Retentivity region overlap. The PII and PIQ are non-retentive. If you accidentally map an M-bit area into the input region by enlarging the PII past 768, you will lose retentive flags. Always check CPU Properties → Retentivity after changing the PII size.
4. H-system sync loss. If the two H-CPUs are reloaded separately with different system data versions, the H-sync diagnostic buffer entry "Difference in the system data" appears. Re-download the system data to both CPUs in the same operation.
5. Address overlap with global data. The PII and PIQ must not overlap with the bit memory (M), timer (T), or counter (C) areas. For the CPU 414-4H the regions are independent, but if you are using the address-overlap option in unusual projects, verify the partition boundary.
6. Symbol table staleness. The symbol table caches the address type. After saving HW Config, close and reopen the symbol table; otherwise the type column will still show PIW.
7. CFC auto-update of process tags. When the address type changes from PIW to IW, the CFC chart's I/O view sometimes retains the old type label until the chart is recompiled. Run Chart → Compile → Chart as program (or All Charts) to force the refresh.
8. Online module replacement requires hardware support. Some SM 431 AI modules from very early production dates do not support online replacement regardless of CPU configuration. Cross-check the order number against the current catalog in the Siemens Industry Mall.

12. Verification Matrix

13. Related PCS 7 Driver Blocks

The same process-image rule applies to all PCS 7 standard driver blocks. The list below shows the most common siblings of CH_AI; if the project uses them on high byte addresses, the same PII size fix is required.

For applications where the input is truly above the process image maximum and the PII cannot be enlarged further (for example, on a smaller CPU 412 or 413 H), use PADP to read the PIW in OB1 and then expose the result as an IW-mapped variable that the driver can consume. This is a workaround, not a fix, and it is not compatible with the PCS 7 driver wizard's automatic process tag creation.

14. Frequently Asked Questions