Resolving PLCSIM Analog Input Syntax in TIA Portal V11+

Address Model Evolution: PIW/PQW to IW/QW

The transition from STEP 7 V5.5 to TIA Portal V11 introduced a new I/O addressing model for SIMATIC S7 PLCs. Engineers who relied on the classic PIW / PQW syntax for reading and writing analog values in S7-PLCSIM frequently encounter problems when their programs, copied from V5.5, no longer compile or fail to update values inside the simulator. This reference covers the address model, the :P suffix behavior, the watch-table modify workflow for forcing analog channels in S7-PLCSIM, and the differences between S7-1200/1500 and S7-300/400 addressing in TIA Portal.

In STEP 7 V5.5 the analog input and output areas of an S7-300/400 CPU were addressed through the process image using the PIW and PQW keywords, and direct peripheral reads were issued with PEW / PAW:

L  PIW 290      // load analog input word at slot 4, channel 0
T  PQW 304      // transfer to analog output word
L  PEW 290      // direct peripheral read (immediate)

In TIA Portal V11 and later, the addressing vocabulary changes. The same address is now written using IW (input word) and QW (output word), and the absolute address is typically prefixed with the % operator to make the address fully qualified. The I and Q operands are split into two memory areas by the optional :P suffix. With :P, the access goes to the process image, which is the same area that the older PIW / PQW syntax addressed. Without :P, the access goes directly to the I/O (peripheral area), bypassing the process image entirely.

The legacy PIW keyword is no longer accepted by the TIA Portal compiler. When a STEP 7 V5.5 project is migrated, the converter rewrites PIW to %IW with the process-image qualifier :P appended automatically. The qualifier is the only syntactic element that distinguishes a process-image access from a peripheral access in the new editor. Engineers who do not append :P implicitly ask the compiler to issue a peripheral read, which the simulator cannot service.

The ":P" Suffix Behavior

The :P qualifier is the TIA Portal indicator that the address is mapped to the process image of the CPU. Internally the compiler treats %IW290:P identically to the legacy PIW 290. Stripping the suffix converts the read into an immediate peripheral access, which is not what PLCSIM was designed to mirror in V11.

Three access modes are possible for every input word in TIA Portal:

• Process-image access (:P) — the same as the legacy PIW. The CPU updates the word at the start of OB1, the program reads a consistent value throughout the cycle, and the value is delivered to the user program. PLCSIM honors the modify operation by writing to this area.
• Direct peripheral access (no suffix) — the CPU reads the input module immediately. The process image is not updated. PLCSIM V11 does not intercept the read, so the value either comes from the last latched process image or returns zero.
• Symbolic access — the tag in the PLC tag table points to a process-image address by default. The compiler resolves the tag to a process-image read; the qualifier is not required in the user program.

When a program is loaded into PLCSIM, the simulator reports the process-image access in its log and writes the modified value into the slot/channel of the simulated module. The behavior is fully deterministic and matches the behavior of a real CPU, but only for process-image access. Direct peripheral access is not simulated in V11 and must be avoided during offline simulation. Engineers who need to verify direct peripheral access logic must run the program on a real CPU with a real analog input module; PLCSIM cannot substitute for that verification.

The :P suffix is not the same as the address qualifier used in SCL pointer expressions. In SCL, the form P#IW290 is a pointer to the input image area, while %IW290:P is a fully qualified operand with the :P access qualifier. The two are related but not interchangeable; mixing them in a single block raises a compiler error.

S7-1200/1500 vs. S7-300/400 Address Behavior

TIA Portal unifies the configuration of S7-1200, S7-1500, and S7-300/400, but the address interpretation rules still differ between the two families. The differences are not always obvious in the editor, but they become important when a project is migrated or when a program is shared between stations.

For the S7-1200/1500 the symbolic access model is preferred. Engineers add a tag named AI_RawValue in the PLC tag table, assign the data type Int (or Word for raw 16-bit unsigned), and link the tag to the input address %IW290:P. The user program then reads the tag name and never touches the absolute address. The :P qualifier is not visible in the program source but is added by the compiler when the symbol is resolved.

For the S7-300/400 the absolute PIW / PQW syntax is preserved. After migration, the address is shown as %IW290:P in the tag table and as PIW 290 in the migrated source, depending on the language. The compiler accepts both forms; engineers should choose one and stick to it for the duration of the project to keep the codebase consistent and to make the simulator behavior predictable.

Analog Value Representation in 16-Bit Words

The Siemens analog value representation is left-justified in a 16-bit word. The value range depends on the configured input range and the resolution of the module:

• Unipolar 0..10 V or 0..20 mA: 0..27648. Zero is at 0x0000, full scale is at 0x6C00.
• Unipolar 1..5 V or 4..20 mA: 0..27648. The lower bound (1 V or 4 mA) maps to 0, the upper bound (5 V or 20 mA) maps to 27648.
• Bipolar ±10 V or ±20 mA: -27648..27648. -27648 is at 0x9400, 0 is at 0x0000, +27648 is at 0x6C00.

When modifying the value in a watch table, the engineer enters the raw 16-bit integer. The conversion to engineering units (e.g., 0..100% for a 0..10 V input) is performed by the user program, typically using the SCALE and UNSCALE blocks from the standard library. The PLCSIM panel does not apply any scaling; the engineer is responsible for entering a value that matches the configured input range.

For the S7-1500, the analog input word also carries a value status (QI - Quality Information) bit. The QI bit is set to 1 when the analog value is valid and 0 when the value is invalid (e.g., wire break on a 4..20 mA input). The QI bit is part of the same 16-bit word in older modules and a separate status bit in newer modules. The watch table displays the QI bit as the most significant bit of the word, and the program can check it before using the analog value.

Step-by-Step: Simulating Analog Values in TIA Portal V11

The workflow for simulating an analog input in S7-PLCSIM is essentially the same from TIA Portal V11 through V17, with cosmetic differences in the panel layout. The procedure below uses TIA Portal V11 and S7-PLCSIM V11 as the reference. For V12 and later the watch-table workflow is unchanged; the PLCSIM panel adds additional features (covered in the next section).

Prerequisites

• TIA Portal V11 SP2 or higher installed (V12, V13, V15, or V16 recommended for the full simulation workflow).
• S7-PLCSIM V11 (matching the TIA Portal version) installed on the engineering PC.
• An S7-1200 CPU configuration (CPU 1212C, 1214C, 1215C, 1217C, or 1500) with at least one analog input module (SM 1231, SM 1232, SM 1234, or signal board SB 1231) configured in the device view.
• Hardware configuration compiled and downloaded to the simulated CPU before the watch table is opened.
• User program blocks (OB1, FB, FC, DB) compiled without errors.

Procedure

1. Open the project in TIA Portal and complete the device configuration for the S7-1200 station, including the analog input module. In the device view, open the analog module properties, set the input range (e.g., 0..10 V, 4..20 mA, ±10 V), and confirm that the input addresses generated in the device view match the addresses used in the user program.
2. Compile the project (Project → Compile → Software (rebuild all)) and resolve any syntax warnings. Address errors typically appear as "The address does not exist in the project" or "Untyped constants cannot be implicitly converted".
3. Start S7-PLCSIM from the TIA Portal toolbar (Start simulation button). In the dialog, select the CPU type, the instance name, and the slot. Click "Start" to launch the simulated CPU.
4. Establish the online connection. After the simulated CPU enters RUN, the project tree will show the online/offline state and the watch-table toolbar becomes active.
5. Open or create a watch table (Project tree → Watch and force tables → Add new watch table). Add the analog input tag and set the display format to "Hexadecimal" (for 16-bit raw value) or "Decimal" (for scaled engineering units).
6. To force a value, click the cell in the "Modify value" column of the tag, enter the value you want the simulated analog input to hold, and press the "Modify now" or "Force" button. For PLCSIM V11 the modified value latches in the process image and is read on the next OB1 cycle.
7. In the user program, ensure that every reference to the analog input uses the :P suffix or a symbolic name that resolves to the process image. For SCL:

   "AI_Process_Value" := %IW290:P;
   

   and in LAD/FBD use the MOVE box wired to the %IW290:P operand. The MOVE box must be triggered on the rising edge of OB1 or on a cyclic interrupt OB; the :P read returns the same value for the whole cycle.
8. Trigger the modify again and observe the "Monitor value" column to confirm the new value is read by the program. If the value does not change, the address most likely points to the peripheral area and needs the :P suffix appended.

Watch-Table Modify Workflow in Detail

The watch-table modify workflow in TIA Portal V11 is the primary mechanism for forcing a value into a simulated analog input. The workflow is identical for digital and analog tags; the difference is in the bit width (1 bit vs. 16 bits) and the interpretation of the raw value (boolean vs. 0..27648 unipolar or -27648..27648 bipolar).

1. Open the watch table and click the "Monitor all" button. The current value of the tag is read from the simulated CPU and displayed in the "Monitor value" column.
2. Click the cell in the "Modify value" column. Enter the desired raw value. For an unipolar 0..10 V input at full scale, enter 27648 (decimal) or 0x6C00 (hex). For a 4..20 mA input at 50%, enter 13824 (decimal) or 0x3600 (hex).
3. Click "Modify now" or "Force". The value is written to the process image of the simulated CPU on the next OB1 cycle. The "Monitor value" column updates to show the new value.
4. If the value does not change, click "Monitor all" again to refresh the display. PLCSIM V11 updates the monitor display on every online change; V12 and later require an explicit refresh.

The "Force" function in the watch table is different from "Modify". Force keeps the value latched in the simulated CPU even when the user program writes to the same address. The forced value remains in effect until the engineer explicitly removes the force. Modify writes a single value that the program can overwrite on the next cycle. For analog simulation, "Modify" is usually sufficient; "Force" is reserved for debugging safety-related logic where the user program must not overwrite the test value.

For multiple tags, the watch table can be configured to modify several values in a single operation. Right-click the "Modify value" column and select "Modify now (all visible)" or "Modify now (all)". The values are written to the simulated CPU in a single batch, which is useful for setting up a test case with several analog channels at known values.

Forcing Analog Values in PLCSIM V12 and Later

The original S7-PLCSIM V11 modified values by writing to the process image through the watch table. In V12 and V13 the simulator exposes a per-channel "Modify" interface in the PLCSIM panel itself. Engineers can open the panel, click on the analog input symbol, and enter a 16-bit integer. The simulator updates the process image and the user program reads the new value on the next cycle. The same panel exposes digital inputs, outputs, timers, and counters.

In S7-PLCSIM V13 (introduced with TIA Portal V13) the panel is extended with:

• A "Force" tab that shows the slot and channel of the simulated module, with separate force bits for each channel.
• A "Sequence" tab for stepping through a list of values, useful for testing the response of a closed-loop controller without writing a script.
• API entry points (SIM_TABLE, SIM_INSTANCE) for use with PLCSIM Advanced (V15 and later) so that HMI or external test harnesses can write into the simulated process image.

For analog channels, the modify value is written as a raw 16-bit integer. The conversion to engineering units (0..27648 for unipolar, -27648..27648 for bipolar) must still be performed by the user program, typically using the SCALE and UNSCALE blocks from the standard library. The PLCSIM panel does not apply any scaling; the engineer is responsible for entering a value that matches the configured input range.

For S7-1500 stations, the PLCSIM V15 panel adds support for isochronous mode simulation, allowing the engineer to verify the timing of a closed-loop controller running on a PROFIBUS or PROFINET cycle. The feature is not relevant to the analog input simulation workflow but is worth noting for engineers who run motion control applications.

S7-PLCSIM Advanced (V15 and later) runs the simulated CPU as a Windows service or container, without a visible user interface. The same API entry points are exposed over TCP/IP, so a test harness running on a separate machine can write into the simulated process image. The Advanced edition supports up to 16 simulated instances and is the preferred mechanism for automated regression testing of analog control loops.

Migrating STEP 7 V5.5 Programs to TIA Portal V11

When a STEP 7 V5.5 project is migrated, TIA Portal translates the symbol table and the program blocks. The translation rules for analog I/O are deterministic and apply to any project that contains the legacy PIW / PQW syntax.

1. PIW nnn is rewritten as %IWnnn:P. The compiler inserts the :P automatically because V5.5 accesses were process-image accesses.
2. P#IX x.y pointer expressions are converted to P#I x.y for the S7-1200/1500 and to P#IX x.y for the S7-300/400 with the peripheral pointer bit cleared.
3. L PEW nnn (peripheral read) is kept as L %IWnnn without :P, depending on the language used.
4. Any direct access that bypassed the process image in V5.5 must be reviewed. A peripheral read in a closed-loop control loop running every 10 ms cannot be replaced with a process-image read without affecting the controller behavior.

For mixed projects that contain both S7-300/400 and S7-1200 stations, the project migration creates two separate devices. Each device carries its own address namespace; analog inputs that are physically wired to both stations must be configured twice, with different addresses in each station. The migration tool does not detect or warn about address collisions between the two stations.

For LAD and FBD blocks, the migration preserves the network comments and symbol information. For SCL and STL blocks, the migration rewrites the absolute addresses and adds the % prefix. Engineers should review the migrated blocks for any remaining PEW / PAW references and either remove them (if the original code intended a process-image access) or convert them to the new peripheral access form %IWnnn (without colon).

The S7-1200 Programmable Controller System Manual (entry ID 68113685) on the Siemens Industry Online Support portal documents the address model in detail, including the :P qualifier, the symbolic access model, and the configuration of analog modules. The same entry hosts the TIA Portal help system, the S7-PLCSIM function manual, and the migration guide for STEP 7 V5.5 projects.

Reference: Analog Input Address Map for Common S7-1200 Modules

Verification Checklist

Before signing off a simulated analog loop, run through the following checks:

• The hardware configuration includes the analog input module with the correct slot, channel, and address.
• The user program references the analog input with :P (or a symbolic tag that resolves to the process image).
• A watch table is open with the analog input tag visible in monitor mode.
• A modify operation writes a known value (e.g., 0x6C00 = 27648 for 100% of unipolar range) into the tag.
• The user program reads the modified value and produces the expected scaled engineering variable in the corresponding DB tag.
• The modify is repeated with a second value (e.g., 0x0000 for 0%) to confirm the channel responds linearly.
• The :P qualifier is removed (or the addresses confirmed to be symbolic process-image addresses) before downloading the project to a real CPU.
• The hardware configuration is re-downloaded to the real CPU before the user program is loaded.
• The wiring between the analog input module and the field device is verified with a multimeter or loop calibrator before commissioning.

Common Pitfalls

1. Forgetting to download the hardware configuration

PLCSIM emulates only the modules present in the device view of the simulated CPU. If the analog input module is missing, the address is not part of the process image and the modify operation fails silently. The compile step does not catch this; the watch table reports the address as "invalid". Download the device configuration to PLCSIM before opening the watch table.

2. Mixing IW and PIW syntax inside a single block

TIA Portal V11 rejects blocks that contain both %IW and PIW syntax. The compiler raises a syntax error on the first occurrence of the legacy form. Convert all references to the new %IW / %QW form, and use the :P suffix for process-image access.

3. Using direct peripheral access in a fast loop

A peripheral read on every scan can be acceptable on a real CPU but is not what PLCSIM V11 is designed to mimic. Use :P and route the value through the process image to keep the simulation deterministic. On a real CPU, the peripheral read is also subject to bus timing and can introduce jitter into a fast loop; the process-image access is the preferred mechanism for any scan faster than 1 ms.

4. Leaving the :P suffix in production code

The :P qualifier is harmless on a real CPU because the process image is still updated. However, the form %IW290:P confuses engineers who read the code and are not familiar with the new syntax. Prefer symbolic names that hide the qualifier and use the absolute form only in libraries that are deliberately process-image-only.

5. Confusing the integrated analog inputs of the CPU with the signal board

The S7-1200 CPU has two integrated analog inputs at addresses %IW0 and %IW2 (only on the C-type variants). The signal board, if present, adds inputs starting at %IW4. The SM analog module starts at the next free address. Engineers often see the wrong channel in the watch table when the addressing list is not reviewed.

6. Modifying the analog input while OB1 is running

The modify value is latched in the process image at the start of the next OB1 cycle. If the user program reads the analog input more than once in the same cycle, all reads return the same modified value. The behavior is correct, but engineers who expect a real-time response (e.g., a value that changes between two consecutive reads) will see the same value twice. The workaround is to use a cyclic interrupt OB (e.g., OB35) to read the analog input and copy the value into a global DB tag.

7. Forgetting to remove the :P suffix from the production download

After verifying the program in PLCSIM, engineers sometimes leave the :P suffix in place when downloading to a real CPU. The download succeeds, the program runs, and the value is read correctly — but the source code is inconsistent with the rest of the project. Use the project-wide search (Ctrl+F) to find every :P occurrence and either keep them as a deliberate style choice or remove them to match the project convention.

Debugging Tips and Diagnostics

When a simulated analog value does not behave as expected, the following diagnostic steps help isolate the cause:

1. Check the address in the watch table. The "Monitor value" column should reflect the value just written. If the value reads back as zero or the latched value, the address is not being modified. Confirm the modify operation completed and the column is in monitor mode.
2. Verify the :P suffix. Open the program block in the editor and look for the address. The suffix must be present in any absolute reference. If the address is symbolic, open the PLC tag table and confirm the tag points to a process-image address.
3. Check the hardware configuration download. In the online diagnostics, confirm that the analog input module is present in the device view of the simulated CPU. If the module is missing, the watch table reports the address as "invalid" or "not available".
4. Confirm the input range. The configured input range (0..10 V, 4..20 mA, ±10 V) determines the raw value range. A value of 27648 represents 100% of the unipolar range. A value of 0 represents 0% (or 4 mA on a 4..20 mA input). Entering a value outside the configured range either saturates the value (e.g., 32767 for a positive overflow) or wraps around the sign bit.
5. Check for OB1 cycle time. A slow OB1 cycle time can make the modify operation appear to be ignored if the user program reads the analog input only every 100 ms. Increase the monitor refresh rate in the watch table or use a cyclic interrupt OB to read the value more frequently.
6. Use the PLCSIM panel for direct verification. In V12 and later, the PLCSIM panel shows the raw value of each analog channel. If the panel shows the modified value but the user program reads a different value, the issue is in the user program, not the simulator.

For engineers who need to script the simulation, the PLCSIM Advanced API (V15 and later) exposes the same modify operation as a TCP/IP call. A Python or .NET test harness can iterate through a list of test values, write each value to the simulated process image, read the user program's response, and log the result. The setup is identical to the manual workflow but runs unattended and can be integrated into a CI/CD pipeline.

FAQ