Resolving Siemens STEP 7 Red Symbol: PIW WORD vs INT in LAD

Engineers working with classic STEP 7 (SIMATIC Manager) on S7-300 and S7-400 controllers frequently encounter a situation where a perfectly valid-looking address such as PIW 400 is rendered in red font in a Ladder (LAD) or Function Block Diagram (FBD) network, while the identical address shows in the normal black font when opened in a Statement List (STL) editor. The discrepancy is not a bug in STEP 7; it is the LAD/FBD editor performing strict data-type checking that the STL editor deliberately does not enforce. This article walks through the exact root cause, the STEP 7 data-type model, the analog-input addressing scheme, and the field-proven procedure to clear the red symbol while keeping your program functionally correct.

1. Problem Description

The reported failure mode is reproducible across SIMATIC Manager V5.5 and earlier, and reappears in TIA Portal when symbolic programming of S7-300/400 projects is enabled. The reproduction steps are:

1. An analog input module (e.g., SM 331, 6ES7331-7KF02-0AB0) is configured in HW Config at slot 4, mapping the first channel to PIW 400.
2. The engineer opens the Symbol Table and assigns the symbol AI_TankLevel to PIW 400 with data type WORD (the default for an empty column auto-fill).
3. In the OB1, a ladder network is created with a MUL_I (Multiply Integer, FC 30) block. The IN1 input is wired to the symbol AI_TankLevel.
4. The editor underlines the address in red and refuses to compile the block, with the message: "The data type of the actual parameter does not match the data type of the formal parameter."
5. Switching the same block view to STL and back shows the network as valid (black) until it is saved, at which point the red indicator reappears in LAD/FBD.

Because STL does not perform this check at edit time, a developer can write a working program in STL that silently produces wrong results in the PLC: when the MUL_I block loads a WORD value into its integer accumulator, the high bit (bit 15) is interpreted as the sign bit, so a positive raw value above 32767 returns a negative integer. This is one of the most common hidden-bug sources in legacy S7 code.

2. Root Cause: Type Checking Differs Between LAD/FBD and STL

The STEP 7 editors implement two fundamentally different design philosophies:

When you wire AI_TankLevel (declared as WORD) to the IN1 parameter of a MUL_I block, the editor compares the formal parameter type INT with the actual type WORD. Because WORD is a 16-bit bit-string type and not a numeric type, the editor marks the operand in red. STL ignores the type tag entirely and simply moves the 16 bits into the accumulator, which is what causes the silent runtime misbehavior described above.

3. STEP 7 Data Type Reference

Before you fix the symbol, understand the data-type model that STEP 7 enforces. Only the 16-bit numeric and bit-string types are relevant for a single peripheral input word.

The crucial insight: WORD and INT share the same 16-bit storage layout, but their semantic meaning differs. WORD is a sequence of 16 flags with no numeric interpretation. INT is a two's-complement signed integer. STEP 7 will not implicitly convert between them.

4. Peripheral Input Word (PIW) Addressing for Analog Signals

The address PIW 400 belongs to the peripheral input area of the CPU. The peripheral area is a separate address space that the S7 CPU uses to read directly from the I/O modules without going through the process-image update. The default address ranges for an S7-300 station are:

Within HW Config, each slot receives a default 16-byte (= 8-word) input sub-range. A typical four-slot analog rack starting at slot 4 yields:

• Slot 4 — PIW 256 … PIW 270 (4 channels × 2 bytes, only first 4 words used for 2-wire AI)
• Slot 5 — PIW 272 … PIW 286
• Slot 6 — PIW 288 … PIW 302
• Slot 7 — PIW 304 … PIW 318

PIW 400 corresponds to a station layout in which an analog input module is installed at a higher slot number or in a distributed I/O rack (PROFIBUS DP / PROFINET IO). The exact slot-to-address mapping is shown in HW Config → Module Properties → Addresses. The address is the same regardless of whether the field device uses a 0 … 10 V or 4 … 20 mA transducer — Siemens modules always normalize the analog value to the same integer range internally.

4.1 Siemens Analog Value Normalization

Siemens analog input modules present a signed 16-bit integer in the following range. This range is independent of the physical transducer type:

The mapping for a 4 … 20 mA current loop is linear: a current of 4 mA yields PIW = 0, 12 mA yields PIW = 13824, and 20 mA yields PIW = 27648. Currents above 22.8 mA (the overrange threshold) produce positive overrange values up to 32767; an open circuit is signalled by a value below -3276. Detailed background on the 0 … 10 V versus 4 … 20 mA choice is provided in the Balluff article on analog signal selection; the underlying analog-signal definition can be reviewed on the Wikipedia analog-signal page.

Because the engineering value coming back from the module is a signed integer, the correct STEP 7 data type for the symbol table entry is INT, not WORD. The presence of negative values in the overrange and bipolar modes is exactly what would corrupt any program that treats the value as an unsigned bit string.

5. Step-by-Step Fix

The fix is to change the symbol-table data type and re-insert the address in the network. Follow the procedure in order.

Prerequisites

• SIMATIC Manager V5.5 SP4 or later, with the S7-300 / S7-400 option package installed.
• The project must be open in offline mode and checked out from the version archive if you are using a multi-user engineering workflow (PCS 7 / COMOS).
• You must have write access to the S7 program container (S7 Program > Sources / Blocks / Symbols).

Procedure

1. Open the Symbol Table. In the project tree, expand S7 Program(1) and double-click Symbols. The symbol editor opens.
2. Locate the PIW entry. Use the filter Address: PIW* to find the offending row. For example: AI_TankLevel PIW 400 WORD.
3. Change the Data Type column from WORD to INT. Click the cell, type INT, and press Enter. Do not edit the address or symbol column.
4. Save the symbol table with Ctrl + S. The editor may warn that the type change affects instances; click Continue only if you are sure no other block depends on the WORD interpretation.
5. Return to the OB1 block that contains the red network. Select the LAD/FBD view.
6. Re-insert the symbol: delete the red operand, place the cursor on the IN1 pin of the MUL_I block, and type the symbol name AI_TankLevel (or use the right-click menu → Insert Symbol → select AI_TankLevel). The address should now appear in black.
7. Save and compile the block (Ctrl + B or menu Program > Compile). The red indicator must disappear from the status bar.
8. Download the changes to the CPU. In the worst case, a full block-container download is required to refresh the type tags in the CPU's compiled code.
9. Verify online with Monitor/Modify: open the VAT or the OB1, force a known input on the field side, and confirm the expected integer appears in PIW 400 (e.g., 13824 for 12 mA).

6. Verification Checklist

Use the following matrix to confirm the fix is complete and that no other blocks in the program carry the same latent issue.

7. Advanced Cases and Edge Conditions

7.1 When You Really Need a WORD Type

If the analog input module is configured for status/diagnostic word output (e.g., the SM 331 diagnostic interrupt group returns a bit-mapped word in PIW x with bit 0 = channel 0 overflow, bit 1 = channel 0 underflow, etc.), then the WORD declaration is correct. The right way to use it in arithmetic is to convert explicitly:

// STL conversion from WORD to INT (only valid for 0 ... 32767)
L     AI_Status_Word      // WORD
ITD                      // extend sign of INT to DINT
DTR                      // DINT to REAL
T     MD 100             // engineering value

Or in LAD, drop in the BTI (Word → Integer) converter, the ITD (Integer → Double Integer) and the DTR (Double Integer → Real) blocks. The crucial point: do not connect a WORD directly to an integer arithmetic block. The conversion must be explicit so the intent is visible in the code.

7.2 Bipolar 4 … 20 mA with Negative Overrange

If the field device is a 4 … 20 mA transmitter wired to a bipolar module configured for ±20 mA, the module can return values down to -27 648. With a WORD declaration, the value 0x9400 (negative overrange) is interpreted as the unsigned decimal 37888 and any subsequent math overflows or sign-flip. Always use INT in this case.

7.3 32-Bit Analog Values (e.g., 0 … 10 V on SM 331 with 8-Channel 13-Bit Mode)

Some 8-channel SM 331 variants in the 6ES7331-1KF02-0AB0 family pack two channels into one 32-bit double word at PID 400. The correct symbol type is DINT or REAL, not DWORD. The same rule applies: DWORD is a bit string, DINT is signed 32-bit, REAL is IEEE-754 floating point.

7.4 When the Symbol Was Originally a S7-200 / S7-1200 Symbol

S7-200 (Micro/Win) and S7-1200/1500 (TIA Portal) do not have peripheral I/O addresses in the PIW sense; they use IW and %IW with the symbol table attached to the data block. If you migrated a project from TIA Portal back into classic STEP 7 (e.g., to use a legacy CPU), the symbol type defaults to WORD and the same red-symbol symptom appears on the first MUL_I / ADD_I block you wire. The fix is identical: change the type to INT in the classic STEP 7 symbol table.

7.5 Using Indirect Addressing (PEEK / POKE)

If you read the analog value through a PEEK or PEEK_W instruction (FC 20 / SFC 74) into an MW marker word, the data type of the marker word governs the next operation. The marker word must be INT to interoperate with MUL_I, ADD_I, etc. A common mistake is to use MW (which is implicitly WORD) and then wire it into a comparator; the comparator's == operation will treat the bit pattern as unsigned, producing wrong results when the analog value is negative.

8. Best Practices for Analog Signal Symbols

1. Default to INT for any peripheral input or output word that carries a normalized Siemens analog value. Reserve WORD for status / diagnostic / control words that are bit-mapped.
2. Use a naming convention that encodes the unit and the engineering range, e.g. AI_TankLevel_PCT_INT for a 0 … 100 % signal and AI_TankLevel_mA_INT for the raw 0 … 27 648 integer. This makes the data type implicit and prevents accidental re-typing in the symbol table.
3. Always wire through a FC105 SCALE (or FC106 UNSCALE) block when converting from the raw 0 … 27 648 range to an engineering range such as 0 … 100.0 %. This keeps the scaling formula in one audited location.
4. Enable symbol consistency check in Options > Customize > Compile so that the type of every PIW / PQW symbol is verified against its usage at compile time, not just at edit time.
5. Avoid STL-only programs for new analog processing code. Use SCL or FBD with explicit conversion blocks so the data type is visible and type-checked.
6. Document the transducer type and the overrange behavior in the symbol comment column, e.g. // 4 ... 20 mA, open-circuit detection at PIW < -3276.
7. When migrating a project to TIA Portal, the type of PIW symbols is preserved in the imported symbol table. Verify with Tools > Project consistency > Display non-consistent symbols after the migration wizard finishes.

9. Diagnostic Buffer and CPU Event ID Reference

If a previously working program suddenly raises a CPU fault after a symbol-table type change, consult the diagnostic buffer with PLC > Diagnostic/Setting > Diagnostic Buffer. Relevant Siemens event IDs (decimal in parentheses):

After a type change, perform a full project recompile (Program > Compile All), then a full block-container download (PLC > Download User Program to Memory Card if the change affects instance DBs).

10. Summary

The red-symbol error in STEP 7 LAD/FBD when wiring a PIW to an integer arithmetic block is not a software defect — it is the editor enforcing the distinction between a 16-bit bit string (WORD) and a 16-bit signed integer (INT). The standard Siemens analog-value normalization always returns a signed integer in the range -27 648 to +27 648, so the correct symbol-table data type is INT. The fix is three steps: change the type in the symbol table, re-insert the operand in the affected LAD/FBD network, and recompile. After the change, verify online that the value tracks the transducer linearly and that the diagnostic buffer is clean. Adopt a symbol-naming convention that encodes the engineering unit and the data type so the issue cannot recur.

FAQ