S5 QW Output Word: Digital Bit Pattern vs Analog Conversion to S7

When migrating a SIMATIC S5 program to S7, one of the most common sources of confusion is the meaning of an Output Word (QW) instruction. Engineers familiar with S7 CFC (Continuous Function Chart) often assume every QW points to an analog output module, because in CFC the symbol always maps to a channel of an AO card. That assumption breaks the moment the legacy S5 STL (Statement List) program is opened: QW in S5 is simply the 16-bit output area of the process image, and it is the responsibility of the slot in the rack that determines whether the value is interpreted as analog voltage/current or as sixteen discrete digital outputs.

This reference clarifies the dual nature of QW in S5, walks through a real-world STL segment, and provides a reproducible procedure for identifying whether a given QW must be migrated to a true analog output, a digital bit pattern, or a bit-memory word used purely as a flag cluster.

1. S5 Output Area Addressing Recap

In SIMATIC S5 the process image is divided into four byte-wide address spaces:

The PLC does not interpret the data type at the address level. The QW is simply a 16-bit cell in the output process image. The interpretation as analog or digital is performed by the hardware module installed in the slot assigned to that byte number, or by the consumer of the value if the QW is used as a flag cluster (no physical module attached).

2. Why "Output Word" Is Not Synonymous With "Analog Output"

A SIMATIC analog output module (for example the S5 6ES5 470-4UA12 or 6ES5 466-4UA11) contains a digital-to-analog converter. The PLC CPU writes a 16-bit integer to the corresponding QW; the module's DAC then converts that integer into a voltage (e.g., 0...10 V) or current (e.g., 4...20 mA) on the physical terminal. The PLC itself never sees "an analog value" - it only ever sees an integer.

Conversely, two digital output bytes that happen to be addressed as a word can be loaded into the same QW cell. The programmer may do this for several reasons:

• To send a 16-bit pattern to sixteen discrete outputs (e.g., driving 16 valves with one transfer).
• To populate both bytes of a digital output module as a single instruction for clarity or to reduce cycle-time load.
• To use the output area as scratch space / bit cluster (a code-smell; FY/FW should normally be used).

Therefore, encountering QW64 in S5 STL does not prove an analog output exists. It only proves the programmer wrote 16 bits to the process image at byte offset 64.

3. S5-to-S7 Nominal Value Ranges

When the QW really does map to an analog output module, the S5 nominal value range depends on the specific module's resolution. The S7 family standardized the S7 analog range to 0...27648 (unipolar) and -27648...27648 (bipolar), but the S5 modules had different full-scale counts:

If your migration source module is a 12-bit S5 AO, the S7 scaling function (FC105 "SCALE" or the IEC "NORM_X / SCALE_X" blocks) must be reconfigured with the S5 full-scale count, not 27648, otherwise the analog actuator will see a 6.7x over- or under-range.

4. STL Segment Walk-Through

The following S5 segment is the canonical example that causes confusion:

Segment 1
Name : SENDEXAM
:C   DB  80              ; open DB80
:L   DW   1              ; ACCU1 = DB80.DW1
:DO  DW   1              ; ACCU1 OR DB80.DW1 (OR with data word 1)
:C   DB   0              ; close DB
:L   DW   1              ; ACCU1 = previous result
:A   F  101.0            ; AND flag 101.0 (typically a trigger / start flag)
:JC  =M001               ; jump to M001 if result <> 0
:L   KH  A001            ; load constant hex A001
:T   QW  64              ; transfer to output word 64
:L   KH  0010            ; load constant hex 0010
:T   QW  66              ; transfer to output word 66
:S   F  101.0            ; set flag 101.0 (latch trigger)
:BEU                     ; block end unconditional

Key observations:

1. The two T QW instructions write raw 16-bit values to the output process image. No scaling, no linearization, no conversion - the values 0xA001 and 0x0010 are placed as-is.
2. If the slot for QW64/QW66 holds a digital output module, the 16 bits of each word become 16 individual relays/transistors. Bit 0 of QW64 (address Q64.0) would be set because 0xA001 = 1010 0000 0000 0001 in binary.
3. If the slot for QW64/QW66 holds an analog output module, the value 0xA001 = 40961 decimal is a nonsensical analog command (way beyond any normal S5 full-scale count of 255, 2048, 4096, or 27648). This is a strong indicator that the output is digital.
4. The trigger flag F101.0 is used as a one-shot / hand-shake - typical for "send the bit pattern once, then do not resend."

5. Hex-Value Pattern Recognition

For a quick first-pass classification of an unknown QW in S5 STL, the constant value is highly diagnostic:

The combination "0xA001 on QW64 and 0x0010 on QW66" sets only a few discrete bits, which is the signature of a digital bit pattern written to a QW pair. There is no plausible 0-10 V or 4-20 mA interpretation for an analog module in any S5 resolution.

6. Hardware Cross-Check Procedure

When the source code is ambiguous, the configuration and the wiring must be consulted:

1. Open the original S5 hardware configuration (COM 115F / COM S5 or STEP 5 HWConfig equivalent). Note the slot assignment and the module MLFB at the byte addresses 64 and 66 (S5 analog modules usually start at even byte numbers; digital output bytes 32 and 64 are common for SM 322 / S5 6ES5 482 / 6ES5 482-1ALA11 equivalents).
2. Check the I&C drawing / EPLAN / wiring diagram. Trace QW64 bit 0 to a terminal. If that terminal drives a 24 V relay coil, the channel is digital.
3. Measure with a multimeter in the de-energized state. Look for pull-up / pull-down resistors, flyback diodes, and the rated load. An AO card output is short-circuit-proof to the module's common, and the loop impedance to a 4-20 mA actuator is typically 250-600 ohm. A DO output is either a transistor (sink/source) or a relay contact.
4. Read the Siemens Industry Online Support entry for the MLFB. The functional description explicitly states "Analog Output" or "Digital Output." Cross-check at Siemens Industry Mall for the historical datasheet.

7. Mapping QW to S7

The S7 output process image layout is identical in concept but uses the I/O address (PII / PIQ) of the inserted module. The byte offset is set by the slot and the channel start address in HWConfig (TIA Portal: Device configuration → Properties → I/O addresses). Typical S7 mapping:

8. STL-to-S7 Translation Patterns

The original S5 STL transfers to S7 STL (or SCL) almost line-for-line, but the syntax differs:

// S5 source
:L   KH  A001
:T   QW  64

// S7 STL equivalent
L    W#16#A001
T    QW  64

// S7 SCL equivalent ("cleaner")
QW64 := W#16#A001;
QW66 := W#16#0010;

// S7 Structured Text (IEC 61131-3) variant
QW64 := 16#A001;  // digital bit pattern
QW66 := 16#0010;  // digital bit pattern

Important detail: the S7 W#16# literal is unsigned 16-bit, exactly matching S5 KH. The older S7 B#16# would be wrong - it is only 8 bits and would truncate 0xA001 to 0x01, masking out 15 of the 16 intended bits.

9. Edge Case: QW Used as Bit-Cluster Without Any Module

Some legacy S5 programs write to QW addresses that have no module at all. The CPU simply overwrites a part of the process image that is never read back by hardware. The bits still toggle in the image, so the programmer can read them with A Q 64.0 / = Q 64.0 as if they were outputs. This pattern is functionally a flag cluster in disguise and should be migrated to M area in S7 to avoid confusion with real outputs that may be added later.

Diagnostic test: in STEP 5 online, set the QW and read the corresponding output LEDs on the rack. If the LEDs do not change, the QW is unassigned and is acting as a scratch register. In TIA Portal, the equivalent check is to put the CPU in "Monitor & Force" mode on the PII/PIQ and confirm that no slot reacts.

10. Edge Case: Mixed-Use QW in One Byte

It is also possible for a byte to be used as an analog channel on one bit and as a digital output on the other - although rare and almost always a bug in the S5 program. Example: an 8-bit S5 analog output module at byte 32 may share the same physical connector footprint as a 4-bit digital output. The S5 CPU cannot prevent the dual assignment; the programmer is expected to be aware of which channels are wired to which device. During migration, this must be untangled by either splitting the S5 QW into two separate S7 channels (one AO, one DO) or by documenting the unusual wiring and keeping the legacy assignment with comments in the S7 source.

11. Verification Checklist

Before commissioning a migrated S7 program that contains QW writes, perform the following:

1. Symbol table parity: Create a symbol table in TIA Portal / STEP 7 that maps every QW used in the S5 source to a meaningful S7 symbol. If the symbol name contains "AO" or "VALVE_OUT" but the actual hardware is a digital card, fix the name or the hardware.
2. Cross-reference check: Use the S5 "Cross-Reference" listing to find every read and write of the QW. If the value is read with L QW 64 in many places as a single 16-bit value, the intent is likely digital pattern. If the value is fed into scaling math, the intent is analog.
3. Force test in S7 PLCSIM: Load the migrated program into PLCSIM, force the QW, and watch the simulated channel. This catches 90% of addressing errors before going to the plant.
4. Voltage / current measurement on site: Put a multimeter or a current clamp on the output terminals while the S7 program runs. A digital output should sit at 24 V (or 0 V) steady. An analog output should ramp / modulate within the configured range.
5. Scaling boundary test: Force QW64 = 0 and QW64 = 27648 (or the S5 full-scale equivalent). The field instrument should reach exactly its 0% and 100% points. Any offset or gain error here means scaling constants need adjustment.

12. Common Pitfalls When Migrating

13. Safety Considerations for Migration

For plants that contain safety-relevant actuators (e.g., ESD valves, fire dampers, burner shut-off), the S5 program is often safety-related and cannot be migrated "bit-for-bit" without a fresh risk assessment per IEC 61511 / IEC 61508. S5 CPUs are no longer supported in safety-certified installations - consider a safety PLC (S7-1500F, ET 200SP F, or SIMATIC S7-300F) and re-engineer the safety function.

14. Reverse-Engineering Flowchart

The following decision tree summarizes the classification procedure for any QW encountered in S5 STL during a migration:

1. Locate the QW in the S5 source. Note the byte number (e.g., QW64).
2. Open the S5 hardware config. What module is at slot for byte 64?
3. If module is Digital Output (SM 322 / S5 6ES5 482 / similar) → QW is a digital pattern. Migrate as QW in S7 with the same byte offset. No scaling needed.
4. If module is Analog Output (SM 332 / S5 6ES5 466 or 470) → QW is a true analog command. Note the module's full-scale count. Migrate the value range and re-scale with FC105 / NORM_X / SCALE_X accordingly.
5. If no module is at the slot → QW is acting as a bit cluster. Migrate to M-area. Add a code comment explaining the original intent.
6. Cross-check the value being written: hex with isolated bits = digital. Decimal near 255 / 4096 / 27648 = analog. Anything else: verify with the S5 programmer's notes or the original commissioning report.

15. Quick-Reference Parameter Table

16. Tools for the Job

• STEP 5 to STEP 7 conversion tool (S5/S7 converter add-on) - automates STL translation and offset adjustments (DW n → DBW n-1).
• SIMATIC S5 to S7 Migration Guide - official Siemens migration methodology.
• Siemens Industry Online Support - datasheet and MLFB lookup for any S5 module.
• Siemens Industry Mall - replacement module / successor suggestion (for example, 6ES5 466-4UA11 → 6ES7332-5HF00-0AB0 for S7-300, or 6ES7532-5HF00-0AB0 for S7-1500).
• Standard PID and scaling function blocks for SIMATIC - reference for FC105 / FC106 replacement by NORM_X / SCALE_X in S7-1500.

17. Engineering Notes

In practice, the S5 STL segment shown above (with the 0xA001 / 0x0010 constant and the F101.0 hand-shake) is a textbook "send 16 bits to 16 valves, then latch the done flag" routine. Migrating it requires no scaling, no analog configuration, and no FC105. The work is purely STL → ST/SCL cleanup, plus a clean symbol table entry (for example, QW64 := "valve_pattern_1";). Engineers who default to "QW means analog" end up hunting for an AO card that does not exist and waste hours chasing a non-problem. Always classify the QW before assuming the hardware type.

FAQ