S7-1200 Output Q65.0 Missing: TIA Portal Cross-Reference Guide

1. Problem Statement: Inherited Program with Untraceable I/O

You have inherited a SIMATIC S7-1200 program from a previous engineer and need to physically locate two output addresses that drive a cylinder permissive circuit:

• Q65.0 — referenced in the logic as the cylinder-allow output.
• Q0.0 — toggled by an operator panel switch but not visible in the device view.

The hardware topology is a S7-1214 (or S7-1215) CPU connected over PROFIBUS DP to a S7-300 CPU 31x. The project was originally built in TIA Portal V13 and later upgraded to V14 (V14 SP1, V15, V15.1, V16, V17, or later are common in the field). After the upgrade, addresses were re-indexed and the device view can be greyed out for slaves whose hardware catalog is not licensed or not loaded.

The symptom: cross-references resolve, the logic compiles, but the physical I/O channel cannot be identified, and the engineer is not sure whether the output is a local head output on the S7-1200, a PROFIBUS DP slave output, or a remote bit transferred from the S7-300.

2. Root Cause Analysis

Three causes explain 95% of the "cannot find the output" symptom on inherited S7-1200 programs:

Direct answering of the engineer's two questions:

1. Can a S7-300 directly access the S7-1200 outputs without any mapping in the S7-1200? No. The S7-1200 is a PROFIBUS DP slave in this configuration (CM 1242-5, order number 6GK7242-5DX30-0XE0). It only exposes the process image that the master (S7-300) reads using standard DP I/O slots. There is no implicit PEEK/POKE between controllers — every byte must be configured as an I/O slot in the device configuration of the CM 1242-5.
2. Can a TIA V13 → V14 upgrade change Q0.0 to Q65.0? Indirectly, yes. The upgrade does not rename the address, but if the engineer added or removed signal modules / DP slaves between versions, TIA Portal re-computes the address map and the cross-reference table re-maps the symbol. Always check the I/O addresses tab of every module before and after upgrade.

3. S7-1200 I/O Address Map: What Goes Where

The default process image on common S7-1200 CPUs is fixed. The following table lists the usable output address space.

Key rule: no physical S7-1200 output is wired to Q65.0. Byte 64+ is reserved for:

• PROFIBUS CM 1242-5 (slave side) — output process image to the DP master.
• PROFINET IO device slot on a PROFINET controller side, when the S7-1200 is the controller.
• CP 1243-1 / CP 1242-7 / CP 1243-7 / CP 1243-8 telecontrol channel handles (rare, but seen in field programs).
• F-I/O when the F-CPU variant is configured.

4. TIA Portal Cross-Reference Procedure

Use the cross-reference inspector to find the user of an address. The standard keyboard accelerator is Shift + F11 on the selected tag, or the menu Edit → Cross-references.

1. Open the program editor (LAD/FBD/ST).
2. Select the tag (for example "Cylinder_Allow" or %Q65.0) by clicking on it.
3. Press Shift + F11. The Inspector window opens the Cross-reference tab.
4. Filter by column: Address, Name, Access (read/write), and Block.
5. Expand the result. The "Used in" column shows the network and block that writes the output. The "Source" column shows the tag table where the symbol was declared.

If the cross-reference shows no writer but multiple readers, the address is being written from a different CPU (PROFIBUS DP master, i.e., the S7-300) or from an HMI tag binding.

5. PLC Tags and Default Tag Tables

Open the project tree and drill into PLC → PLC tags → Show all tags. Two tag tables are created by default:

• Default tag table — contains the I/O symbolic names (auto-generated on first compile).
• User-defined tag tables — added by the programmer (for example Motors, Valves).

In the Show all tags view, the Address column shows the absolute address. To find an unknown tag:

1. Click the Address column header to sort ascending.
2. Scroll to byte 65 — note every row and the Hardware identifier column.
3. If the row reads QB 65 with an HW identifier such as 267, that byte belongs to the CM 1242-5 slave interface (HW IDs in the 260–299 range are PROFIBUS modules).
4. Right-click the row → Go to device. TIA Portal jumps to the slot in the device view.

If Q0.0 is missing from the default tag table, check for partial-word declarations:

• QB 0 — entire byte 0.
• QW 0 — entire word (Q0.0 to Q0.7, Q1.0 to Q1.7).
• QD 0 — entire doubleword (Q0.0 through Q3.7).

When a programmer declares QW0 or QD0 in a tag table, TIA Portal will not expose the individual Q0.0 entry until the project is recompiled. Right-click the PLC → Compile → Software (rebuild all blocks). After the compile, the address list regenerates.

6. Device View Greyed-Out: What It Means

The engineer reported that the Device view option was greyed out when trying to right-click Q0.0. This is a strong signal that the address belongs to a distributed I/O subsystem rather than a head module:

• The CM 1242-5 (PROFIBUS DP slave) on the S7-1200 does not have a separate device view for its I/O — the I/O is owned by the S7-300 master project, not the S7-1200 project.
• To see the slot, you must open the S7-300 master project in TIA Portal. Navigate Devices & Networks → Network view → CM 1242-5 on the DP line → the I/O addresses are listed under Properties → I/O addresses.
• Alternative: open the S7-300's HW Config (or the equivalent TIA device view) and inspect the slave's slot configuration.

7. S7-1200 ↔ S7-300 PROFIBUS Connectivity

The S7-1200 family cannot speak PROFIBUS DP natively — it requires a communications module. Two options exist:

In the field scenario, the S7-1200 is the slave, the S7-300 is the master. The data exchange works as follows:

1. Configuration in the master (S7-300): The CM 1242-5 is added as a slave in HW Config. Up to 244 bytes of input and 244 bytes of output are mapped. The starting address in the S7-300 is set in the slave's properties.
2. Configuration in the slave (S7-1200): TIA Portal inserts the CM 1242-5 as a slot in the S7-1200 device view. The slot's I/O addresses are fixed by the master — but the slave does not see them as "own" outputs; it sees them as DP slave slot I/O.
3. Address space: A CM 1242-5 typically reserves 244 input bytes and 244 output bytes. On a CPU 1214, this places the DP I/O at IB 64 – IB 307 and QB 64 – QB 307. A common real-world layout is QB 64 for the first 32 bytes, QB 96 for the next, etc. — but the actual start address is hardware-specific to the slot configuration in the master.
4. Confirm in the slave's online diagnostics: Online & diagnostics → PROFIBUS DP → Diagnostic. The slot's I/O are listed with their active and configured length.

8. PUT/GET S7 Communication (Cross-Controller Bit Transfer)

If Q65.0 is not a PROFIBUS slot but a transferred bit, the S7-300 and S7-1200 are exchanging data using the S7 communication protocol with PUT and GET instructions. The mechanics:

• The S7-300 calls PUT to write a data block in the S7-1200 (e.g., DB100.DBB0). The S7-1200's logic uses that data area to set internal flags or directly set an output.
• Alternatively, the S7-300 calls PUT to write directly into the S7-1200's process image — this is allowed only for addresses that are not already assigned to a physical or distributed I/O. The function block PUT from the standard library uses a ANY pointer that targets the S7-1200's input, output, DB, or bit memory area.
• The S7-1200 must allow PUT/GET access from the partner. In TIA Portal: Device configuration → Properties → General → Protection & Security → Connection mechanisms → Permit access with PUT/GET communication from remote partner. This must be checked; otherwise the S7-300's PUT will be refused with a connection error.
• Refer to the S7-1200 system manual section on S7 communication and the application example "S7 Communication with PUT/GET for S7-1200".

9. Step-by-Step Diagnostic Procedure

Use this ordered workflow to find the physical location of any inherited S7-1200 output address.

1. Open TIA Portal → open the S7-1200 project. Confirm the project version (file → properties → version).
2. Open the project tree → PLC → PLC tags → Show all tags. Sort the address column ascending. Search for Q65.0 and Q0.0. Note the HW identifier column for both.
3. Cross-reference: Click on the tag in the program editor, press Shift + F11. Read the writer block. If the writer is in OB1 of the S7-1200, the bit is local. If the writer is on a different CPU, the bit is transferred.
4. Check the device configuration: Devices & Networks → Device view. Locate every slot starting at byte 64. The CM 1242-5, CM 1243-5, and any PROFINET IO device show their input/output address ranges in the inspector pane.
5. Search for symbol-to-tag mappings: Project tree → Common data → Cross-references. Generate the cross-reference; the result table contains every reference in the project including HMI tag bindings.
6. Check HMI and SCADA: Open the HMI project. HMI tags → Connections → HMI connections. Look for tags named Q0.0, Output_Q65_0, or any alias that points to a S7-1200 absolute address. The HMI write is a valid writer.
7. Cross-check with the S7-300 master project: Open the S7-300's project. HW Config → PROFIBUS DP → CM 1242-5 slave properties → I/O addresses. The first byte of the output slot is the byte that ends up at QB 64 in the S7-1200 by default. The mapping is one-to-one and contiguous in the order defined in HW Config.
8. Verify online: With both CPUs in Online & diagnostics → Monitor & force, force Q0.0 low and observe the cylinder permissive. If the permissive still drops, the S7-300 is overwriting the bit — you have located a transferred bit.
9. Check the protection settings: Confirm Permit access with PUT/GET on the S7-1200 and the connection resource list (max 8 PUT/GET connections on a CPU 1214/1215).

10. Verifying the Fix

Once the source of the writes is identified, apply a structural fix and re-verify:

1. Re-symbol the addresses: PLC tags → Default tag table → right-click the row → Define as …. Give the tag a meaningful name (for example Cylinder_Allow_Permissive).
2. Add a comment in the Comment column documenting the physical location, the master PLC, the slot, and the date.
3. Save and compile the project. Open the cross-reference; confirm the writer is unique and the address no longer appears as a duplicate.
4. Download the project to the S7-1200. Monitor online; toggle the operator-panel switch and confirm Q0.0 follows the switch. Toggle the S7-300's permissive bit and confirm Q65.0 follows.
5. Update the schematic: if a drawing exists, label the CM 1242-5 output channel numbers and the corresponding S7-300 input byte. If no drawing exists, produce one and file it in the project archive.
6. Document the TIA Portal version, the CM 1242-5 firmware version (displayed in Online & diagnostics → Module information → Firmware), and the GSD file version used for the DP slave.

11. Troubleshooting Matrix

12. Standards and Reference Material

Cross-check your work against the following official documents:

• SIMATIC S7-1200 Programmable Controller System Manual — section 6 on addressing and process image.
• CM 1242-5 Manual — section on I/O configuration and slot mapping.
• S7 Communication with PUT/GET (S7-1200 / S7-1500) — application example with function block wiring.
• SIMATIC S7-300 CPU 31xC and CPU 31x Manual — section on PROFIBUS DP master configuration.
• PROFIBUS International — IEC 61784-1 (CPF 3) for PROFIBUS DP and IEC 61158 for the fieldbus data-link layer.

13. Frequently Asked Questions