S7-1500 AQ Module: Fixing QW21/QW22 Output Address Channel Error

The SIMATIC S7-1500 analog I/O module AI 4xU/I/RTD/TC / AQ 2xU/I ST ships with 4 analog input channels and 2 analog output channels. A common first-time integration error on this module is writing to %QW21 and %QW22 expecting two adjacent word addresses, then watching both output terminals (pins 21 and 25) remain flat at 0 V. The cause is not a wiring problem, a failed module, or a bad cable — it is a word-alignment conflict in the process image that corrupts both channels when only the second word is written.

This reference walks through the symptom, root cause, and the canonical fix for the S7-1500 AQ module under TIA Portal V14 SP1, and extends to the same problem class on S7-1500/ET 200MP analog I/O in general.

1. Problem Summary

Engineer Daniel configured the S7-1500 AI 4xU/I/RTD/TC / AQ 2xU/I ST module for 0–10 V voltage output on both channels in TIA Portal V14 SP1. In his program, he wrote to %QW21 for output 0 and %QW22 for output 1. With the start address set to 21 in the device configuration, the expected behavior was a variable voltage between 0 V and 10 V on the physical pins 21 and 25 of the front connector. The actual behavior was no change at all on either output.

The diagnostic question is always: does the digital-to-analog conversion pipeline even see the value the program is writing? In Daniel's case it does not, because the second output channel is addressed through %QW23, not %QW22.

2. Affected Hardware and Software

The module name AI 4xU/I/RTD/TC / AQ 2xU/I ST is the equipment-manual designation. It identifies the 2-channel AQ portion (AQ 2xU/I ST) of the combo module: two outputs, each configurable as voltage (U) or current (I), standard temperature range (ST).

3. Root Cause: Analog Channels Are Word-Aligned

Every analog channel on the S7-1500 occupies 2 bytes = 1 word in the I/O process image. The mapping is sequential, not interleaved, and the CPU only ever moves full words (16-bit transfers) into the analog output registers. There is no half-word (byte) write path for analog outputs.

For a 2-channel AQ block with a configured start address of 21 (decimal):

• Channel 0 → %QW21 (bytes %QB21, %QB22)
• Channel 1 → %QW23 (bytes %QB23, %QB24)

There is no %QW22 occupied by an analog channel. The address %QW22 overlaps channel 0 (its high byte) and channel 1 (its low byte). When the program writes to %QW22, it overwrites the upper byte of channel 0 and the lower byte of channel 1 with garbage. Channel 0 may now show a wildly wrong voltage, and channel 1 may be similarly corrupted or held in a fault state. Worse, in many TIA Portal builds the CPU's process-image writeback to the module is suppressed if a partial-word collision is detected, so neither channel updates.

The address and the physical pin number are unrelated. Pin 21 of the front connector carries the channel-0 voltage whether the configured start address is 0, 21, or 256. Pins do not have their own addresses; they are simply hard-wired to internal DACs.

4. Module Pinout (AI 4xU/I/RTD/TC / AQ 2xU/I ST)

The 40-pin front connector assigns the analog output pins as follows (per the equipment manual, page 23 in the cited edition):

For voltage output, wire the load between the V+ pin (21 or 25) and Mana (22 or 26). Mana is the analog ground reference for the output stage and must be tied to the load's signal ground. For current output, use the I / Mana pin pair, observing polarity per the manual.

5. Configuring the Output Range (0–10 V) in TIA Portal V14 SP1

The module's two output channels each support multiple hardware ranges. The output type and range are configured per channel, not globally. Voltage options on this module:

• 0–10 V (unipolar)
• 1–5 V (unipolar)
• ±10 V (bipolar)

Current options:

• 0–20 mA (unipolar)
• 4–20 mA (unipolar)
• ±20 mA (bipolar)

Procedure in TIA Portal V14 SP1:

1. Open Devices & Networks in the project tree.
2. Double-click the AQ module to open Device View.
3. Click the module icon (the slot in the rack).
4. In the Properties inspector, select the Output tab.
5. For each channel, expand the channel node and set Output type to Voltage.
6. Set Output range to 0..10 V.
7. Click Apply or OK.
8. Compile the hardware configuration and download to the CPU.

Daniel already performed steps 1–8 correctly. The configuration itself was not the bug; the bug was the program-side address.

6. Setting the Start Address in the Device Configuration

The start address is the only field the user is permitted to edit for analog I/O modules in the I/O address list. The end address is auto-calculated.

1. Open Device View for the AQ module.
2. Click the module icon.
3. Select the Properties → I/O addresses tab.
4. Uncheck System default in the Output addresses group.
5. Type the desired start address in the Start address field. The end address appears automatically as start + 3 for this 2-channel module (4 bytes total: start, start+1, start+2, start+3).
6. Compile and download the hardware configuration.

For start address 21, the resulting address range is 21–24. Channel 0 occupies bytes 21 and 22 (word 21), channel 1 occupies bytes 23 and 24 (word 23). Any program symbol that references the module should use %QW21 and %QW23.

7. Programmatic Output: 16-bit Value to 0–10 V Mapping

After hardware configuration, the S7-1500 expects each AQ channel to be driven by a 16-bit integer whose numeric value maps linearly to the configured range. For 0–10 V unipolar voltage:

The same scaling constant 27648 applies to all unipolar ranges on S7-1500 analog outputs (0–10 V, 0–20 mA, 4–20 mA, 1–5 V). For bipolar ranges (±10 V, ±20 mA) the mapping is −27648 → negative full scale, 0 → mid-scale, +27648 → positive full scale.

SCL example

// 0-10 V output on channel 0 (QW21)
"DB_AO".rVoltage := 0.0..10.0;        // engineering range
"DB_AO".iRaw := REAL_TO_INT("DB_AO".rVoltage * 2764.8);
%QW21 := "DB_AO".iRaw;

// 0-10 V output on channel 1 (QW23)
"DB_AO".iRaw1 := REAL_TO_INT("DB_AO".rVoltage1 * 2764.8);
%QW23 := "DB_AO".iRaw1;

Ladder / FBD equivalent

Use a MOVE instruction from a scaled INT tag to %QW21 and a second MOVE to %QW23. Do not use a single MOVE from a DWORD to %QD21 if you also need to read back the high byte of channel 0; doing so can cause the same partial-word corruption on the read side.

8. Verification Procedure

1. Download the hardware configuration to the CPU.
2. Download the program to the CPU.
3. Switch the CPU to RUN.
4. Right-click the AQ module in Devices & Networks → Online & Diagnostics.
5. Open the Output value tab. Confirm that the start address shown matches your program (%QW21, %QW23).
6. Force a known digital value (e.g., 13824 = 5.000 V on the 0–10 V range) by writing to %QW21 in the watch table.
7. Measure the voltage between pin 21 (+) and pin 22 (return) of the front connector with a calibrated multimeter.
8. Expected reading: 5.000 V ±0.5% of full scale, assuming the module is at nominal temperature (25 °C).
9. Repeat steps 6–8 for channel 1 using %QW23 and pins 25/26.

If the meter reads 0 V on both channels with the correct addresses and known-good values, the next thing to check is the module's Diagnostics tab — a "Configuration error" or "Channel fault" message indicates that the start address you see in the online view does not match what the module expects from the loaded hardware configuration.

9. Troubleshooting Matrix

10. Edge Cases and Field-Proven Caveats

10.1 Renumbering After Re-Racking

Inserting a new module between the CPU and the AQ block can shift the start address in TIA Portal's auto-numbering. Always re-verify the I/O address list after any rack topology change. A common symptom is a previously working program that suddenly stops writing to the correct address because the start address was bumped to 25, 29, or higher.

10.2 Behavior on CPU STOP

Under Output behavior on CPU STOP in the module properties, three options exist:

• Keep last value — output stage holds the last value written before STOP. Required for fail-safe applications where reverting to zero could be hazardous.
• Substitute value — a user-defined value is output. Useful for setting a known safe value (e.g., 0 V for a normally-closed valve).
• Output 0 — output stage drives 0 V / 0 mA (or 4 mA on 4–20 mA range, depending on firmware).

If a process is being commissioned and the output "doesn't move" during a fault, check this setting first. A configured substitute value of 0 may be the cause, not the symptom.

10.3 Firmware Considerations

TIA Portal V14 SP1 supports firmware versions as documented in the S7-1500 system manual. Modules with newer firmware may not be fully visible in V14 SP1 without an updated HSP. For long-running installations, keep the TIA Portal version and the module firmware aligned within Siemens' compatibility matrix to avoid sporadic channel faults related to diagnostic-frame format changes.

10.4 Per-Channel Diagnostics

Each output channel can independently report:

• Wire break (current outputs only)
• Overflow / underflow
• Short circuit (voltage outputs)
• Load voltage failure (no 24 V L+ at pin 40)

Enable these under Properties → Output → Diagnostics on a per-channel basis. The module raises a channel diagnostic interrupt that the OB82 (Diagnostic Interrupt) processes. The OB82 input parameters identify the channel and the fault code.

10.5 Word vs. Byte Access

Although the CPU allows byte-level symbolic access to %QB21 and %QB22, doing so on an analog output is a programming defect. The module expects a 16-bit value at the start of each channel. If your logic genuinely needs byte-level manipulation, the data must be assembled into a full word before being moved to %QW21 or %QW23. The same caution applies to PEEK/POKE instructions in SCL — use the process-image symbols rather than absolute address arithmetic.

10.6 Differences vs. S7-300 / S7-400

The 2-byte-per-channel rule is identical on S7-300 SM 332 and S7-400 SM 432 analog outputs. The only difference is the engineering interface: SIMATIC Manager HW Config shows the channel addresses in the same way, but the device-view workflow is different. Engineers migrating from S7-300 should treat the address mapping as unchanged and revalidate only the configuration workflow.

10.7 Differences vs. ET 200SP Analog Outputs

ET 200SP analog output modules (e.g., AQ 2xU/I HS, AQ 4xU/I ST) follow the same word-alignment rule but use BaseUnits with separate slot numbering. The start address is still on a word boundary and the channel stride is still 2 bytes, but the address range may be much wider (e.g., 256+) depending on the ET 200SP station layout.

11. Related Siemens Documentation References

For the official equipment manual, refer to Siemens Industry Online Support and search for the title SIMATIC S7-1500/ET 200MP Analog Input/Output Module AI 4xU/I/RTD/TC / AQ 2xU/I ST. The manual's section 5 (Parameter assignment / Wiring) documents the pin-to-channel mapping shown in section 4 above, and section 6 (Functions / Interrupts / Diagnostics) documents the diagnostic interrupt sources cited in section 10.4.

For the TIA Portal V14 SP1 environment, see the S7-1500 Programmable Controller System Manual in the same support portal; it documents the process-image model and I/O address rules that the AQ module inherits.

12. FAQ