S7 SIMATIC Manager: Finding Indirectly Addressed Digital Inputs

1. Problem Statement

A classic STEP 7 / SIMATIC Manager diagnostic dilemma: a digital input (DI) is clearly active because the channel LED on the distributed I/O module is lit, and removing the field wire immediately stops the machine, yet the address never shows up in Cross-References (Querverweis) or as a symbol in the online/offline program. The standard Go to Location → Overlapping areas search returns nothing useful, and searching by I-symbol alone is inconclusive because the I-address is consumed indirectly through a pointer.

This article documents the full diagnostic procedure used to resolve this class of problem on S7-300 / S7-400 stations with ET200 distributed I/O on Profibus-DP, including programs using a CP342-5 as a DP master or a CPU with integrated DP interface. The same procedure applies to ET200S, ET200M, ET200pro, and ET200iSP; the addressing and indirect-access patterns are identical.

2. Root Cause: Why the Input Disappears from Cross-References

Cross-reference data in STEP 7 is generated from the static operand table of the loaded blocks (OB, FB, FC, DB, UDT). The analyzer walks the compiled code and indexes every direct operand reference. It cannot resolve operands that are computed at runtime, so the following access patterns are invisible to the cross-reference generator:

• Area-register indirect: A I [AR1, P#0.0], = Q [AR2, P#2.1]
• Memory-indirect (intra-area): A I [MD 100], L IB [MD 0]
• DB-indirect (cross-area): L IB [DBD 20]
• Symbolic / parameter indirect: A I [#dwInputAddr]
• Pointer literals: L P#I 12.0 or L P#Q 8.0
• Direct periphery access on the slave image of a CP342-5: L PIB 256 (read from the DP slave's I-area, not the CPU process image)

If the ET200 station is gated through a CP342-5 acting as a DP master, the I/O are typically mapped into a data block using FC1/FC2 (DP_SEND / DP_RECV) supplied with the CP, with the I/O image rotated inside the DB. The DI you see on the module LED will then be present only as a bit inside a DB byte — which is why Go to Location on the I-address shows nothing. See the official SIMATIC NET CP342-5 / CP343-5 Manual for the FC1/FC2 calling convention and the per-slot I/O offset map.

3. Hardware Identification: ET200, CP342-5, Profibus Topology

Before any software search, confirm the physical topology. This determines where the I-bits actually live:

Open HW Config and read the Profibus topology from the project tree. For each ET200 station, note the slot of the DI module and the configured I address range assigned by STEP 7. If the address shown in HW Config matches the address you searched, the absence from cross-references is firm evidence of indirect access. Refer to the ET200S Distributed I/O System Manual or ET200M Distributed I/O System Manual for slot and I-address conventions.

4. Indirect Addressing Forms Used in S7

STEP 7 STL supports two families of indirect addressing: area-register based and memory-indirect. Both are evaluated at runtime, and the operand the CPU actually reads is therefore a computed value that does not appear in the cross-reference table.

4.1 Area-register indirect (AR1/AR2)

L     P#I 12.0        // load pointer to I 12.0
LAR1                  // store in AR1
A     I [AR1, P#0.0]  // bit-test of I 12.0 (offset 0)
=     M 100.0
A     I [AR1, P#4.2]  // bit-test of I 16.2 (offset 4 bit 2)
=     M 100.1

The square-bracket form [AR1, P#x.y] is fully resolved at runtime. STEP 7 lists the literal I token but cannot know which bit is being tested. Go to Location on I 12.0 may or may not find this site, depending on whether the displacement matches the snapshot it generated during cross-reference build.

4.2 Memory-indirect (intra-area)

L     P#I 32.0        // pointer literal
T     MD 100          // store as 32-bit pointer in MD100
A     I [MD 100]      // bit-test of address held in MD100

The operand is MD 100, not I 32.0; cross-reference sees the load/store of MD 100 and a generic A I [ pattern. A textual search for A I [MD or L IB [MD is the only way to enumerate all such access sites in a project.

4.3 DB-indirect (cross-area)

L     DBD 20           // load pointer from data block
T     MD 200           // copy to work memory
L     IB [DBD 20]      // load input byte at the pointer value

This pattern frequently appears in CP342-5 user code, where the DP slave image is staged into a DB and pointers reference the byte inside the DB. It also appears in custom FB parameter forwarding. See the STEP 7 Programming with STL / SCL Reference Manual for the formal syntax and the area-crossing rules.

4.4 Symbolic / FB-parameter indirect

FUNCTION_BLOCK FB_ReadInput
VAR_INPUT
  dwAddr : DWORD;     // input pointer
END_VAR
BEGIN
  A   I [dwAddr];     // bit-test of address passed by caller
END_FUNCTION_BLOCK

The pointer value is computed in the calling block. Tracing requires you to find every call site of FB_ReadInput and inspect the actual dwAddr argument at runtime (VAT or instance DB).

5. SIMATIC Manager Tools for Unmasking the Address

Use the following tools in this order. Each one progressively widens the search net.

5.1 Assignment list (Belegungsplan)

1. Right-click Blocks folder → Reference Data → Display.
2. From the menu: Options → Reference Data → Assignment List.
3. Filter for the I-byte range reported by HW Config (e.g., I 8 for slot 4 of an ET200M).
4. Even when the cross-reference column is empty, the assignment list shows whether any process image update (OB1 / OB100) or PIQ load touches the byte.

5.2 Program structure (Programmstruktur)

Options → Reference Data → Program Structure lists every block called and its nesting. Confirm whether a CP342-5 FB1/FB2/FC1/FC2 wrapper is present, which is a strong signal that the DI is consumed inside the data block of the CP. See SIMATIC NET CP342-5 Functions (FC1/FC2) Programming Notes.

5.3 Cross-reference regeneration

1. Options → Reference Data → Generate (rebuild the entire DB).
2. Repeat Go to Location with the Overlapping access and Absolute and symbolic checkboxes set.
3. Toggle View → Symbolic Representation off so the literal I-address is displayed.

Even with a clean regeneration, indirect calls will not appear. The next step is mandatory: export the source and grep the project.

6. Source-File Text Search Workflow

STEP 7's reference data cannot help you here; a textual search through the generated source files of the compiled blocks is the only exhaustive option. Procedure:

1. In SIMATIC Manager, select the Blocks container.
2. Options → Generate Source → choose All blocks → save as e.g. ALL_BLOCKS.src.
3. Open the .src file in a text editor (Notepad++, VS Code, UltraEdit).
4. Search the exact byte offset of the I-address range from HW Config. Use a regex or multi-line search.

6.1 Patterns to search

For each hit, note the parent block (FC/FB/OB) and the line number. The pointer literal is what the runtime operand resolves to; if the search returns L P#I 12.0 in FC101, the pressure switch is almost certainly wired to the DI module mapped at I 12.x.

6.2 Using the FC1/FC2 wrapper for CP342-5

When the ET200 station is mounted behind a CP342-5 in DP-Master mode, the I-bytes are normally copied into a project-specific data block by the call CALL FC 2 (DP_RECV). The receiving DB has the same name pattern as the CP, e.g. DB200 for CP342-5 at slot 4. Search the source files for:

• CALL FC 2
• CALL FC 1
• SFB 52 / SFB 54 (RDREC / WRREC, for diagnostic records on the IM153)

Then open the receive DB in SIMATIC Manager and walk each byte back to the I-address defined in HW Config for the ET200. The offset in the receive DB equals the configured I-offset of the slot. This is documented in the SIMATIC S7-300 CP342-5 Operating Instructions.

7. Pointer Tracking Through Data Blocks

When the I-address is not accessed as a literal at all — it is built dynamically from a DB pointer — perform the following trace:

1. Open the data block (DB) that contains the pointer in Data View (S7-DB).
2. Open the corresponding Monitor/Modify window (Ctrl+F7) and watch the DWORD value at the offset referenced in step 6 of section 6.
3. Decode the DWORD as a pointer per the S7 pointer format: byte 0 = 0x81 (input area), byte 1 = 0x00 (intra-area), bytes 2-3 = byte number (×8 + bit number). Example: DW#16#81000030 = I 6.0 (0x30 = 48 = 6×8 + 0).
4. Walk the program call tree that loads this DWORD. The block that computes the pointer and the block that uses it are usually two different FBs.

7.1 Pointer-format cheat sheet

Decode the live DWORD from the DB and you have the exact I-address your pressure switch is on.

8. Online Diagnostics When the Source Is Found

Once the I-address is identified — even if it lives in an FB parameter — you can finally monitor it directly.

1. PLC → Monitor/Modify → Monitor (All).
2. Enter the I-address in the form I 12.0 (bit) or IB 12 (byte) and tick the All radio button.
3. Press the Monitor (glasses) icon. The bit should now toggle in real time with the LED on the module.

If it still shows 0:

• Confirm you are not looking at the CPU process image. The I-bit may be read with L PIB 256 (direct periphery, P prefix) instead of L IB 256. Periphery access bypasses the PAE and is invisible in the IB monitor.
• Open PLC → Diagnostic → Module Information on the DI module and verify the channel is not in Wire-break or Short-circuit (ET200S / ET200pro have built-in diagnostics).
• Use the IM153-2 diagnostic buffer for ET200M stations: PLC → Diagnostic → Module Information → Diagnostics Buffer. Event ID 0x39A1 (channel fault on a digital channel) or 0x39A2 (channel OK again) confirms the field side.

9. CP342-5 and DP Master Configuration Notes

The CP342-5 in DP-Master mode is a frequent culprit. Configuration specifics:

• Open HW Config → CP342-5 properties → Operating Mode and confirm DP Master is selected. The I/O is not mapped into the S7-300 process image in this mode — it is in the CP's own dual-port RAM.
• The user must call FC2 (DP_RECV) in OB1 to copy the CP's input image into a project DB. Without that call, the inputs are completely invisible in the program.
• Per-slot offsets are configured in Properties → Addresses of the CP342-5. The first configured slot starts at IB 0 of the receive DB by default but can be remapped to any byte offset in the DB.
• If the program was generated with the wrong slot number, the I-bit will not align with the DI in the receive DB. The mismatch shows up as the LED on the module changing state but the corresponding DBX remaining 0.

For a working reference, see the SIMATIC NET CP 342-5 Manual, Edition 11/2018 and the application note "CP342-5 as DP Master with FC1 / FC2".

10. Verification Checklist

Use this matrix to confirm the diagnostic is complete.

11. When the Project Will Not Be Hosted

If you cannot share the STEP 7 project for IP reasons, the next-best artifact for remote support is a de-personalized export bundle containing:

1. Generated source files for all blocks (.src).
2. HW Config screenshot of the relevant ET200 station showing the slot-to-I-address mapping.
3. Symbol table export (Options → Symbol Table → Export) stripped of any OEM names.
4. The cross-reference and assignment-list printouts (PDF).
5. The decoded pointer DWORDs from any data blocks involved.

Without these, the engineering cost of finding an indirectly addressed DI rises from 10 minutes to multiple hours. See the official STEP 7 V5.7 Getting Started for a refresher on the export menus.

12. Reference Material and Standard Verification

All configuration limits in the table below must be verified against the current edition of the manuals. The numbers are typical for S7-300 / ET200M; the exact value depends on the CPU firmware version and the IM153-2 article number.

13. Quick Procedure Summary

1. Read the DI module I-address from HW Config (slot → I-byte).
2. Confirm LED behaviour matches the field switch.
3. Regenerate cross-reference and check the assignment list.
4. Export all blocks to source and run a regex search for indirect patterns.
5. If a CP342-5 is present, inspect FC1/FC2 calls and the receive DB.
6. Decode any pointer DWORDs in DBs to recover the I-address.
7. Online-monitor the recovered address and verify it tracks the LED.
8. Document the path in the symbol table and re-compile the project.