SCL TIA Portal: Direct I/O Access with %IW/%QW and PEEK/POKE

Overview: SCL in the TIA Portal Environment

SCL (Structured Control Language) is the IEC 61131-3 ST (Structured Text) compliant high-level language for SIMATIC S7-300, S7-400, S7-1200, S7-1500, ET 200SP CPUs, and WinAC RTX. Within TIA Portal, SCL replaces the classic STEP 7 SCL/STL editor pair, providing syntax-driven editing, integrated cross-reference, online watch, and full symbolic plus absolute addressing.

For engineers migrating from classic STEP 7, the most common question is how to read PIW 256 and write PQW 272 in SCL. This reference consolidates the syntax for every supported CPU family, distinguishes image-table access from peripheral-direct access, and covers the related indirect-addressing primitives (PEEK, POKE, VARIANT tags, and DB-Any pointers) that replace the legacy STL L PIW/T PQW patterns.

Prerequisites and Version Matrix

Before writing a single line of SCL, lock down three variables. The behavior of I/O accessors, the supported data types, and the presence of certain compiler optimizations depend on all three.

Inside TIA Portal, open the project tree, select the PLC, and confirm the firmware under PLC > Properties > General > Identification. The order number (MLFB) and firmware version appear in the identification panel. Cross-reference this against the TIA Portal release notes for the installed version.

Direct I/O Access Syntax in SCL: %I, %Q, %IW, %QW, %ID, %QD

SCL in TIA Portal uses the IEC 61131-3 standardized absolute address notation. The percent sign (%) prefixes the location, followed by size, area, and offset.

The TIA Portal compiler warns if the size of the operand does not match the surrounding expression. A %IW256 read into an INT tag is valid; assigning it to a BOOL triggers a type-mismatch error during the consistency check.

Example reads and writes in an SCL source file:

// SCL example: read input word, branch, and write output word
FUNCTION_BLOCK fb_IO_Access
VAR
    iRawAI      : INT;     // mapped to %IW256
    qRawAO      : INT;     // mapped to %QW272
    bEnable     : BOOL;    // mapped to %I0.0
    bFaultAck   : BOOL;    // mapped to %Q8.0
    rScaled     : REAL;
END_VAR

BEGIN
    // Read process image of inputs
    IF bEnable THEN
        iRawAI := %IW256;
        rScaled := INT_TO_REAL(iRawAI) * 0.1;
        qRawAO := REAL_TO_INT(rScaled);
    ELSE
        qRawAO := 0;
    END_IF;

    // Acknowledge fault
    IF %I0.1 THEN
        bFaultAck := TRUE;
    END_IF;

    // Write to output image
    %QW272 := qRawAO;
    %Q8.0  := bFaultAck;
END_FUNCTION_BLOCK

This is functionally equivalent to the classic LAD/FBD contact network that uses PIW256 and PQW272 in move boxes. The symbolic alternative ("AI_ProcessWord", "AO_ControlWord") is preferred for readability and is automatically updated by the cross-reference.

The :P Suffix for Peripheral-Direct Access

Standard %IW and %QW addresses access the process image, which is refreshed once per OB1 cycle (or at the configured update time for partial process images). When the application requires the value at the exact moment of access (for example, a high-speed input that updates between OB1 scans, or an output that must be updated immediately), use the :P (peripheral) suffix.

Direct peripheral access in SCL:

// Read the raw input word directly from the module
iRawStatus := %IW256:P;
// Write a control word directly to the output module
%QW272:P := iControlValue;
// Direct access to a single bit in the input peripheral area
bDiagFlag  := %I256.0:P;

The :P suffix is supported on S7-1500 and S7-1200 firmware V4.0 and later, and on S7-300/400 when the address is configured in the hardware. The S7-1200 firmware V4.0 release notes document the introduction of the peripheral-direct read for the high-speed counters on the CPU board.

PEEK and POKE for Indirect Addressing

When the I/O address must be computed at runtime (for example, indexing a vector of 16 analog inputs whose hardware slot is only known during commissioning), use the PEEK and POKE instructions. These are SCL system functions that read or write a single byte, word, or double word from a parameterized area at a parameterized byte offset.

The area constant is a hexadecimal literal that selects the memory region:

The byteOffset parameter is given in bits, not bytes. To address PIW256, the offset is 256 × 8 = 2048 bits. To address PQW272, the offset is 272 × 8 = 2176 bits.

PEEK example reading PIW256 as a word:

FUNCTION fc_ReadIndirectAI : WORD
VAR_INPUT
    iByteOffset : DINT;   // in bits
END_VAR
VAR
    wValue : WORD;
END_VAR
BEGIN
    wValue := PEEK_WORD(area := 16#81, byteOffset := iByteOffset);
    fc_ReadIndirectAI := wValue;
END_FUNCTION

POKE example writing PQW272 as a word:

PROCEDURE proc_WriteIndirectAO
VAR_INPUT
    iByteOffset : DINT;   // in bits
    wValue     : WORD;
END_VAR
BEGIN
    POKE(area := 16#82, byteOffset := iByteOffset, value := wValue);
END_PROCEDURE

For further detail, see the Siemens Industry Online Support entry ID 109011420, "In STEP 7 (TIA Portal), how can you implement indirect addressing in an SCL program?" which contains a full discussion of PEEK, POKE, VARIANT, and DB-Any pointer techniques.

CPU Family Differences

Although the SCL syntax is largely identical across SIMATIC families, the supported data types, instruction extensions, and addressing rules differ. Treat the following as a commissioning checklist.

For S7-300/400, the legacy STL approach of loading a word via L PIW 256 and transferring via T PQW 272 is still valid in TIA Portal, but SCL gives you a typed, debuggable equivalent that integrates with the cross-reference.

TIA Portal Version Considerations and Known Bug Classes

Field experience shows that SCL compilation passes differ noticeably between TIA Portal major versions. The following are recurring failure modes reported in production plants, summarized by major version family.

Always run the TIA Portal Software Update tool from the Siemens Industry Online Support portal and apply the latest Service Pack + Update combination for the installed major version. The release notes list every closed SCL compiler bug with the ID in the Entries database.

Code Example: Complete Function Block

The following FB reads eight 16-bit analog inputs from a parameterized base address, scales each with a per-channel gain and offset, and writes eight scaled values to a parameterized output base. It uses PEEK_WORD and POKE for indirect addressing, and demonstrates :P access for the diagnostics channel.

FUNCTION_BLOCK fb_AnalogVector
VAR
    aiBaseIn    : DINT;   // base byte offset of AI vector (bits)
    aoBaseOut   : DINT;   // base byte offset of AO vector (bits)
    aGain       : ARRAY[1..8] OF REAL := [8(1.0)];
    aOffset     : ARRAY[1..8] OF REAL := [8(0.0)];
    aScaled     : ARRAY[1..8] OF REAL;
    wDiagWord   : WORD;
    bOverflow   : ARRAY[1..8] OF BOOL;
END_VAR
VAR_TEMP
    i        : INT;
    iOff     : DINT;
    wRaw     : WORD;
    iRaw     : INT;
END_VAR
BEGIN
    FOR i := 1 TO 8 DO
        // Compute the bit offset for channel i (16 bits per word)
        iOff := aiBaseIn + (DINT_TO_DINT(i - 1) * 16);

        // Read raw value (peripheral-direct for diagnostics-grade latency)
        wRaw := PEEK_WORD(area := 16#81, byteOffset := iOff);
        iRaw := WORD_TO_INT(wRaw);

        // Scale
        aScaled[i] := INT_TO_REAL(iRaw) * aGain[i] + aOffset[i];

        // Range check
        IF aScaled[i] > 27648.0 THEN
            bOverflow[i] := TRUE;
            aScaled[i] := 27648.0;
        END_IF;

        // Write scaled value back to output vector
        iOff := aoBaseOut + (DINT_TO_DINT(i - 1) * 16);
        POKE(area := 16#82, byteOffset := iOff, value := REAL_TO_INT(aScaled[i]));
    END_FOR;

    // Diagnostics: read status word from PIW258 directly
    wDiagWord := %IW258:P;
END_FUNCTION_BLOCK

This pattern replaces a hand-written loop in STL with a type-safe SCL equivalent. The S7-1500 compiler optimizes the array indexing to the same code as the STL version, but the source remains portable and readable.

Documentation and Reference Hierarchy

The TIA Portal in-software help is the canonical source for SCL. Open it from Help > Show Help or press F1 on any SCL keyword. The relevant chapters are:

1. Programming concepts > Programming language > SCL > SCL expressions and operations — covers operators, precedence, and type conversion rules. See the public mirror at TIA Portal documentation cloud.
2. STEP 7 Professional manual, chapter 7.1.2.4 (SCL) — the printed reference, hosted as ID 109011420.
3. Accessing I/O devices — the in-software help section that explains the difference between process image access, direct peripheral access, and PROFINET IO slot addressing.
4. SITRAIN course TIA-SCL1 — instructor-led online training on SCL programming in TIA Portal, indexed at Siemens SITRAIN.
5. Programming and Operating Manual for the target CPU — the device manual lists the firmware-version-specific instruction set and any restrictions on indirect addressing.

For a first SCL block, the "Writing your first SCL code in TIA Portal" walkthrough provides a step-by-step procedure for project setup, FB/FC creation, interface definition, and the first compile/download cycle.

Commissioning and Verification Procedure

After the SCL block is written, validate it in five steps before releasing to production.

1. Compile the program in TIA Portal (Project > Compile > All or Ctrl+B). Resolve every warning, especially the ones that flag optimized-block access conflicts.
2. Download the block to the target PLC. The download dialog displays the firmware compatibility check; if the firmware does not match, the download is rejected.
3. Monitor online the block. Right-click the SCL block in the project tree, choose Open in SCL editor, then click Monitor on/off to attach the SCL debugger. Set breakpoints on the %IW/%QW lines and step through the cycle.
4. Force / overwrite an output to validate the write path. Use a watch table on the tag mapped to %QW272 and set the value. The output module should respond within one OB1 cycle for image access, or within the backplane latency for :P access.
5. Document the access pattern in the function specification. Record the hardware slot, the I/O address, the symbol name, the scaling, and the SCL block number. This information is required for the as-built documentation and for any subsequent maintenance work.

Troubleshooting Matrix

FAQ