Siemens S7-300 Direct Access I/O: PIW and PQW in OB1

The Siemens S7-300/S7-400 CPU executes OB1 in a fixed scan cycle that begins by copying the physical inputs into the input process image (PII / PAE), runs the user program, and ends by copying the output process image (PIQ / PAA) back to the physical output modules. This architecture guarantees deterministic, time-coherent I/O behavior, but it also creates a well-known problem: an input transition that occurs in the middle of OB1 is invisible until the next cycle, and an output that is set mid-cycle does not reach the terminals until the PAA copy at the end of the cycle. When OB1 is short (a few milliseconds), the latency is rarely an issue. When OB1 is long—tens or hundreds of milliseconds because of heavy math, recipe handling, or communication—fast digital events slip through the cycle unnoticed.

This reference documents the two official Siemens mechanisms for breaking out of that process-image model: (1) direct peripheral access using the PIW/PQW operand area, and (2) hardware-driven interrupt OBs (OB40–OB47) and time-driven cyclic OBs (OB30–OB38). Both are documented in the STEP 7 programming manuals and the S7-300 module data manuals; both can coexist with the standard process image; both have well-defined restrictions that field engineers must respect.

1. Process Image Architecture and the Source of Mid-Cycle Latency

The S7-300 CPU maintains two reserved areas of bit-memory (Merker/Flag) that mirror the physical I/O:

The system scan sequence inside OB1 is roughly:

1. Start of OB1: update PII — CPU reads every configured input module byte-by-byte into the PII.
2. Execute user program from network 1 to the last network.
3. End of OB1: flush PIQ — CPU writes the PIQ back to every configured output module.
4. Run self-diagnostics, communication housekeeping, and (if configured) priority-class processing.
5. Restart OB1.

The I-access (L IW 0) always returns the snapshot taken at the start of the cycle. A Q-access (T QW 4) updates the PAA only; the actual terminal does not change state until step 3. If a 1 ms input pulse arrives between step 2 and the next step 1, it is lost. This is the classic justification for direct peripheral access and for interrupt OBs.

2. Direct Peripheral I/O: PIB, PIW, PID, PQB, PQW, PQD

STEP 7 exposes the physical backplane address space through the peripheral (P) operand area. A direct access bypasses the PII/PIQ and reads/writes the I/O module on the same STEP 7 instruction cycle. The operand is available in three widths:

The address <addr> is the byte address shown in HW Config under the module's I/O area, e.g. PIW 288 for the first analog input word of an SM331 plugged in slot 4. Word and doubleword operands must always start on an even byte address; otherwise the CPU enters STOP with SF LED and places SF in the diagnostic buffer with event ID 494E (“peripheral address error, word/dword access not aligned”).

2.1 When to Use Direct Access

• Fast event capture between PII updates (the original problem in the field report).
• Modules outside the PII/PIQ window (analog cards placed above the configured image size).
• Diagnostic data of a module: pulling PID x from the diagnostic address yields the SF/OK status word that HW Config assigns to a diagnostic-capable module.
• Distributed I/O over PROFIBUS-DP: the slave's input area can be reached with PIW only when the master has been configured to not update the PII for that slave; otherwise the PII copy is the correct path because PROFIBUS is asynchronous to OB1.

2.2 Restrictions the Field Engineer Must Respect

• No bit-level access. The smallest unit is the byte. P I 0.0 is not a valid syntax; the CPU rejects it at compile time. If a single bit is required, mask the byte with PI and an AW / AD instruction.
• No symbolic bit names for peripheral bits because the symbol table can only resolve I/Q/M/DB bits.
• Read/write consistency is one byte at a time on the S7-300 backplane; for analog values wider than 8 bits the value can be torn if the module updates between the low and high byte read. Use PIW (16-bit aligned) to avoid tearing of standard AI modules. For 32-bit counters use PID only on modules that latch the value on the first read (most FM and CP modules do; SM modules generally do not).
• Process interrupt generation is not affected by direct access; it is the module that raises the interrupt, not the operand type.

3. Code Examples in STL, LAD, FBD, and SCL

3.1 STL (Statement List) — read PIW and write PQW mid-OB1

Network 1: Capture a fast digital event in the middle of OB1
      L     PIB    0          // read input byte 0 directly from hardware
      T     MB     100        // save to flag byte for later use

Network 2: Replicate to the PAA so downstream logic sees it
      L     MB     100
      T     PQB    4          // write to output byte 4 directly to hardware

Network 3: Poll a fast 1-bit input using a byte mask
      L     PIB    1          // direct read byte 1
      L     W#16#10           // mask bit 4 (16#10)
      UW                     // bitwise AND
      JP    FastEvent        // jump if non-zero (event arrived)
      JU    NoEvent
FastEvent: S M 200.0          // latch event in flag
NoEvent:  NOP 0

3.2 LADDER (LAD) — direct peripheral read of an analog value

      ┌────┐
      │ MOVE│  EN   ENO
      └─┬──┘
   PIW288──IN   OUT──MW200

Functionally identical to L PIW 288 / T MW 200. The MOVE box is preferred for clarity in ladder; the PIW operand is selectable from the operand list in STEP 7 V5.x and TIA Portal V13+.

3.3 FBD (Function Block Diagram) — direct output drive

  MD100 ──┬──( MOVE )── PQW 288
          │

3.4 SCL (Structured Control Language) — conditional direct write

IF bFastTrigger THEN
    "dbRecipe".rSetpoint := WORD_TO_REAL("PIW_analog");   // PIW from hardware
    "PQB_drive" := REAL_TO_WORD("dbRecipe".rSetpoint);    // PQW to hardware
END_IF;

SCL is the most concise form for conditional direct I/O; the compiler emits the same L PIW/T PQW STL pair. Note that SCL does not allow bit-level peripheral syntax either; mask operations are required for single bits.

4. Bit-Level Access Workaround

Because PI cannot address individual bits, the standard pattern to read a single digital input mid-cycle is:

// Read bit 3 of the input byte at peripheral address 0
      L     PIB    0
      L     2#00001000        // mask bit 3 (0x08)
      UW
      L     0
      <>I
      =     M    250.3         // flag equivalent of I 0.3

For a write of a single bit to a peripheral byte, use the SPB/R pattern with PQB on the parent byte and a mask:

// Set bit 5 in output peripheral byte 8
      L     PQB   8            // current value
      OW     W#16#0020        // set bit 5
      T     PQB   8

To clear bit 5:

      L     PQB   8
      AW     W#16#FFDF        // clear bit 5 (invert of 0x0020 = 0xFFDF)
      T     PQB   8

This read-modify-write on the peripheral byte costs two backplane transactions per cycle. If the bit is set in a hot loop (sub-millisecond), prefer mapping the bit to a flag first, then transferring the flag to the PQB once per OB1.

5. Hardware Interrupt OBs (OB40–OB47) for Event-Driven Response

Direct peripheral access still polls; it does not react asynchronously. The S7-300 family provides eight hardware-interrupt OBs to react to a rising or falling edge of a digital input within microseconds of the event, completely independent of the OB1 cycle:

OB40 is the canonical choice. It is invoked the moment the module raises a hardware interrupt, regardless of where OB1 is in its scan. The start information in OB40_MDL_ADDR, OB40_POINT_ADDR, and OB40_EVENT_MASK tells the user program which channel triggered and on which edge (rising/fising, falling, or both) so the OB can dispatch the correct reaction without polling.

5.1 Hardware-Interrupt-Capable Digital Input Modules

Not every SM321 supports hardware interrupts. The base 6ES7 321-1BL00 (16 DI 24 V DC) and 6ES7 321-1BH02 (16 DI 24 V DC) do not. The interrupt-capable variants are:

The 6ES7 321-7BH01-0AB0 referenced in the field report is the standard production-line module for this task. Two of its channels (typically channels 0 and 1) can be configured in HW Config for rising-edge, falling-edge, or both-edge hardware interrupt generation. When the configured edge is detected, the module asserts a backplane interrupt, the CPU saves the current execution context, and OB40 (or OB41–OB47) is scheduled. The latency from terminal-edge to first STL instruction in OB40 is typically 200–500 µs for a CPU 315-2 DP.

5.2 OB40 Template STL

FUNCTION_BLOCK FB_FastEvent
// Temporary variables for OB40 start info
VAR_TEMP
    info  : DWORD;  // OB40_POINT_ADDR (channel pattern)
    md    : WORD;   // OB40_MDL_ADDR (module logical base address)
END_VAR
BEGIN
    info := OB40_POINT_ADDR;
    md   := OB40_MDL_ADDR;

    // Dispatch on channel
    IF (info AND DW#16#1) <> 0 THEN  // channel 0 triggered
        "dbEvent".bCh0Edge := TRUE;
    ELSIF (info AND DW#16#2) <> 0 THEN // channel 1 triggered
        "dbEvent".bCh1Edge := TRUE;
    END_IF;

    // Optional: directly write a PQB in response
    IF "dbEvent".bCh0Edge THEN
        "PQB_drive" := "PQB_drive" OR WORD#16#0001; // set bit 0
    END_IF;
END_FUNCTION_BLOCK

OB40 is reached in microseconds, runs the same code as the field report requires (a direct PQW write to drive the actuator), and then returns. The main OB1 picks up the latched flag bits at the next cycle without having to be fast.

6. Cyclic and Time-of-Day Interrupt OBs (OB30–OB38, OB10–OB17)

When the fast event is periodic rather than asynchronous, use a cyclic interrupt OB. The S7-300 supports nine cyclic OBs with phase offsets so that several loops can be offset against each other to spread CPU load:

OB35 at 100 ms is the de-facto standard background loop. Place the long-cycle direct-peripheral I/O reads inside OB35 to sample inputs every 100 ms regardless of how long OB1 takes. OB38 (10 ms) and OB37 (20 ms) are commonly used for high-speed PID loops and counter capture.

Time-of-day OBs OB10–OB17 execute at absolute clock times. They are useful for end-of-shift flushing, daily calibration reads, and similar housekeeping; they are not a real-time mechanism because clock granularity is 1 second and other OBs can delay them.

7. Timing and Performance Quantification

The following table summarises the latency each mechanism introduces, measured on a CPU 315-2 DP (6ES7 315-2EH14) with default priority configuration:

The “edge → user code” metric is the time from the physical 24 V edge at the screw terminal to the first STL instruction that reacts. Hardware interrupt is the only mechanism that delivers deterministic sub-millisecond response on the S7-300 backplane; the other paths are limited by the scan or by the configured PII/PIQ window.

7.1 OB1 Scan Budget

To keep OB1 fast enough that direct peripheral access is rarely required, the following budget applies to a typical CPU 314C-2 PN/DP:

If the application exceeds 10 ms of OB1 scan time, partition the slow logic into OB35 (or finer OBs) and use the time-driven OBs to do the work that does not need the full 100 ms cycle. Keep OB1 as the synchroniser; let OB30–OB38 handle the heavy lifting.

8. Restrictions, Error Codes, and Diagnostics

Direct peripheral access and hardware interrupts can fail in well-defined ways. The CPU surfaces the failure in the diagnostic buffer (online via STEP 7 PLC → Module Information) and the SF LED. The most common events:

9. Interaction with Distributed I/O (PROFIBUS / PROFINET)

For distributed I/O, the rule is: if the slave's PII is enabled, use the I operand; the CPU handles the consistency. If the PII is disabled (HW Config → slave → DP/PN slave properties), the input area of the slave is only reachable through PIW with the slot-relative byte address. PROFINET IO with IRT (Isochronous Real-Time) and isochronous mode is the only way to achieve deterministic sub-millisecond response over the fieldbus; combined with OB40 on the local module, it enables distributed high-speed motion.

For ET200S, ET200MP, and ET200SP stations, direct peripheral read on PROFINET is performed with the same PIW syntax, but the slot is the PROFINET slot (1 = head module, 2 = first I/O module, etc.) and the address shown in HW Config.

10. Migration to S7-1500 and TIA Portal

The S7-1500 keeps the same peripheral syntax (PIW / PQW) but adds the following improvements:

• Optimized block access (symbolic, error-free) is the default; absolute access still works.
• Hardware interrupt OBs are renamed OB40 (ProcessInterrupt) and now support up to 50 hardware interrupt OBs (ProcessInterrupt_0 … _49).
• The 6ES7 321-7BH01-0AB0 is replaced by the 6ES7 131-6BH01-0BA0 (ET200SP) or 6ES7 521-1BH00-0AB0 (S7-1500 SM521) for new designs; the parameter set is backward-compatible in terms of OB40 behaviour.
• Direct peripheral writes from the user program no longer require a STOP-state toggle; they are atomic at the cycle level.

Existing STEP 7 V5.x projects with direct PIW / PQW access migrate cleanly to TIA Portal V17+ via Project → Migrate to TIA Portal; the peripheral addresses are preserved.

11. Practical Patterns from the Field

11.1 Sampling Eight Fast Inputs Inside OB1 Without Losing Pulses

Problem: a 2 ms pulse train on I 0.0 must be counted, but OB1 takes 40 ms. Solution: configure the SM321-7BH01-0AB0 channel 0 for rising-edge hardware interrupt. In OB40, increment a counter and clear the channel flag. The pulse is captured in microseconds; the count is then visible in OB1 for trending and display.

11.2 Mid-OB1 Analog Output Update for a Heater

Problem: a heater controlled by SM332 AO2 must change its setpoint inside OB1 because the recipe step only changes every 30 s. Solution: write the new setpoint as a PQW immediately after the recipe change. The actual output voltage tracks the new setpoint within 5–10 ms rather than waiting for the next OB1 PAA flush (which is the same cycle, but using PQW makes the dependency explicit in the code review).

11.3 Reading Diagnostic Data on a Failing SM321

Problem: the SF LED on SM321 slot 4 is lit but no diagnostic OB82 has fired. Solution: read the diagnostic area with PID 288 (the diagnostic address assigned in HW Config) — the 4 bytes contain the standard diagnostic record that OB82 would have placed in the start info. This is a common technique for HMI dashboards.

12. Quick Reference Card