Troubleshooting S7-1200 CPU 1215C Analog Output on PLCSIM

Problem: CPU 1215C DC/DC/DC Analog Output Unresponsive in PLCSIM

When simulating a Siemens SIMATIC S7-1200 CPU 1215C DC/DC/DC (order number 6ES7215-1AG40-0XB0 family) in PLCSIM, engineers frequently encounter a situation where writing to the analog output address produces no visible reaction. The PLCSIM SIM Table appears to accept values, the Force Table enables a force on QW64 or QW66, but the analog output word never reflects the value and the application code never sees the change. The symptom is the same in TIA Portal V13 through V18, and is one of the most common questions raised in S7-1200 simulation work.

For engineers transitioning from a physical S7-1200 bench setup, S7-300/400, or from LOGO! to PLCSIM, the absence of a "live" analog output reading is confusing. The simulation environment intentionally separates the physical I/O layer (modifier :P) from the process image used by user code. Understanding this separation, and the specific limitations of PLCSIM's analog handling, is the first step toward a reliable workaround.

Root Cause: Two-Layer I/O Model and PLCSIM Analog Limitations

The S7-1200 system architecture maintains two distinct representations of every I/O point. The same is true in PLCSIM, but the simulation engine does not always propagate analog values back to the user interface the way a real DAC would.

1. Physical I/O (P modifier): The actual voltage or current present at the terminal of the module — written as %QW64:P in SCL or referenced as "with P modifier" in LAD/FBD. In PLCSIM this layer is emulated, but only certain I/O types (primarily digital) are visually echoed back in the SIM Table.
2. Process image (I/Q): The buffered value the CPU updates once per scan cycle and that user code reads/writes via the standard address (e.g., %QW64). This is what every MOVE, every arithmetic block, and every HMI tag binds to by default.

When a force is applied via the Force Table, the value is written to the process image output (PIQ). The PIQ is what the analog output driver of a physical CPU would convert to a voltage or current. In PLCSIM, however, the analog output "physical layer" is not echoed back into the SIM Table; PLCSIM provides digital input/output simulation primarily, and analog simulation is limited to address-space mapping only. The result: code can read and write QW64 in PLCSIM, but the value never appears as an actual "output voltage" because there is no virtual DAC in the simulator to display.

This is a known characteristic of PLCSIM V13 through V18 and is consistent with the Siemens S7-1200 technical specifications for CPU 1215C digital inputs and outputs, which describes the two onboard analog outputs as mapped to fixed process image output words (QW64 / QW66 by default). PLCSIM correctly emulates the address space but does not drive the analog "value" in the same way the physical output driver would.

I/O Layer Model — SVG

CPU 1215C DC/DC/DC Analog Output Specifications

Before debugging PLCSIM behavior, confirm the exact order number (MLFB) and firmware version of your CPU. The two analog outputs (AQ0, AQ1) are always mapped to process image output words beginning at QW64 for the CPU 1215C, but adjacent signal boards (SB) or signal modules (SM) can shift the address map if they occupy the same PIQ area. Use the device view in TIA Portal to inspect the actual I/O addresses for your configuration.

Verification: Hardware, Firmware, and PLCSIM Compatibility

Before applying the workarounds below, eliminate configuration mismatches that masquerade as "analog output not working."

1. Confirm CPU order number and firmware. Open Online → Accessible nodes in TIA Portal. Read the firmware version from the device. S7-1200 firmware 4.x supports the full instruction set including NORM_X / SCALE_X; older 3.x builds are also supported but limit some instructions. CPU 1215C with FW 4.6 is recommended for current TIA Portal V18 projects.
2. Confirm PLCSIM version. TIA Portal V13 → PLCSIM V13, V14 → V14, V15.1 → V15.1, V16 → V16, V17 → V17, V18 → V18. Mismatched versions refuse to start the simulation.
3. Confirm the output type in device configuration. In the device view, click on the analog output channel and set Output type to "Voltage" or "Current" as required. If the type is set incorrectly the output word may be ignored.
4. Confirm the process image address. In the device view, expand I/O addresses and verify that the analog output starts at QW64 (or as configured). If the addresses are user-defined and remapped, update your code and watch table accordingly.
5. Start the simulation with a clean download. Online → Download to device → Select PLCSIM. A "Download to device" that only updates part of the project will not refresh the analog output configuration.

Solution 1: Watch Table Direct Write (No Code Path)

The simplest workaround uses a Watch Table to write directly to the process image output word, bypassing the user program entirely. This works only when no code is writing to the same address in the same cycle, because the end-of-cycle PIQ transfer will overwrite your watch-table value with whatever the OB1 last wrote.

Step-by-step

1. In the project tree, right-click Watch and force tables and add a new Watch Table, e.g., WT_AQ_control.
2. Add the following entries in "Modify" column mode:
   • %QW64 — Modify value: 13824 (≈ 5 V out of 10 V)
   • %QW66 — Modify value: 0
3. Click the Monitor all button (glasses icon) to start monitoring.
4. Click the Modify now button (lightning icon) to write 13824 to QW64.
5. Confirm the value column shows 13824 in decimal and W#16#3600 in hex. If a value of 0 returns immediately, the user program is overwriting the PIQ in the same cycle — proceed to Solution 2.

Solution 2: Move Block + Watch-Trigger Bool Pattern (Recommended)

The field-proven pattern uses a watchdog-style boolean to gate a MOVE block whose source value is itself controlled by the watch table. This guarantees that the user program's PIQ write and your manual value are coordinated, and it scales to any number of analog channels.

Tag declarations

SCL implementation (FB or OB1)

// Watch-gated analog output for AQ0 (QW64)
IF "watch_trigger_QW64" THEN
    "AQ0_out" := INT_TO_WORD("watch_value_QW64");
ELSE
    "AQ0_out" := INT_TO_WORD("program_value_QW64");
END_IF;

IF "watch_trigger_QW66" THEN
    "AQ1_out" := INT_TO_WORD("watch_value_QW66");
ELSE
    "AQ1_out" := INT_TO_WORD("program_value_QW66");
END_IF;

LAD equivalent (single rung)

[ watch_trigger_QW64 ] --[ MOVE watch_value_QW64 -> AQ0_out ]--
[ NOT watch_trigger_QW64 ] --[ MOVE program_value_QW64 -> AQ0_out ]--

Watch table procedure

1. Add the five tags above to the watch table in Modify mode.
2. Set watch_trigger_QW64 = true (1).
3. Set watch_value_QW64 = 13824 (≈ 5 V).
4. Click Modify now. The MOVE block in OB1 will route 13824 to AQ0_out on the next scan, and QW64 will display 13824 in the watch table.
5. To test scaling, change watch_value_QW64 to 27648 (= 10 V) and re-modify.

This pattern works equally in PLCSIM and on a physical CPU. It also gives you a clean separation between production logic and commissioning overrides, which is valuable during FAT/SAT when a control engineer needs to force an analog output without recompiling.

Solution 3: Programmatic Write with NORM_X / SCALE_X

For real applications, the analog output value is almost always derived from a process variable — a setpoint, a PID controller output, a recipe parameter. The S7-1200 instruction set provides NORM_X and SCALE_X for this purpose. Use the same pattern from Solution 2 but feed the SCALE_X result into program_value_QW64.

SCL example: scale 0.0–100.0 % to 0–10 V

// "pv_percent" is REAL in the range 0.0 .. 100.0
"program_value_QW64" := REAL_TO_INT(
    SCALE_X(
        MIN      := 0.0,
        VALUE    := "pv_percent",
        MAX      := 100.0
    ) * 27648.0
);

For a direct 0–100 % → 0–27648 mapping, omit the SCALE_X and write:

"program_value_QW64" := REAL_TO_INT("pv_percent" * 276.48);

PLCSIM vs. Physical CPU: Behavioral Differences

The practical consequence: when developing in PLCSIM, you cannot verify the analog output with a multimeter — there is no physical output. You can only verify that the process image word is correct. Final voltage/current verification must be done on a physical CPU with a calibrated DMM or current loop tester.

Step-by-Step Commissioning Procedure (PLCSIM)

1. Create a new TIA Portal project and add a CPU 1215C DC/DC/DC with matching order number and firmware.
2. In the device view, click on the analog output and set Output type to Voltage (or Current). Confirm the I/O addresses start at QW64.
3. Declare the watch-table tags in a global DB or PLC tags table: watch_trigger_QW64 (Bool), watch_value_QW64 (Int), program_value_QW64 (Int).
4. In OB1, add the IF / MOVE logic from Solution 2 that routes either the program value or the watch value to AQ0_out.
5. Compile the project (Ctrl+B). Resolve any type-mismatch errors (Int vs. Word vs. Real).
6. Start PLCSIM (icon in toolbar or Online → Simulation → Start).
7. Download the project to PLCSIM. Wait for the green "Running" indicator.
8. Open the Watch Table. Monitor QW64 and confirm it reads 0 initially.
9. Set watch_trigger_QW64 = 1 and watch_value_QW64 = 13824. Click Modify now.
10. Verify QW64 now displays 13824 (decimal) and that the value persists across scan cycles.
11. Repeat for QW66 with watch_value_QW66 = 27648 to confirm full-scale 10 V command.
12. When ready for hardware acceptance, download to a physical CPU and measure the terminal voltage with a DMM. 13824 → ≈ 5.000 V; 27648 → ≈ 10.000 V (allow ±0.5 % of full scale per the S7-1200 system manual).

Verification Checklist

• ☐ PLCSIM version matches TIA Portal version (V13 ↔ V13, V16 ↔ V16, etc.).
• ☐ CPU order number and firmware visible in device configuration match the physical target.
• ☐ Analog output type (Voltage/Current) set in device view.
• ☐ Process image addresses for AQ0 / AQ1 confirmed (QW64 / QW66 default).
• ☐ No user program is writing to the same address without coordination.
• ☐ Watch table shows expected raw value (0–27648) and persists.
• ☐ Watch-trigger bool correctly gates the MOVE block.
• ☐ HMI tag bound to %QW64 shows the expected value (PLCSIM limit: PIQ only).
• ☐ On physical CPU, terminal voltage verified with DMM (13824 ≈ 5.000 V; 27648 ≈ 10.000 V).
• ☐ On physical CPU in current mode, loop current verified with multimeter in series (13824 ≈ 10.00 mA; 27648 ≈ 20.00 mA).

Common Pitfalls and Diagnostic Matrix

Field-Proven Caveats

• PLCSIM is not a substitute for hardware acceptance. A simulation that drives 27648 to QW64 proves the program logic; it does not prove that the analog output stage of the physical CPU is calibrated. Always verify terminal voltage/current with a calibrated DMM before sign-off.
• Signal boards change the address map. A plugged-in SB 1232 (analog output SB) starts at QW68, not QW64, for the SB's first channel. Re-verify addresses whenever you add or remove an SB.
• Watch-table "Modify" is one-shot. Toggling the trigger from 1 to 0 in the watch table does not "freeze" the value; it routes the program value through the MOVE. If you need a frozen manual value, add a third state to the IF/ELSIF chain (manual / program / hold-last-value).
• Force table is persistent across downloads. Unlike modify, a force remains active after a STOP→RUN transition and across program downloads. Always clear forces (Force table → Stop forcing) before starting a new test to avoid confusing residual overrides.
• OB1 priority vs. OB35. If OB35 (cyclic interrupt, e.g., 100 ms) writes to QW64 and OB1 also writes, the higher-priority OB35 wins for that cycle. Centralize the watch-gated write in OB1 and remove direct writes from OB35 during commissioning.

FAQ