Even though your %q28 is the actual output, if you haven't entered a description the software automatically assigns %q0001 as a descriptor by default.
This is kinda off topic, but you bring up a good point. There are some nasty tricks that you can do with a PLC.
At Spring Hill, the guy who translated the Series Six code to 90-30 for our Ube's had created nicknames that looked like the register in use, except that he made these nicknames look like a different register than what it really was (i.e. the nickname for %R1000 might show "%R2000" as its nickname).
He also setup ARRAY_MOVE instructions for 5000 & 32000 words (when he really didn't need to be using ARRAY_MOVE instructions in the first place). He usually didn't use more than 40 registers for any operation.
He would use this block for anything that he was controlling (PID, thermocouples, pressure, etc). He oneshot most of the array references so backtracking them was nearly impossible.
So he was essentially using nearly the entire register table to obscure what he was doing.
You could forget about finding an "unused" register, they *all* showed up in the search results.
And he would get the inputs to trigger the various ARRAY_MOVE operations externally (undocumented, of course) so that it was nearly impossible to figure out where things were coming from.
And on top of that he used BTST (Bit Test) and BSET (Bit Set) operations to trigger his logic.
And of course, his documentation was either missing or incorrect.
He did other tricks to keep people from figuring out what he was doing, but these were the worst.
I suspect that he thought he was going to be the only guy in the world who would be able to work on these machines.
Nope, not hardly. We got what we needed fixed. But I do have to hand it to him, he is the closest thing to an evil genius that I have run up against.