E0027: a reference where it cannot be

A reference (REF_TO, or REFERENCE TO with the reference-to extension) holds where a variable is, which means something only inside the running program:

• VAR_IN_OUT: “References shall not be used as in-out variables” (Ed.3 6.4.4.10.3). Pass it as an input: the reference is copied, what it references is shared;
• RETAIN or PERSISTENT: after a restart or a new build the variable it referenced may be elsewhere or gone. iecf refuses a retained reference, and a retained structure, array or function block instance that holds one (docs/dependencies.md): retain the variable it references instead, and take the reference again at start. A variable of an INTERFACE is a reference to an instance (Ed.3 6.6.6.5.1), and is refused the same way;
• at an address (AT %MB0): the process image holds values the host and other devices read, and a reference is no value to them;
• REFERENCE TO (extensions, reference-to): not an array of them, not a REF_TO one, and not a REFERENCE TO a reference, as in CODESYS and TwinCAT. Use REF_TO for those.

VAR RETAIN
    r : REF_TO INT;      (* E0027 *)
END_VAR
VAR RETAIN
    level : INT;         (* fine: retain the value, REF(level) at start *)
END_VAR