Siemens S7 Addressing

About 5 min read

On Siemens S7 TCP devices, the absolute S7 address in the PLC is written in the tag's Address field. For device and channel settings, see the Siemens S7 TCP page.

Address Syntax

The address specifies the memory area and the start byte (and, for Bool, the bit number). Addresses are written in upper case without spaces.

DB (data block) addresses

DB<db>.DBX<byte>.<bit>
DB<db>.DBB<byte>
DB<db>.DBW<byte>
DB<db>.DBD<byte>

A dot (.) is used between the DB number and the area; a notation with a comma such as DB1,DBW0 is not accepted.

Input (I), output (Q) and memory (M) addresses

I<byte>.<bit>   IB<byte>   IW<byte>   ID<byte>
Q<byte>.<bit>   QB<byte>   QW<byte>   QD<byte>
M<byte>.<bit>   MB<byte>   MW<byte>   MD<byte>

German abbreviations are also accepted: E for input (E0.0, EW2), A or O for output (A0.1, AB1).

Timer (T) and counter (C) addresses

T<number>
C<number>

The German notation Z<number> is also accepted for counters.

Address elements

Element	Meaning
DB<db>	Data block number, e.g. DB10
I, Q, M	Input, output and memory (marker) areas
T, C	Timer and counter areas
X + .<bit>	Bit access; bit number 0–7
B	Byte (1 byte)
W	Word (2 bytes)
D	Double word (4 bytes)
<byte>	Start byte within the area; at most 2097151

DB, timer and counter numbers can be at most 65535.

TIP

The letters B, W and D only indicate the start byte. The tag's Data Type determines the number of bytes read and how the value is decoded. To avoid confusion, choose the letter to match the size of the data type: W for 2-byte types, D for 4-byte types.

Data type and address format

• Bool tags require a bit address: DB<db>.DBX<byte>.<bit> or I/Q/M + <byte>.<bit> (e.g. DB1.DBX0.0, M0.1).
• A bit address is used only on Bool tags. Other types use a byte, word or double word address (e.g. DB1.DBW0, MW10).
• Timer and counter addresses contain no bit; Bool is not used on these addresses.

For example, a Bool tag on MW10 or an Int tag on M0.1 is not saved.

Unsupported notations (rejected in the tag table and on the server):

• Input/output/memory bit addresses with an X prefix, such as IX0.0 or MX10.1: use the I0.0, M10.1 format.
• A bit address without a bit number (e.g. DB1.DBX0), a DB address without an area (e.g. DB1) and a bit number greater than 7.
• Lower-case addresses (e.g. db1.dbw0).
• Peripheral (P) addresses.

When a tag is rejected on save, the error message shows the reason.

Data Types

PLC type	Data Type	Size read	Example address
BOOL	Bool	1 bit	DB1.DBX0.0, I0.0, Q0.1, M10.3
BYTE, USINT	Byte	1 byte	DB1.DBB1, IB0, QB1, MB5
INT	Int	2 bytes, signed	DB1.DBW2, IW64, MW20
WORD, UINT	Word	2 bytes, unsigned	DB1.DBW4, QW2, MW22
DINT	DInt	4 bytes, signed	DB1.DBD6, MD40
DWORD, UDINT	DWord	4 bytes, unsigned	DB1.DBD10, ID4
REAL	Real	4 bytes, floating point	DB1.DBD14, MD44
LREAL	LReal	8 bytes, floating point	DB1.DBD18
STRING[n]	String	n + 2 bytes	DB1.DBB26 (Length = n)

Rules:

• String: The address points to the start byte of the STRING variable. Enter the maximum number of characters defined in the PLC in the Length field (e.g. 20 for STRING[20]). Only S7 STRING is supported; WSTRING and CHAR arrays are not supported.
• Length: Must be 1 for types other than String; reading arrays is not supported. Define a separate tag for each element of an array.
• Sbyte: Not supported on Siemens devices. In the PLC program, copy SINT variables to an INT variable and read it as Int.
• LInt, ULInt and LWord: Not supported in 2.10; they cannot be selected in the list on Siemens devices and the server rejects them on save. In the PLC program, copy LINT, ULINT and LWORD variables to a DINT, DWORD or LREAL variable and read that one.
• Automatic: Not supported on Siemens devices; select the Data Type explicitly.

Tags from earlier versions

Tags saved in an earlier version with the LInt, ULInt or LWord type, or with an address that does not match the data type (see Data type and address format), are not deleted. They are not read at runtime, stay at Bad quality, and the reason is written to the service log; writes to these tags are also rejected. To fix them, change the tag's address or data type and save; saving with only a changed description is rejected.

Timer and Counter

T<number> and C<number> addresses read the 16-bit raw value of the timer or counter with Data Type Word or Int. The value is not converted to seconds or to a decimal number; for timers, the time base and the BCD-coded value come together. If you need a readable value, copy the timer or counter value in the PLC program to a DB or a memory word (e.g. MW100) and read that address. Only read from timer and counter addresses.

Examples

Address	Data Type	Length	Meaning
DB1.DBX0.0	Bool	1	DB1, byte 0, bit 0
DB1.DBX0.7	Bool	1	DB1, byte 0, bit 7
DB1.DBB1	Byte	1	DB1, byte 1
DB1.DBW2	Int	1	DB1, bytes 2–3
DB1.DBD6	DInt	1	DB1, bytes 6–9
DB1.DBD14	Real	1	DB1, bytes 14–17
DB1.DBB26	String	20	STRING[20] starting at byte 26 of DB1
I0.0	Bool	1	Input byte 0, bit 0
IW64	Int	1	Input bytes 64–65
Q0.1	Bool	1	Output byte 0, bit 1
QB1	Byte	1	Output byte 1
M10.3	Bool	1	Memory byte 10, bit 3
MW20	Word	1	Memory bytes 20–21
MD44	Real	1	Memory bytes 44–47
T5	Word	1	Raw value of timer 5
C3	Word	1	Raw value of counter 3

Writing to inputs (I) is not recommended; the PLC refills the input area from the physical inputs in every cycle.