Standard S7-300/400/1200/1500 Item Syntax

Kepware Drivers > S Drivers > Siemens TCP/IP Ethernet > Address Descriptions > Item Syntax > Standard S7-300/400/1200/1500 Item Syntax

Address Syntax

Input, Output, Peripheral, Flag Memory Types

<memory type><S7 data type><address><.string length>*

Timer and Counter Memory Types

DB Memory Type

DB<num>,<S7 data type><address>

DB<num>,<S7 data type><address><.bit>

DB<num>,<S7 data type><address><.string length>*

DB<num>,<S7 data type><address><[row][col]>

where <num> ranges from 1 to 65535.

*Applies to S7 data types that support string. String length can vary from 0<n<= 932, with the exception of S7 data type string (which can vary from 0<n<= 254 for a PDU size of 480 and above, 0<n<= 210 for a PDU size below 480).

Memory Type	Description	Address Range	Data Type	Access
I E	Inputs	Dependent on S7 Data Type	Read / Write
Q A	Outputs	Read / Write
PI PE	Peripheral Inputs	Read Only
PQ PA	Peripheral Outputs	Read / Write
M F	Flag Memory	Read / Write
DB	Data Blocks	Read / Write
T	Timers	T0-T65535	DWord, Long	Read / Write
C Z	Counters	C0-C65535 Z0-Z65535	Word, Short	Read / Write

See Also: Examples

S7 Data Types

The S7 data type is used to coerce the data type for a tag. It does not apply to Timers and Counters. The default data types are shown in bold.

S7 Data Type	Description	Address Range	Data Type
B Byte	Unsigned Byte	B0-B65535 BYTE0-BYTE65535 B0.b-B65535.b BYTE0.b-BYTE65535.b .b is Bit Number 0-7 B0.n-B65535.n BYTE0.n-BYTE65535.n .n is string length. 0 < n <= 932.	Byte, Char Boolean String*
C Char	Signed Byte	C0-C65535 CHAR0-CHAR65535 C0.b-C65535.b CHAR0.b-CHAR65535.b .b is Bit Number 0-7 C0.n-C65535.n CHAR0.n-CHAR65535.n .n is string length. 0<n<= 932.	Byte, Char Boolean String*
D DWORD	Unsigned Double Word	D0-D65532 DWORD0-DWORD65532 D0.b-D65532.b DWORD0.b-DWORD65532.b .b is Bit Number 0-31	DWord, Long, LBCD, Float Boolean
DATE	S7 Date Stored as WORD in steps of 1 day since January 1, 1990. Displayed as string format "yyyy-mm-dd" with range "1990-01-01" to "2168-12-31". Read / Write	DATE0-DATE65534	String
DI DINT	Signed Double Word	DI0-DI65532 DINT0-DINT65532 DI0.b-DI65532.b DINT0.b-DINT65532.b .b is Bit Number 0-31	DWord, Long, LBCD, Float Boolean
DT	S7 Date_And_Time Complex data type stored with 8 bytes as follows: 0 year, 1 month, 2 days, 3 hours, 4 minutes, 5 seconds, 6 two most significant digits of MSEC, 7 (4MSB) two least significant digits of MSEC, 7 (4LSB) day of week (1=Sunday). Displayed as string format "m/d/y h:mm:ss <AM/PM>" with range "1/1/1990 0:00:00 AM" to "12/31/2089 23:59:59 PM". Displayed as date format "yyyy-mm-ddThh:mm:ss.hhh" with range "1990-01-01T00:00:00.000" to "2089-12-31T23:59:59.998" Read Only	DT0-DT65528	String, Date
I INT	Signed Word	I0-I65534 INT0-INT65534 I0.b-I65534.b INT0.b-INT65534.b .b is Bit Number 0-15	Word, Short, BCD Boolean
LINT	Signed Long Word (64-bit)	LINT0-LINT65528 LINT0.b-LINT65528.b .b is Bit Number 0-63	QWord, LLong, Boolean
LREAL	IEEE Double (64-bit)	LREAL0-LREAL65528	Double
LWORD	Unsigned Long Word (64-bit)	LWORD0-LWORD65528 LWORD0.b-LWORD65528.b .b is Bit Number 0-63	QWord LLong Boolean
REAL	IEEE Float	REAL0-REAL65532	Float
String	S7 String	STRING0.n-STRING65532.n .n is string length 0<n< 254 (PDU size of 480 and above) 0<n< 210 (PDU size below 480) 0<n< 245 (Netlink S7300 and Netlink S7400 Models)	String
T TIME	S7 TIME Stored as DWORD in steps of milliseconds. Displayed as string format "+/-ddD_hhH_mmM_ssS_hhhMS" with range "-24D_20H_31M_23S_648MS" to "24D_20H_31M_23S_647MS. Read / Write.	T0-T65532 TIME0-TIME65532	String
TOD	S7 Time_Of_Day Stored as DWORD, representing milliseconds since midnight. Displayed as string format "h:m:s.mmm" with range "0:0:0.0" to "23:59:59.999". Read / Write	TOD0-TOD65532	String
W Word	Unsigned Word	W0-W65534 WORD0-WORD65534 W0.b-W65534.b WORD0.b-WORD65534.b .b is Bit Number 0-15	Word, Short, BCD Boolean
X	Bit	X0.b-X65534.b .b is Bit Number 0-15	Boolean

*These are raw strings that differ in structure and usage from the STEP 7 string data type.

Use caution when modifying Word, Short, DWord, and Long type as each address starts at a byte offset within the device. Therefore, Words MW0 and MW1 overlap at byte 1. Writing to MW0 will also modify the value held in MW1. Similarly, DWord, and Long types can also overlap. It is recommended that these memory types be used so that overlapping does not occur. For example, DWord MD0, MD4, MD8, and so on can be used to prevent overlapping bytes.

See Also: Examples

String Support

Raw Strings

For an address DBx,By.n @ string, string values read and written are stored at byte offset y.

y	y+1	y+2	...	y+n-1
' '	' '	' '	...	' '

Raw strings are null-terminated. If the maximum string length is 10 and 3 characters are written, the fourth character is set to NULL, while characters 5-10 are left untouched.

Note: For raw strings, the total number of bytes requested cannot exceed the data portion of the negotiated PDU size. If raw strings exceed the negotiated PDU size, they may fail to be read or written.

String Support

The string subtype follows the STEP 7 string data type definition. The syntax for the string S7 data type is STRINGy.n where y is the Byte offset, and n is the maximum string length. If n is not specified, the maximum string length will be 254 characters when PDU size is >= 480, otherwise it will be 210. String values read and written are stored at byte offset y+2 in data block x. The actual string length gets updated with every write based on the string length of the string being written.

y	y+1	y+2	y+3	y+4	...	y+2+n-1
maximum string length (n)	actual string length	' '	' '	' '	...	' '

Notes:

1. String strings are NULL padded. If the maximum string length is 10 and 3 characters are written, characters 4-10 are set to NULL.

2. If a PDU of 240 is negotiated, STEP 7 strings with a length greater than 222 may fail to be read and strings with a length greater than 212 may fail to be written.

Hex Strings

The HEXSTRING subtype is specific to the Siemens TCP/IP Ethernet Driver. The syntax for the HEXSTRING subtype is HEXSTRINGy.n, where y is the byte offset and n is the length. The n value must be specified in the range of 1 through 932. String is the only valid data type for a HEXSTRING tag.

The value assigned to a HEXSTRING must be an even number of characters. There is no padding, so the entire string must be specified. For example, tag HexStr defined as DB1,STRING0.10 uses 10 bytes of storage and has a display length of 20. To assign a value, the string must be 20 characters long and contain only valid hexadecimal characters. An example valid hex string for this tag is “56657273696f6E353137”.

Array Support

The [rows][cols] notation is appended to an address to specify an array (such as MW0[2][5]). If no rows are specified, row count of 1 is assumed. Boolean arrays and string arrays are not supported.

For Word, Short, and BCD arrays, the base address + (rows * cols * 2) cannot exceed 65536. Keep in mind that the elements of the array are words, located on a word boundary. For example, IW0[4] would return IW0, IW2, IW4, and IW6.

For Float, DWord, Long, and Long BCD arrays, the base address + (rows * cols * 4) cannot exceed 65536. Keep in mind that the elements of the array are DWord, located on a DWord boundary. For example, ID0[4] will return ID0, ID4, ID8, ID12.

For all arrays, the total number of bytes requested cannot exceed the data portion of the negotiated PDU size. For example, for a 960-byte PDU size, the largest single array that may be read or written is 932 bytes. If arrays exceed the negotiated PDU size, they may fail to be read or written.

Timers

The Siemens TCP/IP Ethernet Driver automatically scales T values based on the Siemens S5 time format. Timer data is stored as a Word in the PLC but scaled to a DWord in the driver. The value returned will already be scaled using the appropriate Siemens time base. As a result, the values are always returned as a count of milliseconds. When writing to T memory, the Siemens time base will also be applied. To assign a value to a timer in the controller, write the desired value as a count of milliseconds to the appropriate timer.

Counters

The value returned for C memory will automatically be converted to a BCD value.

Examples

S7 Data Type	Data Type	Input	Flags	Data Blocks
B Byte	Byte Boolean String Array	IB0 IBYTE0 IB0.7 IBYTE0.7 IB0.64 IBYTE0.64 IB0[2][5] IBYTE0[2][5]	MB0 MBYTE0 MB0.7 MBYTE0.7 MB0.64 MBYTE0.64 MB0[2][5] MBYTE0[2][5]	DB1,B0 DB1,BYTE0 DB1,B0.7 DB1,BYTE0.7 DB1,B0.64 DB1,BYTE0.64 DB1,B0[2][5] DB1,BYTE0[2][5]
C Char	Char Boolean String Array	IC0 ICHAR0 IC0.7 ICHAR0.7 IC0.64 ICHAR0.64 IC0[10] ICHAR0[10]	MC0 MCHAR0 MC0.7 MCHAR0.7 MC0.64 MCHAR0.64 MC0[10] MCHAR0[10]	DB1,C0 DB1,CHAR0 DB1,C0.7 DB1,CHAR0.7 DB1,C0.64 DB1,CHAR0.64 DB1,C0[10] DB1,CHAR0[10]
D DWORD	DWord Boolean Array	ID0 IDWORD0 ID0.31 IDWORD0.31 ID0[10] IDWORD0[10]	MD0 MDWORD0 MD0.31 MDWORD0.31 MD0[10] MDWORD0[10]	DB1,D0 DB1,DWORD0 DB1,D0.31 DB1,DWORD0.31 DB1,D0[10] DB1,DWORD0[10]
DATE	String	IDATE0	MDATE0	DB1,DATE0
DI DINT	Long Boolean Array	IDI0 IDINT0 IDI0.31 IDINT0.31 IDI0[4][3] IDINT0[4][3]	MDI0 MDINT0 MDI0.31 MDINT0.31 MDI0[4][3] MDINT0[4][3]	DB1,DI0 DB1,DINT0 DB1,DI0.31 DB1,DINT0.31 DB1,DI0[4][3] DB1,DINT0[4][3]
DT	String Date	IDT0 IDT8	MDT0 MDT8	DB1,DT0 DB1,DT8
I INT	Short Boolean Array	II0 IINT0 II0.15 IINT0.15 II0[5][2] IINT0[5][2]	MI0 MINT0 MI0.15 MINT0.15 MI0[5][2] MINT0[5][2]	DB1,I0 DB1,INT0 DB1,I0.15 DB1,INT0.15 DB1,I0[5][2] DB1,INT0[5][2]
LINT	LLong Boolean Array	ILINT0 ILINT0.63 ILINT0[5][2]	MLINT0 MLINT0.63 MLINT0[5][2]	DB1,LINT0 DB1,LINT0.63 DB1,LINT0[5][2]
LREAL	Double Array	ILREAL0 ILREAL0[10]	MLREAL0 MLREAL0[10]	DB1,LREAL0 DB1,LREAL0[10]
LWORD	QWord Boolean Array	ILWORD0 ILWORD0.63 ILWORD0[10]	MLWORD0 MLWORD0.63 MLWORD0[10]	DB1,LWORD0 DB1,LWORD0.63 DB1,LWORD0[10]
REAL	Float Array	IREAL0 IREAL0[10]	MREAL0 MREAL0[10]	DB1,REAL0 DB1,REAL0[10]
String	String	ISTRING0.10	MSTRING0.10	DB1,STRING0.10
TOD	String	ITOD0	MTOD0	DB1,TOD0
T TIME	String	IT0 ITIME4	MT0 MTIME4	DB1,T0 DB1,TIME4
W Word	Word Boolean Array	IW0 IWORD0 IW0.15 IWORD0.15 IW0[10] IWORD0[10]	MW0 MWORD0 MW0.15 MWORD0.15 MW0[10] MWORD0[10]	DB1,W0 DB1,WORD0 DB1,W0.15 DB1,WORD0.15 DB1,W0[10] DB1,WORD0[10]
X	Boolean	IX0.7 IX0[10]	MX0.7 MX0[10]	DB1,X0.7 DB1,X0[10]

Note: The offset for an atomic type tag in a data block is denoted by the column "Address" in Step 7, as shown above. This offset is denoted by the column "Offset" in the Siemens TIA Portal programming environment.

Was this helpful?