PLC Simulator
Siemens cheat sheet

Siemens S7 addressing and tag cheat sheet

Siemens addresses a bit by its memory area, byte and bit number, and TIA Portal lets you give each address a symbolic name in the tag table. Blocks add their own local and data block addressing on top. This sheet lists the forms you will meet in programs and manuals.

Absolute addresses

Absolute addresses
ItemSyntaxMeaning
Input bitI0.0Byte 0, bit 0 of the input area. TIA Portal shows it as %I0.0.
Output bitQ0.0Byte 0, bit 0 of the output area.
Memory bitM0.0Byte 0, bit 0 of the bit memory area.
Memory byte, word, double wordMB0 MW0 MD08, 16 and 32 bits starting at byte 0.
Input and output wordIW64 QW64A 16-bit word of the input or output area, such as an analog value.
Peripheral (direct) accessI0.0:PReads the module directly instead of the process image.

Symbolic and block addresses

Symbolic and block addresses
ItemSyntaxMeaning
Tag from the tag table"Motor_Start"A symbolic name mapped to an absolute address, written in quotes.
Data block variable"Pump_Data".SpeedA member of a data block, by block name and variable name.
Absolute data block addressDB1.DBX0.0 DB1.DBW2Bit 0 of byte 0, and the word at byte 2, of data block 1.
Local variable#SpeedA block-local variable, marked with a hash.

Block types

Block types
ItemSyntaxMeaning
Organisation blockOB1Called by the CPU. OB1 is the main cyclic program.
FunctionFC1Code with no memory of its own.
Function blockFB1Code with memory, stored in an instance data block.
Data blockDB1A named table of values.

Common data types and literals

Common data types and literals
ItemSyntaxMeaning
Elementary typesBool Byte Word DWord Int DInt RealOne bit, 8, 16 and 32-bit unsigned, 16 and 32-bit signed, and floating point.
TimeT#3s T#500msA TIME literal for an IEC timer preset.

STL statement mnemonics (international)

STL statement mnemonics (international)
ItemSyntaxMeaning
AND and AND NOTA bit AN bitCombine the result with the bit, or with its inverse.
OR and OR NOTO bit ON bitOR the result with the bit, or with its inverse.
Assign, set, reset= bit S bit R bitWrite the result, set the bit, reset the bit.
Load and transferL value T addressLoad a value, then transfer it to an address.

In this browser editor

In this browser editor
ItemSyntaxMeaning
Bare bit addressesI0.0 Q0.0Accepted for input and output bits.
Memory bitsM0.0Not accepted here. Use a word address such as %MW0, or declare a plain internal BOOL.
DeclarationsSTART AT %I0.0 : BOOL;IEC-style declarations in a VAR block.

What this sheet leaves out

  • Optimised block access and its effect on absolute addresses.
  • Default address ranges of onboard I/O, which differ by CPU.
  • STL availability, which differs between CPU families.

Always confirm addresses and ranges against the manual for your exact controller and software version. Want to see these addresses used in logic? Read the Siemens instruction reference.

Frequently asked questions

What does the :P suffix mean on an address?

It selects peripheral access: the program reads the input module directly instead of the process image captured at the start of the cycle. Use it when a program needs the freshest value of an input.

How do I read a data block address like DB1.DBX0.0?

DB1 is data block 1. DBX means a bit, and 0.0 is byte 0, bit 0. DBB, DBW and DBD select a byte, a word and a double word at the given byte offset.

Why are some tags written in quotes?

TIA Portal writes symbolic names from the tag table or a data block in double quotes. Block-local variables are marked with a hash instead.

Training material. Follow your site procedures, local electrical code and the manufacturer's instructions. Lockout/tagout and a qualified person are required for real equipment.