An Overview of SIEMENS PLC Address Mapping

SIEMENS Address Mapping

We can do SIEMENS S7 mapping by two methods. They are

1)Direct Addressing

2)Indirect Addressing

The widely used form of addressing in SIEMENS S7 PLCs is direct and symbolic. The examples for direct mapping are

Indirect Mapping:

Indirect address can be used to save time and money, or to automate and reduce the source code.

If you have a PLC with 60 analog inputs, you can use an indirect address to process information from analog inputs, such as scaling, testing alarm limit values, etc., meaning, for example, you don’t have to configure the alarm limit evaluation for each signal individually.

The Basics of SIEMENS IO Addressing

Process Image

We can access I/O bits only through the Process image

These values are buffered in between scans

In some CPU models have limited address space

Peripheral Address

All address outside of the process image is referred to as peripheral address

We can’t access I/O bits through a peripheral address

The actual values are read and written immediately from the user program to the physical I / O

The process picture sometimes does not provide the entire I/O address field of the CPU.

If the module’s I/O address areas are beyond the process picture, you must access these areas through “Peripheral addressing” Peripheral addresses can be reached directly after addressing the addresses in the user program. Thus, with “Peripheral addressing” it is often guaranteed that the real value is immediately read or that the output is immediately applied.

This is especially important for analog and process alarms.

You may also access modules whose I/O address areas are allocated to a process picture through “Peripheral addressing”

“Peripheral addressing” also means that the modules can be accessed directly. To do this, you set a “P” in front of the address field to be addressed:

PIBPeripheral Input Byte

PQBPeripheral output Byte

PIW → Peripheral Input Word

PQWPeripheral output Word

PIDPeripheral Input Double-word

PQDPeripheral Output Double-word.


The POINTER and Data Types

The POINTER data type is used to format a number to be recognized as an address rather than a value. The pointer is often followed by the symbol P#. The address of the pointer can be in three different formats.

Any data type is used to transfer a parameter of an unknown or unspecified data type. Some functions in the library use some form of data to operate on whole portions of memory. The last pointer approach is used to characterize the field. For eg, P#DB25.DBX address 0.0 Byte 14 points to the first byte of DB25 with a length of 14 bytes.

Data Block Instructions

When operating with indirect address, it is often important to open a DB first and then start working on an address without explicitly referring to a particular DB. This is achieved with the OPN order. The OPN command will open either a shared data block (DB) or an instance data block (DI).

The Address Registers

In addition to standard accumulators, there are two 32-bit address registers (AR1, AR2) for storing pointers used in registry indirect address methods. You may use a set of different load and switch style instructions to operate with AR1. A similar package for AR2 is available.

Address Syntax

We need a device name and a tag address to create a tag. We need to configure the tag address. When you have both the device name and tag address, type it in the OPC path of the Tag Editor using [device_name]:address format, where device_name is the name of the device and address is the configured address listed there.

Tag address are the combination of three different components. They are

Area Syntax

Data Type Syntax

Offset Syntax

Offsets : It is very important to note that offsets are absolute or not.

IW0 & IW1 are share a byte. You need to address IW0 and IW to get 2 consecutive, non-overlapping words.

You have to combine syntax for the desired area and DataType with an offset into area to form an address

For Example

Bits: Bits are addressed by using Bit DataType (X) and adding .bit to the end where the bit is in the range [0-7]. When addressing a bit at a certain offset, the offset is often treated as a byte.

Timers: Timers are scaled up to the DWord and translated from the S5 time format so that they can display the time in milliseconds without having any multipliers. When you write to a timer, it is automatically converted from milliseconds to the S5 time format for you. A DataType is not specified when accessing the Timer.

Strings: Strings are known to be in the S7 string format and to have a maximum length of 210.

Counters: Counters in the PLC will be processed in the BCD. The driver can automatically translate to/from BCD for you and expose any counter tags to UInt16 values. When accessing Counters, a DataType is not defined