Every Siemens PLC tag lives at an address made of a memory area, a size, and a location: for example M10.0 is Memory area, bit 0 of byte 10, and DB1.DBX0.0 is bit 0 of byte 0 inside Data Block 1. The four working memory areas are I (Input), Q (Output), M (Bit memory/Merker) and DB (Data Block); each can be addressed as a single bit (.X), byte (B), word (W) or double word (D). On top of that address sits a data type — BOOL for a bit, BYTE/WORD/DWORD for raw bit strings, or INT/DINT/REAL for numeric values — which tells TIA Portal how to interpret and calculate with the value stored there.
- Every Siemens address = memory area (I/Q/M/DB) + size (bit/byte/word/dword) + location, e.g. M10.0 or DB1.DBX0.0
- BOOL is 1 bit; BYTE/WORD/DWORD are 8/16/32-bit raw bit strings; INT/DINT/REAL are numeric types built on those same sizes
- S7-1200/S7-1500 optimized data blocks hide absolute offsets by default — you address tags by symbolic name, not by DBX/DBB numbers
The addresses below come from the conveyor project in Part 2: OPB push buttons on RIO_1, roller-bed contactors and the G120 drive. Each step has a live tool, with the full reference tables folded underneath.
Read Any Siemens Address: I, Q, M and DB
Every address is area + size + byte (+ bit). Type one, or pick an address from the Part 2 conveyor project.
Reference: the four memory areas
| Area | Letter | Purpose | Typical example |
|---|---|---|---|
| Input | I | Physical/process input signals read from digital and analog input modules at the start of each scan cycle | I0.0 — a start-pushbutton wired to input channel 0 |
| Output | Q | Physical/process output signals written to output modules at the end of each scan cycle | Q0.1 — a motor contactor coil |
| Bit Memory | M | Internal flags and working memory, not tied to any physical wiring — used for logic markers, timers, interlocks | M10.0 — a "system ready" internal flag |
| Data Block | DB | Structured, user-defined storage for tags, recipes, setpoints and instance data of function blocks; the main working area on S7-1200/1500 | DB1.DBX0.0 — bit 0 of byte 0 in Data Block 1 |
Bit, Byte, Word and Double Word: How They Overlap
MB10 to MB13 below are real memory. A word or double word is just a wider window on the same bits, and Siemens puts the high byte first.
Same bits, read as different addresses and types
Reference: bit, byte, word and double-word addressing
| Size | Suffix | Width | Example | Typical use |
|---|---|---|---|---|
| Bit | none (dot notation) | 1 bit | M10.0, I0.3, Q0.1 | On/off signals, flags, interlocks |
| Byte | B | 8 bits | MB10, IB0, QB4 | Small numeric values, thumbwheel/DIP switch banks |
| Word | W | 16 bits | MW10, IW0, QW4 | Analog input/output raw values (0–27648 range), 16-bit counters |
| Double word | D | 32 bits | MD10, ID0, QD4 | REAL/DINT values — scaled process values, large counters |
Want to practice addressing on real hardware?
Live TIA Portal session covering I/Q/M/DB addressing, data types and SCL programming — Pune classroom or online.
Elementary Data Types in TIA Portal
The address says where, the data type says how to read it. Pick a type to see its size and range, then test a value against every type.
Will it fit?
Reference: binary and bit-string types
| Type | Size | Description |
|---|---|---|
| BOOL | 1 bit | A single true/false value — the type behind every dot-notation bit address |
| BYTE | 8 bits | Raw bit string, no numeric meaning by default — often used for status/diagnostic bytes |
| WORD | 16 bits | Raw 16-bit bit string — common for control/status words (e.g. drive STW1/ZSW1) |
| DWORD | 32 bits | Raw 32-bit bit string, used for wide status registers and bit-level masks |
Reference: numeric types and ranges
| Type | Size | Range (signed unless noted) | Availability |
|---|---|---|---|
| SINT / USINT | 8 bits | −128 to 127 / 0 to 255 | S7-1200, S7-1500 |
| INT / UINT | 16 bits | −32,768 to 32,767 / 0 to 65,535 | All families (UINT: S7-1200/1500) |
| DINT / UDINT | 32 bits | −2,147,483,648 to 2,147,483,647 / 0 to 4,294,967,295 | All families (UDINT: S7-1200/1500) |
| LINT / ULINT | 64 bits | Large signed/unsigned integers | S7-1500 only |
| REAL | 32 bits | Floating-point, ~6–7 significant digits | All families — the standard type for scaled process values |
| LREAL | 64 bits | Double-precision floating-point | S7-1200, S7-1500 |
Symbolic vs Absolute Addressing and Optimized Data Blocks
S7-1500 data blocks are optimized by default: you access members by name only. Switch to standard access to see the fixed offsets that S7-300/400 code relies on.
| Name | Data type | Offset | Absolute address | Symbolic access |
|---|---|---|---|---|
| Run | Bool | 0.0 | %DB1.DBX0.0 | "PRB_1".Run |
| Fault | Bool | 0.1 | %DB1.DBX0.1 | "PRB_1".Fault |
| Speed | Real | 2.0 | %DB1.DBD2 | "PRB_1".Speed |
| Runtime_s | DInt | 6.0 | %DB1.DBD6 | "PRB_1".Runtime_s |
Reference: absolute vs symbolic addressing
| Method | What it looks like | Where you'll see it |
|---|---|---|
| Absolute addressing | %I0.0, %M10.0, %DB1.DBX0.0 | Older S7-300/400 style programs, standard (non-optimized) data blocks, cross-reference views |
| Symbolic addressing | "StartButton", "Motor1_Run", "Recipe".SetTemp | Everyday S7-1200/1500 programming — TIA Portal shows the symbolic name while the absolute address sits underneath it |
Complex Data Types: UDT, ARRAY, STRUCT and STRING
Define a PLC data type (UDT) once, then reuse it. One ARRAY[1..16] OF Motor_UDT gives every roller bed on the conveyor the same members.
Fault : Bool
Speed : Real
Runtime_s : DInt
Change the UDT once and all 16 instances update.
Reference: STRUCT, UDT, ARRAY and STRING
| Type | What it is | Addressing example |
|---|---|---|
| STRUCT | An anonymous grouping of different data types declared inline inside a single tag or block | "Motor1".Status.Fault |
| PLC data type (UDT) | A named, reusable structure template — define it once, then declare many tags of that type (e.g. one "Motor_UDT" reused for every motor) | "ConveyorA".RunFeedback, "ConveyorB".RunFeedback |
| ARRAY | A fixed- or variable-length list of elements, all of the same data type, addressed by index | "Setpoints"[3], ARRAY[0..9] OF REAL |
| STRING / WSTRING | A sequence of characters with a maximum and current length header, used for text such as recipe names or alarm messages | "BatchName" (STRING[20]) |
Quick Quiz: Siemens Addressing and Data Types
1. Which address is bit 2 of input byte 10?
Byte first, then bit: %I10.2. Bits only go 0 to 7.
2. %MW10 covers which bytes?
A word is 2 bytes. %MD10 would cover MB10 to MB13.
3. You write MW10 := 1. Which bit becomes TRUE?
Siemens stores the high byte first, so the low byte of MW10 is MB11 and the value 1 lands in M11.0.
4. Best data type for a scaled tank level in mm with decimals?
Decimals need a floating-point type. SCALE_X outputs a Real.
5. A raw value of 40 000 fits in…
Int stops at 32 767. UInt goes to 65 535 (DInt also works).
6. %DB1.DBX0.0 only works when DB1 has…
Absolute DB addresses need standard (non-optimized) access.
Step-by-Step Lab: Addressing and Data Types in TIA Portal
Hands-on- TIA Portal installed (V17 or later), any S7-1200 or S7-1500 project — a PLCSIM simulation is enough, no physical hardware required.
- A CPU already added to the project, with the default PLC tag table open.
- Basic familiarity with opening the PLC tags editor and a Data Block.
- Estimated time: 12 minutes.
Create bit, byte and word tags in the PLC tag table
Open the default PLC tag table and add three tags: StartButton (data type BOOL, address I0.0), StatusByte (data type BYTE, address MB20), and SpeedSetpoint (data type INT, address MW22).
Add a data block and compare optimized vs. standard access
Insert a new global Data Block, add a BOOL member and a REAL member, and check its properties. Note that "Optimized block access" is ticked by default. Untick it, and observe how the DB view changes.
Build a UDT and reuse it for two instances
Create a PLC data type named Motor_UDT with members Run (BOOL), Fault (BOOL) and Speed (REAL). Then declare two DB tags of this type: Motor1 and Motor2.
Trigger and read a data type mismatch error
In a new SCL block, try assigning the BOOL tag StartButton directly to the INT tag SpeedSetpoint (e.g. SpeedSetpoint := StartButton;) and compile the block.
If Step 2 showed you the hidden DBX offsets appear only with optimized access off, and Step 4's compile error correctly blocked an invalid BOOL-to-INT assignment, you've demonstrated the two ideas this lesson is built on: addresses have a fixed structure whether or not TIA Portal shows you the offsets, and data types are enforced strictly at compile time. Keep tags symbolically named and correctly typed from the start — it's far cheaper than untangling a byte-overlap bug on the shop floor.
Frequently asked questions
Why does writing MW10 change M10.0?
MW10 covers bytes MB10 and MB11, and Siemens stores the high byte at the lower address. MB10 is the high byte of MW10, so M10.0 is bit 8 of the word. Any write to MW10 or MD10 also rewrites the bits M10.0 to M11.7.
Which data type should I use for an analog input?
The analog module delivers a raw INT, 0 to 27 648 for the nominal range. Scale it with NORM_X and SCALE_X into a REAL in engineering units such as mm or bar, and use the REAL in the program and on the HMI.
What do I, Q and M stand for in a Siemens PLC address?
I is Input (physical/process input signals), Q is Output (physical/process output signals), and M is Bit Memory or "Merker" — internal working memory not tied to any physical wiring. DB, Data Block, is where most structured tag data lives on S7-1200/1500 projects.
What is the difference between M10.0 and MW10?
M10.0 addresses a single bit — bit 0 of byte 10 in Bit Memory. MW10 addresses a 16-bit word starting at the same byte 10, covering bytes 10 and 11. Writing to MW10 changes the bits that M10.0 through M11.7 also point to, since they overlap the same memory.
What is the difference between absolute and symbolic addressing?
Absolute addressing uses the raw address directly, like %M10.0 or %DB1.DBX0.0. Symbolic addressing uses a human-readable tag name, like "StartButton", which TIA Portal maps to that same absolute address behind the scenes. Modern S7-1200/1500 programs are written almost entirely with symbolic names.
What does "optimized block access" mean for a data block?
It means TIA Portal manages the internal byte offsets of that DB automatically, so tags are addressed only by symbolic name with no fixed DBX/DBB layout. Turning it off restores standard access with visible absolute offsets, which some communication instructions and legacy code require.
Why can't I assign a BOOL value directly to an INT tag?
TIA Portal enforces data types strictly at compile time: a BOOL is a single bit with no numeric meaning, while an INT is a signed 16-bit number. A direct assignment between incompatible types is rejected; use an explicit conversion instruction such as BOOL_TO_INT if the conversion is genuinely needed.