Siemens PLC Addressing and Data Types in TIA Portal

• Every Siemens address = memory area (I/Q/M/DB) + size (bit/byte/word/dword) + location, e.g. M10.0 or DB1.DBX0.0
• BOOL is 1 bit; BYTE/WORD/DWORD are 8/16/32-bit raw bit strings; INT/DINT/REAL are numeric types built on those same sizes
• S7-1200/S7-1500 optimized data blocks hide absolute offsets by default — you address tags by symbolic name, not by DBX/DBB numbers

What Addressing Means in a Siemens PLC

Every value a Siemens PLC scans, calculates or writes out — a sensor bit, a motor speed, a batch counter — lives at a specific address in the CPU's memory. Addressing is simply the naming system that lets a program, and the engineer reading it, point at that exact location. Get comfortable reading addresses and you can look at almost any line of ladder logic or SCL and know instantly what physical signal or stored value it touches, without opening the hardware configuration.

In TIA Portal, an address is built from three pieces read left to right: the memory area (which block of memory), the size (how many bits you're reading as one unit), and the location (which byte and bit within that area). M10.0 reads as "Memory area, byte 10, bit 0." DB1.DBX0.0 reads as "Data Block 1, byte 0, bit 0." Once that pattern is familiar, every other address in a Siemens program follows the same logic.

Memory Areas: I, Q, M and DB

A Siemens S7-1200/S7-1500 CPU splits its working memory into a handful of named areas, and every tag you create belongs to one of them. Four areas cover almost everything an engineer touches day to day:

I and Q addresses are refreshed automatically by the CPU's process image at the start and end of every scan cycle, so program logic reads and writes I/Q like ordinary memory without touching the physical bus directly. M is pure working memory that survives between scans (though not, by default, a power cycle unless retentive). DB is where almost all structured data lives on modern hardware — recipe values, timers' preset/elapsed values, communication buffers, and instance data for function blocks (FBs) all sit inside data blocks.

Bit, Byte, Word and Double-Word Addressing

Any memory area (I, Q, M or DB) can be addressed at four different granularities, and the suffix letter after the area tells you which one you're looking at. The same physical memory can be read as a single bit or as a wider chunk covering several bits at once — which one you use depends on whether the value is a true/false flag or a numeric quantity like a temperature or a count.

A byte, word or double word address always starts at the same first byte number as its overlapping bit addresses — for example MW10 occupies the same two bytes as M10.0 through M11.7. This is exactly why mixing sizes carelessly at the same starting byte causes bugs: writing to MW10 silently changes the bits at M10.x and M11.x underneath it. Good addressing hygiene keeps bit flags and multi-byte values in clearly separated byte ranges, or — on S7-1200/1500 — simply lets TIA Portal assign non-overlapping addresses automatically inside a data block.

Elementary Data Types in TIA Portal

Where addressing tells you where a value lives, the data type tells the CPU how to interpret the bits stored there — as a logical true/false, a raw bit pattern, a whole number, or a number with a decimal point. TIA Portal enforces this strictly: you cannot add a BOOL to an INT, or move a REAL into a WORD tag, without an explicit conversion instruction.

Binary and Bit-String Types

Numeric Types

In everyday PLC work, INT and DINT cover most counters and setpoints, and REAL is the default type for anything scaled from an analog input (temperature, pressure, level) since NORM_X/SCALE_X instructions output REAL. TIME (for timer preset/elapsed values), DATE, TOD (time of day) and DTL (date-and-time structure, S7-1200/1500) round out the types used for scheduling and timestamping.

Symbolic vs. Absolute Addressing, and Optimized Blocks

Two ways exist to write the same address in TIA Portal, and knowing when each shows up saves confusion when reading someone else's program:

By default, data blocks created in TIA Portal for S7-1200/1500 are optimized: the compiler manages the internal byte offsets itself, tags are accessed purely by symbolic name, and there's no fixed DBX/DBB layout for the programmer to track. This is why a modern DB tag looks like "MotorData".RunFeedback rather than DB1.DBX4.2. A block can be switched to standard (non-optimized) access instead, which restores fixed byte offsets and absolute addressing — this is required for cases like ANY-pointer access, some communication blocks, or compatibility with S7-300/400-style code. Both approaches store the same data; optimized access simply hides the offset bookkeeping from the programmer.

Complex Data Types: STRUCT, UDT, ARRAY, STRING

Beyond the elementary types, TIA Portal lets you group and repeat data so a whole recipe, a whole conveyor's status, or a whole batch of readings can be addressed as one tag instead of dozens of separate ones.

UDTs are the workhorse of scalable programming: build one "Motor_UDT" containing Run, Fault, Speed and Runtime members, and every motor on the line gets a consistent, self-documenting tag structure instead of a wall of loosely related M and DB addresses. This is also the pattern behind most furnace and SCADA reporting projects, where each equipment instance reuses the same UDT so that SQL/reporting scripts can walk through them predictably.

For the full, authoritative list of every data type and its exact bit layout, range and conversion rules, Siemens maintains the reference documentation directly in the online help.