PLC Programming Handbooks
Siemens S7 Indirect Addressing
The following is provided by Automation Training from their excellent Siemens Step 7 training manual. This is a really nice explanation of a difficult but important subject. Check out their website for hands-on and online training classes.
The most common form of addressing used in the Siemens S7 PLCs is direct and symbolic. When a direct addressed is referenced by an instruction there is no question as to the location in memory. The following are examples of direct addressing:
By using the methods of indirect addressing the address used by an instruction can be varied to point to any number of locations. In this case, a memory location stores a â€œpointerâ€ to another memory location. While this may increase the difficulty of troubleshooting, its advantage is to greatly reduce the number of networks and instructions needed to control a process. It is also a method that must be understood to use some of the library and system function calls provided by Siemens.
The POINTER and ANY Data Types
A POINTER data type is used to format a number to be accepted as an address rather then a value. A pointer is always preceded by a P# symbol. The pointer address may be in three different formats.
The ANY data type is used to pass a parameter of an unknown or undefined data type. Some functions in the library use the ANY data type to work on whole sections of memory. To do this, the last pointer method is used to describe an area. For example the address P#DB25.DBX 0.0 Byte 14 points to the first byte of DB25 with a length of 14 bytes.
NOTE: A DINT can be converted to a POINTER by simply shifting the double word left by 3 bits.
Data Block Instructions
When working with indirect addressing it is sometimes needed to first of all open a DB and then begin working on the
When monitoring in STL the shared DB number is displayed in the DB1 column and the instance DB number is displayed in the DB2 column.
Furthermore, there are instructions to confirm that the correct DB number is opened and that it is large enough for the next operation.
Memory Indirect Addressing
The first method of indirect addressing is called memory indirect addressing because it allows for a memory location (M, DB or L) to determine or point to another.
The memory area identifiers T, C, DB, DI, FB and FC use a word (16-bit) pointer location in integer format. Two examples are as follows:
The memory area identifiers I, Q, M, L, DB use a double word (32-bit) location using the POINTER data type.
When monitoring memory indirect addressing the INDIRECT column displays the current address the instruction is using.
Note that math can be done on the POINTER data type using the double math instructions (e.g. P#2.0 + P#5.0 = P#7.0).
Since the bit position only goes to eight the result of P#8.7 + P#1.1 = P#10.0 and not P#9.8. These methods can be used to offset the address or increase/decrease the pointer in a loop.
The Address Registers
Besides the regular accumulators, there are two 32-bit address registers (AR1, AR2) for storing pointers used in register indirect addressing methods. A series of different load and transfer type instructions can be used to work with AR1. A similar set is available for AR2.
Addition can be directly accomplished on AR1 and AR2 with the following:
Area-Internal Register Indirect Addressing
The area-internal register indirect addressing method uses one of the address registers plus a pointer to determine the address the instruction is to reference. The format is:
address identifier [address register, pointer]
The address identifier can be I, Q, M, L, DI or DB in bit, byte, word or double word form. The address register must be previously loaded with a double word pointer without reference to the address identifier. The exact address is determined by adding the address register with the pointer. The example below shows the area-internal method using bit locations.
Area-Crossing Register Indirect Addressing
Area-crossing register indirect addressing is similar to the area-internal method except the pointer loaded into the address register references a memory area (e.g. P#M10.0 or P#DBX0.0). This means the address identifier used before the opening bracket is not needed if referencing a bit otherwise it will be a B for byte, W for word or D for double. The example below shows the area-crossing method using bit locations.
This next example shows area-crossing methods using a word and double word format.
Exercise #2 (Advanced)