Free tool

PLC address and data type calculator

Work out the offsets of the variables in a Siemens S7 standard-access data block and the DB length, convert addresses between notations, and see when a counter will reach its INT or DINT limit.

Data block (DB) layout

Variable	Type	Address	TIA absolute address	Size

Address notation converter

Address As DB10.DBW4, %DB10.DBW4 or P#DB10.DBX4.0 WORD 1

Address notation converter

Counter overflow time

Current counter valuecounts Increase per hourcounts/h

Counter overflow time

Data types and value ranges

Type	Bits	Minimum	Maximum	Note
BOOL	1	FALSE	TRUE
BYTE	8	16#00	16#FF	bit string
CHAR	8	16#00	16#FF	one character
WORD	16	16#0000	16#FFFF	bit string
INT	16	-32768	32767
DWORD	32	16#0000_0000	16#FFFF_FFFF	bit string
DINT	32	-2147483648	2147483647
REAL	32	±1.175495e-38	±3.402823e+38	IEEE 754 single precision, about 7 significant digits
LREAL	64	±2.2250738585072014e-308	±1.7976931348623157e+308	IEEE 754 double precision; S7-1200 and S7-1500
LINT	64	-9223372036854775808	9223372036854775807	S7-1500 only
STRING	(n+2)×8	''	254	up to 254 characters + 2-byte head

How the DB layout is calculated

The tool places variables in a standard-access data block in the order the STEP 7 and TIA Portal editors place them: BOOLs fill the bits of a byte, BYTE and CHAR take one byte, larger types and STRING start on an even byte, and the block length is rounded up to an even number. For the six variables in the example the result is: Calisiyor DBX0.0, Arizada DBX0.1, AlarmKodu DBW2, Sicaklik DBD4, UrunKodu (STRING[10]) DBB8…DBB19, KaliteOnay DBX20.0; DB length 22 bytes.

Siemens does not publish these layout rules as one official table. The 2-byte STRING head and the 254-character limit come from Siemens' "Working with Strings in S7-SCL" (entry ID 22506480); the alignment rules are how the editors behave. So check the computed offsets against the "Offset" column of the DB editor. Optimized-access blocks have no fixed offsets, and this tool does not apply to them.

Address converter and data types

The converter translates between DB10.DBW4, %DB10.DBW4 and P#DB10.DBX4.0 WORD 1. It warns when a WORD or DWORD starts on an odd byte: no variable starts there in a standard DB, so such an address is most likely an access spanning two variables. The data type table helps when you decide which type to store a PLC value as in SCADA or a database.

Counter overflow time

Production counters are often declared as INT and wrap to a negative value after 32767. Enter the counter's current value and its increase per hour; the tool shows how many hours are left until the INT and DINT limits. We explain how we handle these overflows when collecting data in our PLC data collection guide and on our Siemens S7 PLC data collection page. More tools are on the tools page.

The tool is for information; confirm addresses in the PLC project and against a known value.

Frequently asked questions

Common questions

How are variables laid out in a standard-access DB?

BOOL variables fill bits 0–7 of a byte in order and move to the next byte after the eighth BOOL. BYTE and CHAR take the next free byte. WORD, INT, DWORD, DINT, REAL, LREAL, LINT and STRING start on an even byte; if the previous element ended on an odd byte, a pad byte is left. The block length is rounded up to an even number. Check the computed offsets against the "Offset" column of the DB editor in TIA Portal.

Do these addresses apply to optimized DBs?

No. Optimized-access blocks, the default on S7-1200 and S7-1500, have no fixed offsets; you cannot reach a variable with an absolute address such as DBW4, only by its symbolic name. If a SCADA, HMI or data collection driver reads absolute addresses, turn off "Optimized block access" in the block properties.

Why does a STRING take 2 bytes more than its length?

The first byte of an S7 STRING holds the maximum length and the second the current length; the characters start at the third byte. So STRING[10] takes 12 bytes and a STRING with no length (254 characters) takes 256 bytes. Siemens describes this in "Working with Strings in S7-SCL" (entry ID 22506480).

What is the difference between DB10.DBW4, %DB10.DBW4 and P#DB10.DBX4.0 WORD 1?

All three point at the same place. DB10.DBW4 is the STEP 7 Classic notation, %DB10.DBW4 is the TIA Portal absolute address, and P#DB10.DBX4.0 WORD 1 describes the same area as an ANY pointer (start bit, type and count). DBX is a bit, DBB a byte, DBW a 2-byte word and DBD a 4-byte double word.

When does an INT counter overflow, and what happens then?

An INT holds at most 32767 and a DINT at most 2147483647. A counter that reaches the limit wraps to the negative minimum (-32768 for INT) on the next increment, and the production count suddenly reads negative. An INT counting 1200 parts an hour from zero overflows in about 27 hours; as a DINT the same counter would last more than 200 years.