Configuring Absolute Addressing for S7-1200 Global DB Tags in TIA

Overview: Why Absolute Addressing Matters for S7-1200 Global DBs

Symbolic tag names are the preferred programming model in TIA Portal for the S7-1200 and S7-1500 families, but the moment a third-party HMI/SCADA, OPC bridge, Modbus gateway, or non-Siemens PLC must read or write controller memory, the project must expose the absolute byte/word offsets that live behind every DB tag. TIA Portal V15.1 hides those offsets by default because the global data block is created with Optimized access enabled, and optimized blocks store tags in a non-deterministic layout that cannot be addressed symbolically from outside the project. The fix is to either flip the block to Standard access or to mirror the tags into a non-optimized block that the HMI can consume.

This reference walks through the exact mechanics for an S7-1214 CPU running TIA Portal V15.1, including the single-instance DB exception raised by Siemens motion libraries (e.g., AC_Homing_DB) and the storage location of Technology Object (TO) axis data such as Axis_1.Sensor[1].ActiveHoming.SwitchLevel.

Standard Access vs. Optimized Access: The Core Decision

Every global data block (DB) in TIA Portal inherits one of two storage models, and the choice cannot be made independently per tag — it is a property of the entire block.

Per the official TIA Portal V20 documentation, “PLC tags and DB variables in blocks with standard access have an absolute address. DB variables in blocks with optimized access have no absolute address.” That single sentence is the foundation of every decision in this article.

Disabling Optimized Access on a Global DB

1. In the project tree, right-click the target global DB (for example, Data_block_1 [DB8]) and choose Properties.
2. Open the Attributes section.
3. Clear the checkbox Optimized block access. If the block is already in use, TIA Portal will warn that the access mode can only be changed when no other block is calling it.
4. Click OK, then re-compile the project (Project → Compile → Software (rebuild all)).
5. Re-open the DB; the previously hidden Offset column now displays the absolute byte address for every tag.

Reading the Offset Column and Forming Absolute Addresses

After compile, the DB editor shows three columns that matter for external access:

The Siemens absolute address syntax for an HMI or SCADA tag is:

DB<DB number>,DB<length letter><offset>

Where the length letter follows the IEC 61131 convention:

Example conversions from TIA offset to HMI tag string:

Offset 0.0  BOOL   ->  DB8,DBX0.0
Offset 2.0  INT    ->  DB8,DBW2.0
Offset 4.0  REAL   ->  DB8,DBD4.0   (Citect/Vijeo: DB8,DBG4.0)
Offset 10.0 DTL    ->  DB8,DBL10.0

For S7-1200 firmware V4.x targets, an S7-1500-style HMI may also accept the symbolic form "Data_block_1".Motor_Speed, but any legacy WinCC Flexible, Citect, FactoryTalk, or Modbus TCP gateway that polls raw S7 areas still requires the absolute form.

PLC Tags vs. DB Tags: Where I, Q, and M Live

The S7-1200 separates PLC tags from DB tags. PLC tags are the global symbol table that maps onto fixed memory areas independent of any DB. There are exactly three address choices when you create a PLC tag:

PLC tags are always non-optimized — the M, I, and Q areas have fixed addresses by definition because they are mapped to physical inputs, physical outputs, and the CPU’s flag memory. A legacy third-party HMI that already speaks S7 MPI/TCP can read DB8 with the offsets above, or read MW100, IB0, etc., directly. There is no separate DB for PLC tags; they live in the CPU’s system memory and are listed in PLC tags → Show all tags.

The Single-Instance DB Exception (Motion FBs)

When a function block such as AC_Homing from the S7-1200 Motion Control library is instantiated as a single instance, TIA Portal auto-generates a private DB — in the project tree it appears as AC_Homing_DB. By design, that instance DB is created with optimized access and the checkbox is dimmed (greyed out) so that it cannot be flipped to standard access. This protects the FB’s internal layout from breaking with future library updates.

To expose motion-control data to a third-party HMI, do not try to change the access mode of the instance DB. Instead, copy the values you need into a normal global DB that is non-optimized:

// In OB1 or a cyclic interrupt OB
"Data_block_1".HomingActive := "AC_Homing_DB".HomingActive;
"Data_block_1".HomingSensor  := "AC_Homing_DB".SensorInput;
"Data_block_1".ActualPosition := "AC_Homing_DB".ActualPosition;

This pattern keeps the library FB untouched while giving the HMI a clean absolute-address target. If the HMI is a Siemens Comfort panel, you can also expose the instance DB directly through HMI tags — but with the trade-off that re-importing a new library version may shift the offsets.

Technology Object (TO) Data Storage

When a TO such as TO_PositioningAxis named Axis_1 or ARM_Rotation is added under Technology objects, TIA Portal automatically creates a system data block whose number is shown in the TO’s properties (commonly DB10, DB11, etc., but the actual number depends on project order). The TO-DB holds all axis parameters, sensor configuration, status bits, and motion state.

To see every tag in a TO-DB, expand it under Program blocks → System blocks. The view is identical to a user-defined DB — name, data type, and (for optimized blocks) the symbolic comment column. The Offset column is intentionally absent for optimized TO-DBs.

Recommended HMI hand-off pattern:

1. Create a global DB named, e.g., HMI_Motion with Optimized access = OFF.
2. Declare one tag per TO value you need to expose.
3. Use a cyclic OB (OB1 or OB35) to copy TO values into the HMI DB using the symbolic syntax shown above.
4. Compile, export the HMI DB to Excel via Project → Export → Tag list, and import into the third-party HMI’s tag database.

Recommended DB Layout for a Third-Party HMI

For a maintainable HMI hand-off, segregate data into three purpose-built DBs rather than mixing HMI traffic with control logic:

This pattern gives the third-party HMI a stable, documented contract while letting the rest of the program use the symbolic, optimized model that makes S7-1200 code easier to maintain.

Exporting Tag Lists for HMI Import

1. Compile the project (Project → Compile → Software) so offsets are settled.
2. Right-click the HMI_SCADA DB and choose Export → Tag list (CSV). The CSV contains the symbol, address (e.g., DB100.DBW0), data type, and comment columns.
3. Open the CSV in Excel and add any HMI-specific columns required by your SCADA (e.g., acquisition cycle, scaling, alarm limits).
4. Import the sheet using the SCADA’s native Excel/CSV importer. For Citect/Vijeo, prepend the tag string with DB as described above.

Verification Steps After Switching to Standard Access

1. Compile the project; the Offset column must be populated for every tag in the DB.
2. Go online and open the DB in the Monitor/Modify view. Each tag shows its absolute address in the column header (e.g., DB100.DBW4).
3. Force a known value into the first tag and read the same byte from the third-party HMI to confirm the offset matches.
4. Power-cycle the PLC (STOP → RUN) and verify that non-retentive tags reset to their initial values — this is expected behaviour for standard-access blocks.
5. If the HMI loses values after a download, enable Retain on the affected tags in the DB editor.

Troubleshooting Matrix

Reference Documentation

The mechanics above are documented in the official TIA Portal programming reference and the S7-1200 system manual. The two entries below describe the symbolic-vs-absolute addressing rules and confirm that optimized blocks deliberately hide offsets:

• Using tags within the program — STEP 7 / TIA Portal V20
• Addressing variables in global data blocks — STEP 7 Basic V13.1
• Addressing tags in global data blocks — STEP 7

FAQ