The Ewon Flexy 205 sends a read request through the configured Siemens S7 connection to the PLC data block. The path can succeed at the network and session layers while the returned text is still wrong. Follow the packet: confirm the physical connection, confirm the data block address, then determine whether the reader starts at the STRING header or at its first character.
Where can the string read fail?
A working PLC connection does not prove that the tag address or data interpretation is correct. String length does not alter the network port or polling path; it changes how bytes returned from the data block must be decoded.
| Path element | Check | Pass condition |
|---|---|---|
| Physical layer | Link state, cabling, and interface counters | The link remains up without increasing error counts. |
| Network path | PLC address selected by the configured Siemens S7 connection | The Flexy reaches the intended PLC. |
| Session | Configured connection and port | Ordinary PLC reads complete without session errors. |
| Data block |
DB10 and byte offset 0
|
The address identifies the actual start of the STRING object. |
| Decoder | Interpretation selected by DB10,S0
|
The returned character count matches the PLC current-length field. |
| Polling | Configured update interval | A controlled PLC edit appears after the expected tag updates. |
Layer one first. If other values from the same PLC connection fail or update intermittently, repair the link or session before changing the string tag. If ordinary reads work and only the string is malformed, move directly to the data block layout and decoder.
What does STRING[50] store in the PLC?
For a classic Siemens S7 STRING, 50 is the maximum character capacity, not the complete storage size and not necessarily the number of valid characters currently present. The object contains two header bytes followed by the character area:
| Relative byte | Meaning | Expected value for this example |
|---|---|---|
0 |
Maximum length | 50 |
1 |
Current length | From 0 through 50
|
2 onward |
Character storage | Up to 50 characters |
Under that layout, STRING[50] consumes 52 bytes: two header bytes plus 50 character bytes. A type-aware reader starts at the first header byte and uses the current-length byte to decide how many characters to return. A raw-byte reader has no such context and needs separate length handling.
Confirm the actual data block representation in the PLC programming software. Absolute byte addressing requires a stable, externally addressable layout. If the data block uses a layout that does not expose fixed offsets to the external client, an apparently correct byte number can still target the wrong storage.
Which addressing approach should be used?
| Approach | Start address | Length source | Main failure mode |
|---|---|---|---|
| Type-aware STRING read | First byte of the STRING header | Maximum- and current-length header bytes | Starting at the character area shifts the decoder by two bytes. |
| Raw character-area read | First character byte | Separate known count or application logic | Unused or stale bytes appear after a shorter value. |
| Fixed-width text treatment | Application-defined byte range | Configured field width | Padding, terminators, and current length are handled inconsistently. |
Use the type-aware approach first for DB10,S0: point the tag at the first byte of the PLC STRING object and let the returned value prove whether the driver consumes the header. Do not add two to the byte offset merely because the text begins two bytes later. That offset is appropriate only when deliberately reading raw character bytes.
The absence of a manual string-length field is not itself a truncation fault. The decisive check is whether changes to the PLC current length produce the same character count at the Flexy tag. This test also works when different tags have different declared capacities.
How do you diagnose truncation or trailing characters?
Observe the source STRING and the Flexy tag during controlled value changes. Use a test value whose characters and length are unambiguous; repeated spaces or identical characters hide offsets and stale bytes.
| Symptom | Likely boundary | Diagnostic check |
|---|---|---|
| First characters are missing or nonsensical | Starting offset | Verify that DB10,S0 targets the header, not the first character. |
| Value stops before the PLC current length | Reader limit or embedded data terminator | Compare the displayed count with the PLC current-length byte and inspect the character bytes at the stopping point. |
| Old characters remain after a shorter value | Source header or raw fixed-width read | Check whether the PLC current-length byte changed when the shorter value was written. |
| One tag works but another does not | Per-tag offset or data type | Compare each tag's declared capacity, header location, and configured start address. |
| Value alternates during an update | Write/read sequencing | Observe several polling cycles and determine whether the PLC updates the header and characters as one coherent operation. |
Extra characters have two common mechanisms. The source logic can write new characters without setting the correct current length, or the client can read the entire allocated character area instead of honoring that length. Inspecting the header separates them: if the header declares the extra characters as current, repair the PLC write logic; if the header declares the shorter value but the Flexy still displays more, investigate the tag's decoding and downstream display or logging path.
How should the tag and PLC value be tested?
- Open the PLC data block and identify the first byte of the STRING object. Confirm that the object is
STRING[50]for this test rather than a raw character array. - At the object start, inspect the maximum-length byte, current-length byte, and first several character bytes. For this example, the maximum-length byte should contain
50. - Configure the Flexy tag with
DB10,S0only when byte0ofDB10is the STRING header. If the STRING starts elsewhere, use its actual header offset while retaining the same address form. - Write a short, distinctive value through normal PLC string logic. Record the PLC current length and compare it with the number of characters returned by the tag.
- Replace it with a longer value that does not exceed 50 characters. Confirm that the returned text grows to the new current length without losing its first two characters.
- Replace the long value with a shorter value. Confirm that old trailing characters disappear even if unused bytes remain in the allocated character area.
- If the header is correct but the tag remains wrong, inspect any Flexy script, logging stage, export, or display that consumes the tag. A downstream fixed-width buffer can reintroduce padding or stale suffixes after the PLC read succeeded.
How is the final result verified?
Run boundary-oriented tests rather than checking one normal value. Test an empty STRING, a one-character STRING, a shorter value written after a longer value, and a value at the declared 50-character capacity. For every case, compare three observations: the PLC current-length byte, the actual character bytes, and the Flexy tag's displayed character count.
Record the configured address and the observed counts for each tag because their declared capacities differ. A passing result has the correct first character, exactly the PLC current number of characters, no stale suffix after shortening, and a new value visible after the configured polling updates.
FAQ
Why does the Ewon Flexy 205 have no STRING length field?
A classic Siemens S7 STRING carries maximum and current length in its two-byte header. With a type-aware read, configure the start of that header and verify that the returned count follows the PLC current-length byte.
Why does my Siemens STRING show extra characters at the end?
The PLC current-length byte may still include the suffix, or a raw/fixed-width consumer may be exposing unused character bytes. Write a shorter value, inspect the header, and check whether the Flexy returns exactly that declared length.
Why does DB10,S0 truncate or misread STRING[50]?
Confirm that byte 0 of DB10 is the first header byte, not the first character or another variable. Finish by testing a 50-character value and verifying that the PLC current length and Flexy character count both equal 50.