Configuring System and Clock Memory via TIA Portal Openness

Configuring System and Clock Memory via TIA Portal Openness

System memory bytes and clock memory bytes are reserved marker bytes inside an S7-1500 / S7-1200 CPU whose individual bits are driven automatically by the firmware. They eliminate the need to write ladder logic just to generate a 1 Hz blink, a first-cycle flag, or a diagnostic-changed edge. When the project is generated programmatically through TIA Portal Openness — Siemens' .NET-based automation interface — these bytes are exposed as four device attributes on the CPU item: SystemMemoryByte, SystemMemoryByteAddress, ClockMemoryByte, and ClockMemoryByteAddress. This reference explains what each bit does, how to write the attributes from C#, and why the same call sequence silently no-ops on an S7-1200.

1. Overview: What System and Clock Memory Bytes Do

The CPU firmware maintains two reserved MB (marker byte) areas whose contents are updated every scan without any user code involvement:

• System Memory Byte — a single MB whose bits expose CPU-level status: first-scan, always-true, always-false, diagnostic-state-changed, 24-hour-time-changed, and similar control flags.
• Clock Memory Byte — a single MB whose eight bits toggle at fixed, asymmetric frequencies so the programmer can pick whichever duty-cycle ratio is needed.

Both bytes are globally enabled at the CPU object, after which every program block, FC, FB, OB, and HMI tag can read them directly with the absolute address (MBx) or a symbolic alias. See the official S7-1200 G2 system manual page for the conceptual description: System and Clock Memory (Siemens TIA Docs).

2. Clock Memory Byte Bit Patterns

Each bit of the clock memory byte oscillates with a 50% duty cycle at a fixed period. The periods are not user-configurable; the CPU always produces this exact sequence:

The bit is high for the first half of its period and low for the second half, so a 1 Hz signal (bit 5) is high for 500 ms and low for 500 ms. The frequencies are exact; the jitter is bounded by the OB1 cycle time of the CPU.

3. TIA Portal Openness Attribute Reference

Openness exposes the byte enable flags and address values as four attributes on the CPU device item. The full attribute table from the TIA Portal Openness Hardware Parameters manual is:

The addresses are absolute MB numbers, not bit offsets — supplying 5 reserves MB5 for that function, so user code must not write to MB5 while the byte is enabled. Collision with other retained markers, HMI tags, or DB-optimized bit-packed areas is the most common field bug; pick an MB outside the range used by the program and outside any HMI pointer area.

4. Prerequisites

1. TIA Portal V16 or later installed with the Openness API option selected in the installer (Siemens Setup → "TIA Portal Openness").
2. A licensed copy of the TIA Portal Openness DLL set: Siemens.Engineering.dll, Siemens.Engineering.Hmi.dll, and Siemens.Engineering.S7.dll.
3. A Visual Studio (2019 or 2022) C# project, .NET Framework 4.7.2 or .NET 6.0+, with references to the above DLLs.
4. An open TIA Portal project that already contains the target CPU device. Openness cannot create the CPU — it can only modify parameters of an existing one.
5. For S7-1500: any CPU 151x / 150x / 151xSP / 150xSP with firmware V1.0 or higher.
6. For S7-1200 G2: only V20.0+ firmware; classic S7-1200 V4.x is not supported through these attributes.

5. Step-by-Step: Configuring the Bytes Through Openness (C#)

The canonical sequence opens a TIA Portal project, locates the first PLC's first device item (which is the CPU object), and writes the four attributes.

5.1 Minimal working example (S7-1500)

using Siemens.Engineering;

TiaPortal tia = new TiaPortal(TiaPortalMode.WithUserInterface);
Project project = tia.Projects.Open("C:\\Projects\\DemoProject.ap17");

// Pick the first PLC in the project tree
Device plc = project.Devices.First(d => d.Type.ToString().Contains("PLC"));

// DeviceItems[0] is the CPU rack; Items[0] inside it is the CPU module
UInt64 byteSystem = 1;   // MB1 → system memory
UInt64 byteClock   = 0;   // MB0 → clock memory

plc.DeviceItems[0].Items[0].SetAttribute("SystemMemoryByte", true);
plc.DeviceItems[0].Items[0].SetAttribute("SystemMemoryByteAddress", byteSystem);
plc.DeviceItems[0].Items[0].SetAttribute("ClockMemoryByte", true);
plc.DeviceItems[0].Items[0].SetAttribute("ClockMemoryByteAddress", byteClock);

project.Save();
project.Close();
tia.Dispose();

5.2 Address-collision guard

Before writing the address, walk the program's tag table to confirm the chosen MB is free:

bool IsMbFree(PlcSoftware plcSw, int mb)
{
    foreach (var tag in plcSw.TagTable.Tags)
    {
        var a = tag.LogicalAddress?.Address;
        if (a != null && a.Area == AddressArea.Marker &&
            a.ByteOffset == mb && a.BitOffset == 0 &&
            a.Length >= 8) return false;
    }
    return true;
}

5.3 Reading the current configuration back

bool sysEnabled  = (bool)plc.DeviceItems[0].Items[0].GetAttribute("SystemMemoryByte");
UInt64 sysAddr   = (UInt64)plc.DeviceItems[0].Items[0].GetAttribute("SystemMemoryByteAddress");
bool clkEnabled  = (bool)plc.DeviceItems[0].Items[0].GetAttribute("ClockMemoryByte");
UInt64 clkAddr   = (UInt64)plc.DeviceItems[0].Items[0].GetAttribute("ClockMemoryByteAddress");

If the attribute is returned as null rather than a default value, the underlying CPU does not implement the attribute — this is the diagnostic signal that the target is a classic S7-1200.

6. Manual Configuration in TIA Portal (UI Path)

For a single CPU it is faster to click through the Portal UI; the steps also document what the Openness attributes represent internally:

1. Open the project and expand Devices & Networks in the project tree.
2. Select the CPU device (e.g. CPU 1515-2 PN).
3. In the inspector (lower pane), switch to the Properties tab.
4. Navigate to System and clock memory (under "PLC alarms & diagnostics" or "Properties" depending on Portal version).
5. Tick Enable the use of system memory byte and enter the MB address.
6. Tick Enable the use of clock memory byte and enter the MB address.
7. Compile and download to the CPU.

The UI write and the Openness SetAttribute write end up in the same SystemData block on the CPU, so a UI-configured project and a script-configured project are interchangeable.

7. S7-1500 vs S7-1200 Compatibility Matrix

The Openness call sequence is identical across all three families; only the firmware's accept/reject behavior differs. On a classic S7-1200 the call returns successfully but the value is silently dropped at compile-to-CPU time, producing a project that looks correct in the Portal tree but has neither byte enabled after download.

8. Verification After Download

1. Open the project in TIA Portal, select the CPU, and choose Online & Diagnostics → Online tools → Force / Monitor/Modify.
2. Add the system memory MB (e.g. MB1) and the clock memory MB (e.g. MB0) to the watch table.
3. Go online; the system memory MB should show its status bits immediately, and the clock memory MB should pulse — verify the 10 Hz bit (M0.0) and the 1 Hz bit (M0.5) with the trace or with a counter in a temporary OB.
4. If the watch table shows all zeros and never changes, the byte is not enabled in the running configuration. Re-trigger a full download (not just delta) of the hardware configuration.

9. Troubleshooting Matrix

10. Engineering Best Practices

• Reserve a fixed block of MBs (e.g. MB0–MB15) exclusively for system/clock memory and document it in the project naming convention to avoid collisions.
• Generate the project from a template before writing the attributes; Openness throws on read-only states and on stale Project handles.
• Wrap every SetAttribute call in a try/catch and re-read the value to verify acceptance — silent no-ops are the dominant failure mode.
• When scripting a multi-CPU project, iterate plc.DeviceItems[0] per device; each CPU keeps its own address.
• Avoid MB addresses above 4095 on S7-1200 G2 — they will be rejected even though UInt64 accepts them.