Indexed Addressing in Siemens S7 PLCs: M Area Arrays and PEEK/POKE

Siemens S7 controllers expose a flag (M) memory area that can be addressed as bits, bytes, words, and double words. When an application needs to walk through a contiguous block of flags using a runtime index—instead of hard-coding every absolute address—the engineer has three separate implementation paths depending on the controller family and the programming environment. Classic STEP 7 V5.x on the S7-300/S7-400, the embedded STEP 7 of TIA Portal targeting the same S7-300/S7-400 CPUs, and TIA Portal targeting the S7-1200/S7-1500 each use a different combination of syntax, data-block layout, and instructions. This reference documents the M-area indexed-access forms that have shipped in fielded programs, the data-type rules that govern symbol-table entries, and the migration path when an old STL routine is ported into modern SCL on an S7-1500.

1. Memory Model Overview: Inputs, Outputs, Flags, and Data Blocks

Every S7 CPU partitions its process image and internal RAM into fixed, byte-aligned areas:

The flag area is a flat byte array that can be sliced at any byte boundary. M[byte,bit] refers to the bit at (byte × 8) + bit; MW[n] refers to the 16-bit word whose least-significant byte sits at byte offset n. These two notations are the foundation of indexed addressing.

Per the Wikipedia array data structure reference, an array is stored such that the position (memory address) of each element can be computed from its index tuple by a mathematical formula. The S7 M area is precisely such a structure: byte n lives at fixed offset n from the start of the flags, so the address of MW[n] is &M + 2 × n in absolute terms. The PLC firmware performs this multiplication in a single microcycle when the index is a variable.

2. Classic STEP 7 V5.x Indexed Access on S7-300/S7-400

STEP 7 V5.x (the "classic" line) reached its terminal release as V5.7, which still installs on Windows 10 and Windows 11 and is the only officially supported route for legacy S7-300/S7-400 projects. Versions V5.0 through V5.7 are mutually compatible in source code; project files can move forward and backward with little rework.

Within a single Organization Block (OB) and without declaring any Data Block, classic STL accepts direct indexed syntax against the absolute flag area:

// STL, classic STEP 7 V5.x, valid on S7-300/S7-400
L     50                    // load index 50
T     MW    100             // store value at MW[100]
L     MB    [MW 200]        // indirect byte access using MW200 as index
T     MB    10
U     M     [MW 200, 3]     // bit access: byte from MW200, bit 3
=     M     5.0

Two important properties of this syntax:

1. Type is fixed by the operand identifier. MW[] is always a 16-bit Word; MD[] is always a 32-bit Double Word; MB[] is always an 8-bit Byte. The data type cannot be altered by the index.
2. No array declaration is needed. The flag area is treated as a raw, pre-existing array. The symbol table can assign a name to MW 100 (for example MotorSetpoint), but it cannot turn MW 100..MW 110 into an ARRAY[0..10] OF WORD declaration in V5.x.

SCL in V5.x uses square-bracket indexing as well but requires a temporary variable of integer type for the index:

// SCL, classic STEP 7 V5.x
VAR
    iIndex   : INT;
    wValue   : WORD;
END_VAR

wValue := MW[iIndex];
IF M[iIndex] THEN            // bit access by integer index
    MW[iIndex] := 0;
END_IF;

The pre-TIA symbol table (Symbol Editor) stores symbolic addresses—a name and an absolute address such as MW100—but it does not support array declarations. Array types in classic STEP 7 are declared inside a Data Block, never in the symbol table. Engineers who need 16-bit indexed scratch buffers must therefore either:

• Reserve a Data Block with ARRAY[0..n] OF WORD and access it via DB1.DBW[i], or
• Use the M area as a flat array with MW[idx] syntax, accepting that no symbol-table metadata records its size or type.

3. TIA Portal STEP 7 for S7-300/S7-400

TIA Portal (current major release line STEP 17) ships an embedded STEP 7 module that can program S7-300, S7-400, S7-1200, and S7-1500 from a single IDE. Two license tiers govern which targets are programmable:

The SCL syntax for indexed M-area access on the S7-300/S7-400 remains the same as classic V5.x:

// SCL, TIA Portal targeting S7-300/400
wScratch := MW[iIndex];

The TIA Portal editor, however, applies a stricter parser. Two engineering realities result from this:

1. Some legacy V5.x idioms that compiled silently (for example, an STL loop that updates the AR1 register by +AR1 P#2.0 and then loads M [AR1, P#0.0]) compile with warnings about pointer use and may be flagged by the SCL compiler as ambiguous.
2. The IDE encourages migration to Data-Block-resident arrays. When a project migrates from V5.x to TIA, the migration tool will, in many cases, convert a contiguous MW[0..100] scratch range into a global DB containing an ARRAY[0..100] OF WORD.

4. S7-1200 and S7-1500: PEEK and POKE Replace Indexed M-Area Syntax

The S7-1200 and S7-1500 firmware does not implement indexed absolute operand syntax in the same way as the S7-300/S7-400. The line was deliberately simplified. The official Siemens guidance is captured in the entry In STEP 7 (TIA Portal) and in S7-300/S7-400, how can you implement indirect addressing in an SCL program? on the Siemens Industry Online Support portal:

"In SCL for S7-1200 and S7-1500, indirect access to memory areas is implemented with the PEEK/POKE instructions. Use non-optimized data blocks for absolute addressing."

The runtime implications are significant:

• PEEK/POKE operate on byte addresses. A PEEK_WORD reads two bytes; POKE_DWORD writes four. The index passed is the byte offset, not the element index, so the engineer must multiply by 2 for WORD and 4 for DWORD.
• Optimized data blocks must be disabled for the source area. PEEK/POKE use the absolute byte offset in load memory; an optimized block reorganizes tags for speed and the byte offsets become unpredictable. TIA Portal will either reject the access or produce a compile error such as W:Address area of the PEEK/POKE instruction is not a non-optimized block.
• STL is no longer offered on the S7-1200. The S7-1500 emulates STL register operations for compatibility, with a measurable performance penalty relative to native SCL or LAD/FBD. Indirect addressing via AR1/AR2 in STL should be avoided on the S7-1500 unless absolutely necessary.

4.1 SCL Pattern: PEEK and POKE on the M Area

// SCL, TIA Portal, S7-1500 CPU 1515-2 PN
// Read MW at byte offset iByteOffset (must be even)
wValue := PEEK_WORD(area := 16#83,      // area code 0x83 = M (flags)
                   dbNumber := 0,      // not used for M area
                   byteOffset := iByteOffset);

// Write MD at byte offset (must be multiple of 4)
POKE_DWORD(area := 16#83,
           dbNumber := 0,
           byteOffset := iByteOffset,
           value := dwValue);

The area codes used by PEEK/POKE are documented in the TIA Portal help under PEEK/POKE — area parameter:

4.2 STL Pattern on S7-1500 (Compatibility Only)

// STL on S7-1500 — emulated register operations
// Not recommended; left here for migration reference only
LAR1  P##pSource              // load ANY-pointer from in/out
L     W [AR1, P#0.0]          // indirect read
T     MW   100

The S7-1500 firmware maintains AR1/AR2 as 32-bit registers internally; the emulation step adds roughly 0.5–1.5 µs per access compared with the native operand L MW 100. Multiply that by a 1000-iteration loop and the cycle-time penalty becomes visible. Rewrite the routine in SCL with PEEK/POKE or, preferably, with an in-DB array.

5. Data Type Rules in the Symbol Table vs. the DB

The source observation that MW[adr] "will always be in the Word format" is technically correct for the address itself but can mislead readers about what the symbol table accepts. The rules are summarized below.

For an ARRAY[0..255] OF WORD declared in DB1, the symbol table in TIA Portal can still bind a tag name to it (for example ScratchBuffer) and the address column shows DB1. The data type is set on the DB declaration, not in the symbol table.

6. Recommended Migration Path from Classic M[adr] to Modern Code

Step-by-step procedure for converting a legacy MW[idx] routine running on an S7-300 into an S7-1500 project without losing functionality.

1. Inventory the M range. In the V5.x project, open Reference Data > Display and export all writes to the M area. Record the byte-offset ranges touched by the indexed loop and the data types (byte / word / dword) actually consumed.
2. Reserve a non-optimized global DB. In TIA Portal, add a new global DB (for example DB_Scratch) and uncheck Optimized block access in the DB properties. Declare ARRAY[0..n] OF WORD and/or ARRAY[0..m] OF DWORD arrays sized to the inventoried range.
3. Replace indexed M access with PEEK/POKE if the original code must remain a thin shim. Use the area code 16#83 and pass 2 × idx for WORD offsets. Wrap each PEEK/POKE in a small FC so future cleanup can swap to direct array indexing.
4. Replace PEEK/POKE with direct array indexing in the long term. Once the legacy shim runs, rewrite the consumer blocks to read DB_Scratch.Scratch[idx]. This is type-checked, watchable in the online monitor, and benefits from the optimized-block acceleration on the S7-1500.
5. Verify byte ordering. S7 is little-endian; MD 100 occupies bytes 100–103 with the least-significant byte at 100. PEEK_DWORD uses the same order. Confirm on the receiving side that any high-endian device (e.g. some Modbus gateways) does not expect byte-reversed data.
6. Re-test on the target CPU with the diagnostic buffer open. Watch for event IDs 0x2522 (area length error), 0x2530 (DB not loaded), and 0x2942 (I/O access error) during the run-up sequence.

7. Optimized vs Non-Optimized Blocks: When the Choice Matters

On the S7-1500 (and to a lesser degree the S7-1200), each global DB has a toggle Optimized block access. The runtime effects are documented in the TIA Portal help and reproduced in condensed form here.

Engineering rule of thumb: keep new S7-1500 projects optimized unless a specific integration (legacy HMI tag poll, indirect PEEK/POKE, or third-party OPC UA mapper) demands absolute addressing. The S7-1500's symbolic access path is consistently 5–15 % faster than the absolute path on benchmark loops.

8. STL Register Operations and AR1/AR2 Indirect Addressing

The classical pointer-in-register style is still compiled by STEP 7 but is firmly in the legacy bucket for S7-1500 work. The relevant instructions are:

For S7-300/S7-400 STL this remains the fastest indirect-access path. For S7-1500, the same source compiles and runs, but the compiler emits a register-emulation call into firmware, slowing every iteration. Siemens' own guidance in the TIA Portal documentation is to refactor such loops to SCL with array indexing whenever possible.

9. Field-Commissioning Verification Procedure

After deploying a program that uses indexed M-area or PEEK/POKE access, run through the following verification before sign-off.

1. Static watch table. Open Watch & Force Tables in TIA Portal (or Monitor/Modify in classic). Add a row for the highest-indexed word in your range (for example MW[254]). Force a value from the laptop and confirm it appears on the online value column. Repeat for index = 0 and a mid-range index.
2. Diagnostic buffer sanity check. With the CPU in RUN, open Online & Diagnostics > Diagnostic Buffer. Verify that no event IDs from the indirect-access failure family (0x2522, 0x2530, 0x2942) have been logged since the program reached the steady state.
3. Cycle time check. Record the OB1 cycle time from the online diagnostics before and after switching from MW[idx] to PEEK/POKE. Document the delta; an S7-1500 typically shows a 0.3–1.0 ms increase for a 100-iteration loop.
4. Retain behavior. Power-cycle the CPU and verify that all retain-flagged M bytes reload their pre-power-down values. Indexed access into the retain region follows the same retention rules as direct access; this test catches accidental use of the non-retain sub-range.
5. HMI tag refresh. If the HMI is bound to MW[idx] by a polled tag, confirm the polling rate does not bottleneck the operator screen. S7-1500 symbolic tag access is faster than absolute polling and is the preferred path for HMI updates.

10. Troubleshooting Matrix

11. Frequently Asked Questions