Indirect Bit Addressing in SCL: S7-1200 and S7-1500 Methods

Overview: Why Indirect Bit Access in SCL Is Non-Trivial

Indirect addressing in SCL (Structured Control Language) on Siemens SIMATIC S7-1200 and S7-1500 controllers behaves very differently from the absolute, symbolic, or fully-qualified array-index syntax used in classic STL or LAD/FBD. SCL inherits its parser semantics from Pascal and therefore disallows the construct DB1.DBX[ByteOffset, BitOffset] as a direct operand. Engineers who need to read or write a single bit whose position is computed at runtime (for example, "bit n of word m of a 64-element array") must choose between three families of techniques:

1. Bit masking with AND/OR/SHL/SHR on a BYTE, WORD, DWORD or LWORD extracted by absolute or symbolic addressing. Works on every S7-1200/S7-1500 firmware and on optimized data blocks.
2. PEEK / POKE / PEEK_BOOL / POKE_BOOL instructions. Work only on non-optimized data blocks (or on bit memory, inputs, outputs) because they use the legacy absolute-byte address.
3. VARIANT, P# pointers and slice access %B<DB>.DBX<o>.X<n> via AT wrapper. The most modern approach for S7-1500 firmware V2.0+ and S7-1200 firmware V4.2+; required when indirect specification of the data block itself is needed.

The Siemens Knowledge Base article "Indirect addressing in SCL - STEP 7 Professional V13.0" explicitly documents that indirect specification of data blocks or DB tags is implemented with the PEEK / POKE instructions in S7-1500 and that the migration tool automatically converts older pointer-style code to PEEK/POKE during an S7-300/S7-400 project upgrade.

Prerequisites

Bit Numbering Convention in Siemens SIMATIC

All Siemens controllers number bits from right to left within a byte. Bit 0 is the least significant bit (LSB) at byte offset 7 of the Siemens representation, bit 7 is the most significant bit (MSB) at offset 0. Bytes, conversely, are numbered left to right starting at offset 0. This is the source of the most common indexing errors: an engineer who requests "bit 0 of byte 0" of a DWORD expects the LSB of the lowest byte but Siemens returns the LSB of byte 0 — which by coincidence is the same address, but requests for "bit 7" produce the MSB of the byte (value 0x80), not bit 7 of the high-order byte (value 0x80000000). Always pin the byte index first, then the bit index, before computing the mask.

Bit-mask formula for a single bit at position n (0-7) of a BYTE:

Mask := SHL(BYTE#1, n);     // 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80
Value := Value AND Mask;    // isolate the bit
Bit   := (Value <> 0);     // BOOL result

For a DWORD the bit position runs 0-31, so the shift operand is an LWORD-typed 1:

Mask64 := SHL(LWORD#1, n);   // 0<=n<=63 for LWORD

Method 1 — Bit Masking on an AT-View of a Symbolic Variable

This is the cleanest approach for new S7-1500 code targeting an optimized DB. Declare an AT overlay that re-interprets a byte array as an array of BOOL, then index it symbolically.

FUNCTION_BLOCK FB_BitAccess
VAR
    Raw     : ARRAY[0..63] OF BYTE;          // 64 bytes, 512 bits
    Bits    AT Raw : ARRAY[0..511] OF BOOL;  // overlay view, same memory
    ByteIdx : INT;
    BitIdx  : INT;
    Result  : BOOL;
END_VAR

BEGIN
    // Compute mask, isolate the requested bit
    IF (ByteIdx >= 0 AND ByteIdx <= 63) AND
       (BitIdx  >= 0 AND BitIdx  <= 7) THEN
        Result := (Raw[ByteIdx] AND SHL(BYTE#1, BitIdx)) <> 0;
        // write example:
        // Raw[ByteIdx] := Raw[ByteIdx] OR SHL(BYTE#1, BitIdx);  // set
        // Raw[ByteIdx] := Raw[ByteIdx] AND NOT SHL(BYTE#1, BitIdx); // clear
    END_IF;
END_FUNCTION_BLOCK

The AT overlay is fully symbolic and works on optimized blocks because the compiler computes the byte offset at compile time and emits absolute DBx.DBBy operands. The bit access itself, however, is still implemented as AND/OR in MC7/SCL — there is no single-bit read instruction generated.

Method 2 — PEEK_BOOL and POKE_BOOL on Non-Optimized Data Blocks

The SCL standard library exposes the following IEC 61131-3-compatible functions inside <Standard library> > IEC function blocks:

Where:

• area is a BYTE constant: 16#81 = PA (outputs/PIB/PQB/PAB), 16#82 = AA (bit memory), 16#83 = DB (data block), 16#84 = PE (inputs), 16#86 = DBW (instance DB).
• db is the DB number; pass 0 when area is not a DB.
• byteOffset, bitOffset are DINT variables, fully computed at runtime.

// Reading bit 3 of byte 17 from DB20
BitValue := PEEK_BOOL(area := 16#83,
                      db   := 20,
                      byteOffset := 17,
                      bitOffset  := 3);

// Writing a 1 to that bit
POKE_BOOL(area := 16#83,
          db   := 20,
          byteOffset := 17,
          bitOffset  := 3,
          value      := TRUE);

The technique referenced in the Siemens Knowledge Base at support.industry.siemens.com/cs/mdm/89515142 uses exactly this PEEK/POKE pattern when the destination data block is supplied as a runtime variable. Restrictions:

• The DB must be non-optimized (deselect "Optimized block access" in the DB properties). Optimized blocks rearrange symbolic members in load memory; the absolute byte offset no longer corresponds to the symbolic layout.
• The DB number must be a literal or an INT/DINT variable — symbolic DB names cannot be passed because the IEC 61131-3 PEEK/POKE signature requires a numeric DB number.
• PEEK/POKE bypass the system-consistency check; concurrent writes from another OB or HMI can race.

Method 3 — VARIANT Pointer with Type-Dereferencing

Since TIA Portal V13 and S7-1500 firmware V1.8, the VARIANT data type provides runtime type information plus an internal byte pointer. Combined with the type-deref operators % (slice) and the P# pointer literal, this enables indirect symbolic access.

FUNCTION_BLOCK FB_VariantAccess
VAR_IN_OUT
    AnyBlock : VARIANT;   // wired by the caller
END_VAR
VAR
    pByte : POINTER TO BYTE;
    Value : BYTE;
END_VAR

BEGIN
    // Resolve variant to a pointer
    pByte := AnyBlock.pByte;   // built-in helper on S7-1500
    IF pByte <> 0 THEN
        Value := pByte^;
    END_IF;
END_FUNCTION_BLOCK

For a true "bit of a byte" read using only VARIANT, the canonical Siemens recipe is to cast through P#:

// Read bit 4 of byte offset 12 from a VARIANT
BitValue := BOOL#0;
IF VariantHasTypeOf(VAR_BYTE, AnyBlock) THEN
    BitValue := (AnyBlock.%DB12.B4);
END_IF;

The slice syntax %DB<offset>.<type><n> is parsed by the S7-1500 compiler and emits a single bit-test instruction against the runtime-resolved VARIANT pointer. This is the only indirect bit-access mechanism that is officially supported on optimized data blocks.

Method 4 — Loop with 2-Dimensional BOOL Array

When the bit count is known at compile time (for example, 64 status bits of a station) and the index set is small, the simplest workaround is a 2-D array of BOOL. The compiler stores it row-major; reading any element is a single DB[].X symbolic reference, no masking.

VAR
    Status : ARRAY[0..7, 0..7] OF BOOL;   // 64 status bits
END_VAR

Status[3, 5] := TRUE;      // symbolic, no mask, no pointer
IF Status[3, 5] THEN
    // ...
END_IF;

This is the technique surfaced in the field report as a workaround when indirect masking "isn't elegant enough." It is correct, deterministic, works on every S7-1200/S7-1500 firmware, and is the recommended approach when the array bounds are bounded and known.

Comparison of Methods

Step-by-Step: Implementing Indirect Bit Read with PEEK_BOOL on a Non-Optimized DB

1. In the project tree, right-click the data block, choose Properties, and clear the Optimized block access checkbox. Confirm the compile.
2. Open the SCL source of the FB that performs the bit access.
3. Declare ByteOffset : DINT; BitOffset : DINT; BitValue : BOOL; in the VAR section. Optionally declare DBNum : INT;.
4. Insert the call BitValue := PEEK_BOOL(area := 16#83, db := DBNum, byteOffset := ByteOffset, bitOffset := BitOffset);.
5. For POKE_BOOL, call POKE_BOOL(area := 16#83, db := DBNum, byteOffset := ByteOffset, bitOffset := BitOffset, value := NewBit);.
6. Compile the block. Verify the compiler does not warn about optimized access — the warning "The block has optimized access; PEEK is not supported" means the optimization was inadvertently left on.
7. Download the program and use a watch table or the SCL online monitor to confirm BitValue tracks the expected DB bit.

Step-by-Step: Implementing Indirect Bit Write with VARIANT Slice

1. Declare the FB interface with VAR_IN_OUT Target : VARIANT; END_VAR.
2. In the SCL body, validate the type:
   IF NOT IS_BYTE(Target) THEN RETURN; END_IF;
3. Call the slice:
   Target.%DB0.X<n> := TRUE; — the compiler emits the runtime offset for <n>; <n> can be a variable only if the compiler can statically resolve the slice width, which means n must be in 0..7 for a single bit. Use a CASE to dispatch the variable to one of eight static slice writes when broader support is needed.
4. Download, then test with the SCL debugger or a small test FB that flips each bit and verifies via online monitoring.

Verification Checklist

• Compiler does not emit warning "POINTER used without VARIANT context" or "Indirect addressing not supported on optimized block".
• Online > Monitor shows BitValue toggle when you force the source bit from the watch table.
• Stepping through the OB1 cycle confirms a single PEEK_BOOL execution consumes one OB1 scan; PEEK of a DWORD consumes one as well.
• For multi-byte writes, confirm byte ordering on the target by writing the pattern 16#01020304 via POKE and reading back via a watch table in the DB.
• If the bit index is wired from an HMI tag, confirm the HMI tag is bound to an INT, not a BOOL — a common mistake leaves the bit index stuck at 0 or 1.

Troubleshooting Matrix

Performance Notes

On an S7-1516-3 PN/DP, the measured execution times for one indirect bit access are:

For scan-time-critical loops the 2-D BOOL array is fastest. For maximum flexibility across heterogeneous DBs, VARIANT slice wins. PEEK_BOOL is the right answer when the application must be portable to S7-300/S7-400.

Migration Path from S7-300/S7-400 to S7-1500

When migrating an S7-300/S7-400 SCL program that uses the legacy WORD_TO_BLOCK_DB, BLKMOV or direct P#DBxx.DBXoffset pointer arithmetic, the TIA Portal migration tool rewrites the pointer expressions into the equivalent PEEK/POKE calls because S7-1500 firmware disallows the original pointer syntax on optimized blocks. See the migration appendix of Indirect addressing in SCL (S7-300, S7-400) for the exact rewriting rules.

For new code on S7-1500, design with optimized blocks (the default) and use VARIANT pointers or AT overlays; reserve PEEK/POKE for legacy ports.

FAQ