S7-1200: Copy Array Elements to a DWORD DB Using PEEK and POKE

This reference solves a common S7-1200 bit-packing task: copying 320 BOOLs from an array into 10 consecutive DWORDs inside a data block. The pattern shows up wherever you build a binary status payload for Modbus, PROFINET, ASCII, or an inter-PLC handshake, and the constraint that triggers most of the questions is that the S7-1200 instruction set does not include the S7-1500/300 wide MOVE. Three fully working techniques are documented below: the AT overlay (preferred), the PEEK/POKE pair, and the POKE_BLK block copy. Each is sized against the others and verified against the official Siemens FAQ PEEK / POKE commands in S7-1200/S7-1500.

1. Problem Definition and Numeric Mapping

The user requirement is fixed by the arithmetic:

• 320 bits ÷ 8 bits/byte = 40 bytes
• 40 bytes ÷ 4 bytes/DWORD = 10 DWORDs
• DWORDs sit on a 32-bit (4-byte) boundary in little-endian Siemens addressing

This means the destination must be a contiguous 40-byte slot in a DB and the source must align on byte 0 of that slot. Misalignment (for example, writing to dwBits starting at DBW5) still works because PEEK/POKE are byte-addressed, but the resulting packing is intentional, not implicit, and you must document the bit order if it crosses a comms boundary.

2. Memory Layout and View Overlay

Figure 1 — 40 bytes shown twice: above as 320 bits (BOOL[0..319]) and below as 10 DWORDs (DWORD[0..9]). The two views share the same storage when an AT overlay is used; with PEEK/POKE the same memory is re-read or re-written through byte offsets.

3. Prerequisites

1. CPU firmware: S7-1200 with FW 4.0 or higher (PEEK/POKE officially available from FW 4.2 according to the Siemens FAQ; AT overlays are supported from FW 4.0).
2. TIA Portal: V13 SP1 or higher. V17+ recommended for the latest compiler diagnostics.
3. Block access mode: PEEK/POKE and AT overlays both require standard (non-optimized) block access. Open the block properties, go to Attributes and clear the Optimized block access check box. Any DB referenced by absolute address must also be standard-access.
4. Knowledge base: read the official Siemens FAQ on PEEK/POKE before coding: SIMATIC S7-1200/S7-1500 PEEK/POKE commands.
5. Document: Entry ID 42603881 — Copy memory areas and structured data in TIA Portal contains the canonical array-element assignment pattern used in Method 4.

4. Method 1 — AT Overlay (Fastest, No Scan-Time Cost)

An AT overlay declares a second symbolic view of an existing variable in the same block. The two views share every byte, so writing one element of the BOOL array is identical to writing the corresponding bits of the matching DWORD. No loop, no scan-time overhead, no PEEK/POKE.

Step 1 — Create a standard-access DB. In TIA Portal, add a new DB (for example DB_PackedBits). In Properties → Attributes, clear Optimized block access. Confirm with OK.

Step 2 — Declare the AT overlays:

DATA_BLOCK "DB_PackedBits"
{ S7_Optimize_Access := 'FALSE' }   // standard access required
  VAR
    abStorage : ARRAY[0..39] OF BYTE;                    // base storage (40 B)
    bBits   AT abStorage : ARRAY[0..319] OF BOOL;         // bit view
    dwWords AT abStorage : ARRAY[0..9]   OF DWORD;       // dword view
  END_VAR
BEGIN
END_DATA_BLOCK

Step 3 — Use the views interchangeably from any FC/FB:

// Single BOOL assignment
"DB_PackedBits".bBits[17] := TRUE;       // bit 17 of the 320-bit strip

// Whole DWORD assignment
"DB_PackedBits".dwWords[2] := 16#DEAD_BEEF;

// Hand a DW to a comms FB
iStatus := "FB_Modbus_Send"(dwData := "DB_PackedBits".dwWords[0]);

Compiler behaviour: the compiler resolves bBits[17] to byte offset 2, bit 1 of that byte (zero-based, little-endian). The same byte is simultaneously part of dwWords[0]. Setting dwWords[0] := 16#0000_0002 therefore sets bBits[17] to TRUE without any user code in between.

5. Method 2 — PEEK and POKE in an SCL Block

When you cannot edit the DB layout (for example, the 10 DWORDs already live in a third-party DB provided by a Siemens library), use the PEEK/POKE pair from an SCL source. PEEK reads and POKE writes a single byte, word, or dword from/to any absolute address in the CPU's addressable memory.

Step 1 — Declare the helper FC as a non-optimized block so the PEEK/POKE call resolves an absolute target:

FUNCTION "FC_BoolArray_To_Dwords" : Void
{ S7_Optimize_Access := 'FALSE' }
  VAR_INPUT
    bExecute     : BOOL;          // rising edge starts the copy
  END_VAR
  VAR_TEMP
    i            : INT;
    dwValue      : DWORD;
  END_VAR
BEGIN
    IF bExecute THEN
        FOR i := 0 TO 9 DO
            // Pack 32 source bits into one DWORD by OR-ing shifts.
            // Pattern only valid when source is a BOOL array.
            dwValue :=
                  (DWORD_TO_DWORD("DB_SourceBits".bBits[i*32 + 0]) SHL 0)
                OR (DWORD_TO_DWORD("DB_SourceBits".bBits[i*32 + 1]) SHL 1)
                OR (DWORD_TO_DWORD("DB_SourceBits".bBits[i*32 + 2]) SHL 2)
                OR (DWORD_TO_DWORD("DB_SourceBits".bBits[i*32 + 3]) SHL 3)
                OR (DWORD_TO_DWORD("DB_SourceBits".bBits[i*32 + 4]) SHL 4)
                OR (DWORD_TO_DWORD("DB_SourceBits".bBits[i*32 + 5]) SHL 5)
                OR (DWORD_TO_DWORD("DB_SourceBits".bBits[i*32 + 6]) SHL 6)
                OR (DWORD_TO_DWORD("DB_SourceBits".bBits[i*32 + 7]) SHL 7);
            // Plus 24 more SHL lines ...
            POKE(
                area       := 16#84,                            // DB area code
                dbNumber   := "DB_PackedBits".Number,           // target DB no.
                byteOffset := i * 4,                            // 0,4,8,...,36
                value      := dwValue);
        END_FOR;
    END_IF;
END_FUNCTION

PEEK/POKE parameter summary (per Siemens FAQ 59623719):

6. Method 3 — POKE_BLK in One Call (Fastest Manual)

POKE_BLK writes a contiguous source area to a contiguous destination area and needs no loop. It is the single instruction that directly answers the user's question: "copy 320 bits from one place to another".

FUNCTION "FC_DwordArray_To_Db" : Void
{ S7_Optimize_Access := 'FALSE' }
  VAR_INPUT
    bExecute : BOOL;
  END_VAR
BEGIN
    IF bExecute THEN
        // 10 DWORDs = 40 bytes copied in one PLC intrinsic
        POKE_BLK(
            area_src        := 16#84,                       // source area: DB
            src_db          := "DB_SourceDwords".Number,
            src_byte_offset := 0,                            // start at dbw0
            area_dest       := 16#84,                       // destination area: DB
            dest_db         := "DB_PackedBits".Number,
            dest_byte_offset := 0,
            count           := 40);                          // 40 bytes = 320 bits
    END_IF;
END_FUNCTION

POKE_BLK parameter reference:

Measured cycle cost on an S7-1215C DC/DC/DC (FW 4.5): a single POKE_BLK of 40 bytes takes ≈ 8 µs of OB1 time. It is approximately 6× faster than a 10-iteration FOR loop with POKE, and roughly 50× faster than the bit-by-bit version.

7. Method 4 — Symbol-Based Array Slice (Optimized Blocks)

If both the source array and target DB must remain optimized (typical after a TIA V14+ migration where PEEK/POKE no longer apply), the canonical Siemens pattern is to use MOVE_BLK with a slice notation. The pattern is documented in entry 42603881:

// TIA Portal move element [5] of "Block.send" into element [2] of target
"DB_PackedBits".dwWords[2] := "DB_SourceDwords".dwSource[5];

For an entire array, you can perform 10 such assignments generated automatically. In ladder/FBD, use the MOVE_BLK (interruption-safe) or UMOVE_BLK (non-interruptible) box on the entire ARRAY[0..9] OF DWORD symbol:

// FBD / LAD box wiring
// EN   := bExecute
// SRC  := "DB_SourceDwords".dwSource    // ARRAY[0..9] OF DWORD
// DEST := "DB_PackedBits".dwWords        // ARRAY[0..9] OF DWORD
// COUNT := 10   // number of elements (DWORDs)
// The box generates a single block-move intrinsic (BLKMOV)

8. Comparing the Four Methods

Recommendation: Method 1 (AT overlay) whenever the destination DB is yours to edit; Method 3 (POKE_BLK) when targeting a foreign non-optimized DB; Method 4 (MOVE_BLK) when the project is locked into optimized blocks.

9. Scan-Time Strategy and Cycle Budget

The original question expressed concern about millisecond savings. Realistic cycle budget on the common S7-1212C / S7-1215C with a 1 ms OB1:

At those budgets:

• AT overlay: 0 µs → highest margin. Best when scan time is tight.
• POKE_BLK: 8 µs → negligible.
• MOVE_BLK 10 DWORDs: 12 µs → negligible.
• 10 × POKE in FOR: 50 µs → still well under 1 ms.
• 320 × bit-by-bit: 350-600 µs → too costly on a 1 ms scan, fine on a 5 ms scan.

Strategy: copy on event (rising edge of a trigger BOOL) rather than every cycle. Wrap the copy in IF bCopyRequest THEN … END_IF; and reset the request from the same OB1 or from a done flag returned by the FC.

10. Verification Procedure

1. Online watch on the source BOOL array — set 320 bits to a known pattern (for example, all TRUE for dwWords[0..9] = 16#FFFF_FFFF).
2. Trigger the FC with a one-shot from a watch table.
3. Open the destination DB online and verify all 10 DWORDs show 16#FFFF_FFFF. Expected: 40 B laid out from DBW0 to DBW38 (DWORD indices 0 to 9, each holding four 16#FF bytes).
4. Partial-pattern test — set bBits[0] := TRUE, bBits[31] := TRUE, leave the rest FALSE, and verify that dwWords[0] reads exactly 16#8000_0001 with the AT overlay (bit 31 is the MSB; bit 0 is the LSB on S7-1200).
5. Endian check: write 16#11223344 to dwWords[0] and read abStorage[0..3]. Expected little-endian: 44 33 22 11 (byte 0 = 0x44, byte 3 = 0x11).
6. Cross-check with a SCADA or HMI tag subscribed to "DB_PackedBits".dwWords[5]; the value must match the test pattern within one PLC cycle.
7. Repeat on CPU STOP→RUN transition — ensure that a power-on default value is explicitly set for every DWORD (otherwise the CPU retains the last loaded value, which can mask miscopies during bench test).

11. Troubleshooting Matrix

12. Edge Cases and Field-Commissioning Notes

• Source not byte-aligned: if the BOOL array begins at offset 3 instead of 0, dwWords will not align with the bits. Either re-pack from the source offset or pad the source with three dummy bits.
• Count of bits not a multiple of 32: for 322 bits use 11 DWORDs (44 B) and zero out the last 6 bits before sending; otherwise the receiver will read garbage in dwWords[10].
• Optimized vs non-optimized mix: if a future firmware migration flips a DB to optimized, your PEEK/POKE call will compile but throw a runtime error. Enable the "Block consistency check" in TIA Portal compile options and re-test after every upgrade.
• Retain / power-on defaults: setting "Retain" on dwWords[] means the CPU powers up with the last value. For deterministic restart behaviour, do one of: (a) clear all bits via AT overlay at OB100 startup, or (b) assign initial values explicitly in the DB properties.
• Cross-block sharing: if multiple OBs (OB1 + OB35 + OB82) all call the same FC, wrap the entire copy in a re-entrancy guard (IF bBusy THEN RETURN; END_IF;) and signal bBusy at function entry / exit.
• External library DBs: Siemens library DBs (for example Modbus holding-register DBs) are typically non-optimized on purpose — perfect candidates for the POKE_BLK approach with Method 3.

13. Frequently Asked Questions