S7-300 HW Identifier Missing: TIA Portal I/O Address Reference

Overview

Engineers migrating projects from legacy STEP 7 V5.x or commissioning a S7-300 station inside TIA Portal V13 SP1 (and later) frequently discover that fields, tags, and system constants that exist on a S7-1500 CPU are simply not generated for S7-300 hardware. The most common symptom is the absence of a hardware identifier (HW identifier, HWID, German: Hardware-Kennung) for an I/O module, an interface, a submodule, or an IO-link master. On S7-1200 and S7-1500 the HWID appears automatically in the project tree under PLC tags > System constants and is consumed by extended instructions such as RDREC, WRREC, DPWR_DAT, DPRD_DAT, and by the IO device / I-device configuration. On S7-300 and S7-400 the same object is not generated because the underlying addressing model is based on the logical I/O address of the slot, not on a system-issued HWID.

This reference explains why S7-300 has no HW identifiers, shows the exact navigation path to recover the logical address that replaces them, maps the relationship between slot, first input/output, and the value used in user code, and provides a worked example for an IO-link master mounted on an ET 200SP IM155-6 PN interface module where the displayed example value (80) and the slot-derived value (128) can both appear depending on firmware and TIA Portal revision.

What is a Hardware Identifier?

A hardware identifier is a system-assigned integer constant (16-bit or 32-bit depending on the data type) that uniquely references a hardware object inside the S7-1200/1500 project. Siemens documents the concept in the TIA Portal help and in the function manual "Programming and Operating Manuals for S7-1200/1500":

• Example for the use of hardware identifiers (S7-300, S7-400, S7-1500) — Siemens Support entry 109742272.
• What you need to know about HW identifiers (S7-1200, S7-1500, S7-1500T) — TIA Portal V20 documentation.

The HWID is the only valid handle for instructions that need to address a module, submodule, port, or transfer area. Each HWID has a hardware data type that constrains which instructions can use it:

The system assigns the HWID at compile time, and the value is stable for the lifetime of the compiled project. Renaming or re-inserting a module may change the HWID even if the slot and the I/O address remain identical.

Why S7-300 and S7-400 Do Not Expose HW Identifiers

The S7-300 and S7-400 families predate the HWID concept. Their programming model is built around two coordinate systems that the user supplies explicitly:

1. Logical I/O address (also called process image address or module start address) — a byte-aligned value configured in the device view that is bound to the module's slot.
2. Diagnostic address — a separate slot-bound address used by RDREC/WRREC and by the diagnostic interrupt OB (OB82).

Because the user controls both numbers, the engineering tool never needs to invent a third internal handle. The HWID exists in TIA Portal's S7-300/400 view only as a derived value used by some Wizards (for example the "Find module by HWID" search) and is not published to the symbol table, the PLC tag table, or the system constants. The result is the situation described in the source: opening the same TIA Portal V13 SP1 Update 5 project next to a S7-1500 station shows HWIDs for the 1500 hardware and nothing for the 300 hardware.

Locating the Module's Logical Address in TIA Portal

For a S7-300 CPU, the relevant addressing information is in the Device View of the station. The exact navigation path is:

1. Open the project and double-click the Devices & networks entry.
2. Select the S7-300 station (the rack symbol that contains the CPU).
3. Open the Device view tab (lower-left of the station editor).
4. Click the module whose address is required — for example the IO-link master on slot 1 of an ET 200SP head module.
5. In the Properties inspector (right-hand panel) open the General tab, then the I/O addresses sub-tab.

The I/O addresses tab shows four editable fields:

For central modules (slots 0–3 of the S7-300 rack, or the first row of the ET 200SP station) the module's logical address — the value the user program reads with PEW/PAW or with L PIW/T PQW — equals the start address shown in the I/O addresses tab. For distributed modules behind PROFINET/PROFIBUS, the start address is still the relevant address; the diagnostic address is separate and is the value used in RDREC/WRREC with MLEN or the implicit call from OB82.

Diagnostic Address vs Logical Address: Practical Example

Consider a S7-300 CPU 315-2 PN/DP (6ES7 315-2EH14-0AB0, firmware V3.3) connected over PROFINET to an ET 200SP station with an IM155-6 PN HF (6ES7 155-6AU00-0BN0) and a 4-port IO-link master (6ES7 137-6BD00-0BA0) inserted in slot 1. A typical TIA Portal configuration displays:

The diagnostic address follows the convention used for PROFINET devices: head module = 2045, slot 1 = 2046, slot 2 = 2047, and so on. Do not hard-code 2046 in the program; instead read the address from the slot symbol that TIA Portal generates. A SCL block that reads the IO-link master's identification data (index 0x0010) on a S7-300 looks like this:

// Read IO-link master identification (record 16) via PROFINET
// Diagnostics address of the IO-link master module
#ioLinkMasterDiagAddr := 2046;   // source: Device view -> Properties -> I/O addresses

#status := RDREC(
    REQ      := TRUE,
    ID       := DW#16#0,                   // always 0 for record access
    INDEX    := 16,                        // IM 0x10 = identification
    MLEN     := 64,                        // record length
    VALID    => #valid,
    BUSY     => #busy,
    ERROR    => #error,
    STATUS   => #retStatus,
    RECORD   := #idData);

Why an Example Project May Show 80 or 128 for the Same Module

Engineers who port Siemens example projects frequently see the "module's logical address" printed as 80 in the project documentation while the slot-derived value computed by hand comes out to 128. The mismatch is usually one of three causes:

1. Different TIA Portal revision. TIA Portal V13 SP1 Update 5 assigned a different start address than V14, V15, V16, or V17 for the same hardware configuration because the address space was reorganized when the system constants / HWID model was extended.
2. Different ET 200SP head module firmware. The IM155-6 PN HF firmware V3.3 and V4.x differ in slot addressing. The V4.x firmware introduced 0–65 slot range with a different diagnostic base; a V3.3 head module running in a V4.x project uses the older 2000-series diagnostic addresses.
3. Manual address override. The project author may have explicitly typed the start address 80 into the module's I/O address tab to free up the low address range for the process image partition. Once typed, the value is independent of the slot index.

The two values 80 and 128 can both be valid: 80 is the IO-link master's input start address after the user typed it in; 128 is what the slot auto-assignment would have produced for a module in slot 4 of the ET 200SP. Verify the actual value by reading the start address from the Device View of the user's specific project, not from a printed example.

HWID in S7-1500 vs Logical Address in S7-300: Conversion Table

For migrating user code from S7-1500 to S7-300, the following substitution table applies when the S7-1500 block uses the hardware identifier as the input of an instruction:

The substitution is not automatic. The code must be rewritten by hand because the S7-1500 instructions accept a typed system constant while the S7-300 blocks accept a plain WORD/INT input. TIA Portal's cross-compiler cannot convert the two.

Special Case: IO-link Master on ET 200SP behind a S7-300 CPU

The IO-link master 6ES7 137-6BD00-0BA0 (or its successor 6ES7 137-6BD20-0BA0 with port class A) is treated as a PROFINET submodule. From the S7-300 perspective, three addresses are relevant:

• Process image start (input) — the start byte for cyclic process data. The IO-link master occupies 2 bytes of input and 2 bytes of output by default; channel-level diagnostic data is mapped to the diagnostic address, not the process image.
• Process image start (output) — the start byte for the master's cyclic command data (e.g. port enable, fallback direction).
• Diagnostic address — the address used for acyclic RDREC/WRREC calls and for the diagnostic interrupt OB (OB82). The diagnostic frame is mapped to bits of input byte 0–3 of the master, with a status byte and a channel number byte.

For port-level access (read IO-link device parameter, write IO-link device parameter) the user's block uses RDREC/WRREC against the master's diagnostic address with index 0x8000 + port_index for the IO-link device (port 1 = index 0x8000, port 2 = 0x8001, port 3 = 0x8002, port 4 = 0x8003). A SCL sketch for port-1 parameter read:

// Read IO-link device parameter (port 1, index 0)
// Use the IO-link master's diagnostic address
#idx := INT_TO_WORD(16#8000 + 0);     // port 1, subindex 0
#status := RDREC(
    REQ      := #go,
    ID       := INT_TO_WORD(0),
    INDEX    := #idx,
    MLEN     := 32,
    VALID    => #done,
    BUSY     => #busy,
    ERROR    => #err,
    STATUS   => #rc,
    RECORD   := #buf);

Finding the Module's Logical Address on a S7-300 with TIA Portal V13 SP1

TIA Portal V13 SP1 Update 5 was released in 2015. On this revision, the navigation path to the I/O address is identical to newer revisions:

1. Devices & networks → select S7-300 station → Device view.
2. Click the module on the rack.
3. Properties → General → I/O addresses tab.

If the I/O address tab is greyed out, the module is a "head module" (the IM155-6 PN itself, slot 0). Head modules have no process image; they have a diagnostic address only. To find the diagnostic address of a head module on a S7-300 project, open the Properties → General → PROFINET interface tab; the "Diagnostics address of the module" field shows the value.

Common Pitfalls

Verifying the Address at Commissioning

To confirm the value is correct without writing a full program, use the S7-300 online watch table and the CPU's Monitor / Modify function:

1. Go online with the S7-300 CPU.
2. Create a watch table with three rows: PEW start, PAW start, and PIB diagnostic_address.
3. Power-cycle the IO-link device; the master's diagnostic byte should show the channel event.
4. Read PIB diagnostic_address with status byte = 0xF0 (channel diagnosis present) and a channel number matching the IO-link port.

If the status byte is non-zero but the channel number is unexpected, the start address is wrong by exactly one slot. Move to the next slot in the Device View and re-read.

Frequently Asked Questions