S7-300 Interarea Pointers: Accessing ET200S Peripheral I/O

S7-300 Interarea Pointers: Accessing ET200S Peripheral I/O

This reference explains how to access distributed I/O on an ET200S station from a Siemens SIMATIC S7-300 CPU 314-2DP over Profibus DP using 32-bit area-cross (interarea) pointers in STL. It consolidates the pointer structure, the difference between process image and direct peripheral access, the HW Config slot addressing rules, and field-proven STL snippets for digital and analog I/O.

1. Prerequisites

• SIMATIC S7-300 CPU 314-2DP (6ES7314-6BF01-0AB0) with at least one DP master port active.
• ET200S distributed station, interface module IM151-1 (e.g., 6ES7151-1BA02-0AB0) or IM151-1 HF.
• Digital I/O modules 4/8/16-channel (e.g., 6ES7131-4BD01-0AA0 inputs, 6ES7132-4BD01-0AA0 outputs).
• Analog I/O modules (e.g., 6ES7134-4FB01-0AB0 2AI, 6ES7135-4FB01-0AB0 2AO).
• Profibus DP cable, bus connector (6ES7972-0BA12-0XA0), terminating resistors enabled at both ends.
• STEP 7 V5.5 SP2 (or TIA Portal V15.1 or higher) with HW Config installed.
• GSD file of the ET200S IM (ET200S.GSD, supplied with STEP 7).

2. The 32-Bit Area-Cross Pointer Format

The S7-300 family uses 32-bit internal pointers to dereference any memory area. When the high byte carries an area identifier, the pointer is called an interarea (area-cross) pointer because it can target any area in one instruction.

2.1 Area Identifier Table

For digital bit access the complete pointer is built as DW#16#8yBB000n where y is the area digit, BB is the byte address in hex, and n is the bit position 0..7. For example, the source's DW#16#81000000 points to I 0.0 and DW#16#82000000 to Q 0.0.

3. Process Image vs. Direct Peripheral Access

Two physically different paths exist between the CPU and the ET200S modules:

1. Process image (PI / PIP1) — the I/O image is refreshed once per OB1 cycle (or as configured). The I and Q areas are copies of the physical state at the OB1 start.
2. Direct peripheral (P area) — a single load/store triggers a Profibus cycle that reads or writes the actual value at the moment of execution. No snapshot is used.

3.1 When to Use Direct Peripheral Access

If the ET200S module property is set to "Process image update" (default), the area appears under I and Q. If you change the property to "PIP1 (peripheral, update once per cycle)" or "PIP2" in HW Config, the same byte can be read by the P-area pointer as well. Modules configured as "no PI" can only be accessed by the P area.

4. ET200S Address Mapping in HW Config

When the ET200S station is inserted in HW Config and linked via Profibus DP, the address assignment follows the slot order of the IM151-1 head. For a typical configuration the mapping looks like:

For the CPU 314-2DP the analog I/O area starts at PIW 256 by default for the first Profibus master system. The exact starting address can be shifted in HW Config by editing the module properties ("Addresses" tab). The first free PIW/PQW after the CPU's local I/O is typically 256 for a Profibus master system — check with the Address Overview tool in HW Config to confirm.

5. Building a 32-Bit Pointer in STL

5.1 Construction Pattern

The standard formula is:

1. Load the byte number (0..65535) into a temporary.
2. Convert to DINT (ITD).
3. Shift left by 3 to make room for the bit field (SLD 3).
4. OR-in the area identifier (0x80..0x87) in the high byte.
5. OR-in the bit number 0..7 in the low 3 bits.
6. Transfer to AR1 (LAR1) and dereference with A [AR1,P#0.0] or L DBB [AR1,P#0.0].

5.2 STL Snippet: Bit Read of a Logical Input

// Source-variable examples in STEP 7 V5.5
// Input: #i_LogNo  (INT, 0..255  logical input number)
// Output: #RET_VAL (BOOL)

      L     #i_LogNo           // logical input number 0..N
      ITD                       // convert to DINT
      SLD   3                   // shift byte addr by 3 to make room for bit pos
      L     DW#16#81000000      // area id 0x81 = process image input
      OD                        // OR area id into high byte
      TAR1                      // use AR1 (or LAR1 if not preset)
      AD    DW#16#0             // mask off low bits if needed
      LAR1
      A     [AR1, P#0.0]        // read bit
      =     #RET_VAL            // return

Reading directly from the peripheral area (PE) is identical except for the area identifier:

      L     DW#16#80000000      // area id 0x80 = peripheral input
      OD
      LAR1
      A     [AR1, P#0.0]

5.3 STL Snippet: Byte / Word / Dword Access

// Read a peripheral byte (PEB 0) using interarea pointer
      L     0                   // byte number 0
      ITD
      SLD   3
      L     DW#16#80000000      // area id 0x80 = peripheral
      OD
      LAR1
      L     B [AR1, P#0.0]      // L PEB 0
      T     MB   10

// Read a peripheral word (PEW 256) for first analog input
      L     256
      ITD
      SLD   3
      L     DW#16#80000000
      OD
      LAR1
      L     W [AR1, P#0.0]      // L PEW 256
      T     MW   12

// Read a peripheral dword (PED 0)  (longer analog value, or two adjacent words)
      L     0
      ITD
      SLD   3
      L     DW#16#80000000
      OD
      LAR1
      L     D [AR1, P#0.0]      // L PED 0

5.4 STL Snippet: Logical-to-Physical Map via a DB

This is the pattern that matches the source's application: a DB is filled with one DINT per logical I/O. Each DINT is a prebuilt interarea pointer that is dereferenced by a generic FC.

// DB "IO_Ptrs" — DINT array
//   DBW 0  -> pointer for logical input #0
//   DBW 4  -> pointer for logical input #1
//   ...

FUNCTION FC 100 : VOID
VAR_INPUT
   i_LogNo  : INT;     // logical I/O number 0..N
END_VAR
VAR_TEMP
   t_Offset : INT;
   t_Ptr    : DWORD;
   t_AR1    : DWORD;
END_VAR

BEGIN
      L     #i_LogNo
      L     4
      *D                       // offset = i_LogNo * 4
      T     #t_Offset

      OPN   "IO_Ptrs"
      L     DBB [#t_Offset]    // load DINT pointer from DB (one of 4 bytes)
      ...
      L     DBD [#t_Offset]    // load full DINT
      T     #t_Ptr

      LAR1  #t_Ptr             // load into AR1
      A     [AR1, P#0.0]
      =     M 0.1              // forwarded result
END_FUNCTION

6. Step-by-Step Commissioning

1. Wire the ET200S station. Connect the IM151-1 Profibus port, enable terminating resistors on the first and last device only.
2. Open HW Config in STEP 7. Insert a Profibus DP master system and place an ET200S station (HW Catalog > PROFIBUS DP > ET200S).
3. Add modules to the ET200S slots. Drag digital input, digital output, analog input, analog output modules. STEP 7 auto-assigns addresses starting at the next free range (commonly 0.0 for digital, 256 for analog on master system 1).
4. Edit module properties. For inputs that need real-time access, set the digital input module to "Process image: PIP1" or "no PI" depending on whether you want OB1-time reads or direct reads.
5. Configure the analog input range. For 6ES7134-4FB01-0AB0 select "0..10 V" or "4..20 mA" in module properties > Inputs. STEP 7 will encode 0..27648 integer units across the selected range.
6. Download HW Config to the CPU and the IM151-1. Verify the IM151-1 has its SF/ BF LED off.
7. Create the IO_Ptrs DB. Populate with 32-bit interarea pointers, e.g. DW#16#81000000 for I 0.0, DW#16#81000020 for I 0.2, DW#16#80000000 for PE 0, etc.
8. Implement the FC in STL following the pattern in section 5.4. Place a call in OB1 with the logical input number as input.
9. Monitor online in STEP 7: open the FC, click Monitor, change the input number, and confirm the dereferenced bit follows the physical signal at the terminal.

7. Verification

After commissioning, perform the following checks before sign-off:

8. Analog I/O Specifics

Analog modules on ET200S return integer values normalised to the configured range:

Read the first AI (PEW 256) with a 32-bit interarea pointer as shown in section 5.3. The next channel is at PEW 258. The 2-wire / 4-wire mode of the AI module is configured in HW Config > module properties > Inputs.

9. Troubleshooting Matrix

10. Field Commissioning Notes

• Profibus baud rate is auto-detected by the IM151-1. New slaves may take up to 5 s to enter data exchange. With OB82 (diagnostic interrupt) enabled, the CPU logs the transition.
• OB1 cycle time on a CPU 314-2DP with 200 byte Profibus I/O is typically 5…15 ms. A direct peripheral read inside an OB30 (5 ms interrupt) returns the value at that instant, not at OB1 start.
• AR1 / AR2 usage — both address registers are shared. If the called FC uses AR1 internally, save and restore AR1 around the dereference; otherwise the caller's pointer is corrupted.
• Bit memory vs. peripheral read — reading a peripheral input does not update M memory. A latching operator must copy the bit to M if persistence across OB1 cycles is required.
• Pointers in SCL — SCL abstracts pointers with the POINTER and ANY data types. The compile target STL generated by SCL is functionally equivalent to the explicit patterns above; STL gives finer control for bit access.
• Process image size on a CPU 314-2DP defaults to 128 byte for inputs and 128 byte for outputs. Profibus I/O can exceed this if "no PI" is selected on a module. With OB1, only the configured PI range is refreshed; bytes outside the range require direct peripheral access.
• Wiring rule for digital output — ET200S 24 V DO modules source 500 mA per channel. When using a relay coil, install a flyback diode (1N4007) reverse-biased across the coil to protect the output against inductive kickback.
• Watchdog / time-out — if the IM151-1 loses Profibus communication for longer than the configured DP watchdog (default 10 s), the ET200S outputs go to the configured substitute value (typically 0). Set this in HW Config > ET200S properties > Parameter Assignment.

11. Edge Cases and Caveats

1. Pointer arithmetic overflow — if i_LogNo is negative, ITD sign-extends and the resulting byte address becomes a very large unsigned value, which causes a peripheral access error in OB121. Always check i_LogNo >= 0 and i_LogNo < Max before loading the pointer.
2. Byte-aligned only — the P area cannot be read below the byte boundary. If your logical map has bit granularity, the source must still load the entire byte and extract the bit via A [AR1, P#0.x].
3. AR1/P#0.0 sum — when you write [AR1, P#0.0], the S7 firmware adds the bit offset P#x.x to the pointer's bit address. Use this for indirect bit access without reloading AR1.
4. Byte vs. word address interpretation — the same DINT can mean "byte 256 of the P area" or "word 128 of the P area", depending on whether you dereference with L W[AR1,P#0.0] or L B[AR1,P#0.0]. Always confirm the dereference width.
5. PI update partial refresh — if the ET200S module is set to PIP1, the image is updated at the start of OB1, but only for the configured PIP1 range. Bytes outside that range stay at the previous value if read with I; use PE instead.

12. Related S7-300 Resources

• S7-300 CPU 31xC and CPU 31x Operating Instructions — covers the pointer structure and process image rules referenced throughout this article.
• ET200S Distributed I/O System Manual — Profibus DP station configuration, slot addressing, and module diagnostics.
• STEP 7 Professional / Basic in the TIA Portal — HW Config and block programming environment.
• System Software for S7-300/400 — System and Standard Functions Reference Manual — SFC/SFB descriptions including SFC 14 / SFC 15 (DP read/write) for block-based Profibus I/O access.

For verification of standard wiring and rating limits, cross-check against the project-specific installation guidelines in the S7-300 manual and the module-specific datasheets. Permissible overload values, derating curves, and ambient temperature limits are not in scope of this article and must be confirmed against the latest edition of the relevant Siemens datasheet before deployment.