S7-300 I/O Addressing Reference: AI, RTD, AO Slot Mapping

S7-300 I/O Addressing Reference: AI, RTD, AO Slot Mapping

This technical reference covers SIMATIC S7-300 I/O addressing for analog input (AI), Resistance Temperature Detector (RTD), analog output (AO), digital input (DI), and digital output (DO) modules. It documents the slot-to-byte mapping used in STEP 7 HW Config, explains why AI modules occupy 1 word of address space while RTD modules occupy 2 words, and clarifies the difference between process-image access (IW) and peripheral access (PIW). Module order numbers, resolution figures, and indirect addressing techniques for the S7-300/400 CPU family are included.

1. S7-300 Addressing Architecture Overview

The S7-300 uses a slot-based addressing scheme. Each module plugged into a rack (0-3) occupies a logical slot (4-11). The CPU assigns input and output addresses based on the module's position in HW Config, regardless of the physical slot number. The starting address of the first slot is fixed:

Each rack contributes a 32-byte input area and a 32-byte output area regardless of how many slots are populated. The address space within each rack starts at the boundary above and grows as modules are inserted in HW Config. Address gaps occur only when modules reserve space they do not fully use (notably 8-channel thermocouple modules that reserve 16 bytes for 4 usable channels).

2. Worked Addressing Example

The configuration below was used to validate the addressing scheme described in this reference. It covers two racks with a mix of analog, RTD, AO, DI, and DO modules.

2.1 Rack 0 — Analog and RTD Modules

2.2 Rack 1 — Digital I/O

3. Why AI Uses 1 Word and RTD Uses 2 Words: Resolution Mechanics

The address footprint of an analog module is set by two factors: the number of channels and the internal word granularity. Standard AI modules (voltage, current, 4-wire RTD with 13-bit resolution) allocate 2 bytes per channel in HW Config. RTD modules with 24-bit Sigma-Delta converters also allocate 2 bytes per channel, but the second word is reserved for the channel's high-order data when configured for 4-wire mode.

3.1 Standard AI Modules — 13-Bit Resolution (12 bits + sign)

The SM 331 AI 8x13Bit (6ES7331-1KF02-0AB0) provides 13-bit resolution across 8 channels. The 16-bit process value is encoded as:

• Bit 15: Sign bit
• Bits 14-3: 12-bit magnitude
• Bits 2-0: Reserved / zero

One 16-bit word per channel is sufficient because the entire measurement range fits in 13 bits. Each module reserves 16 bytes (8 words) of input address space.

3.2 RTD Modules — 24-Bit Internal / 16-Bit Process Resolution

The SM 331 RTD 8-channel (6ES7331-7PF01-0AB0) uses a Sigma-Delta converter with 24-bit internal resolution. The 24-bit conversion result is stored internally, but the user program sees a 16-bit representation:

• Bit 15: Sign bit
• Bits 14-0: 15-bit magnitude (one extra bit compared to standard AI)

The extra precision is achieved by averaging Sigma-Delta oversamples, not by widening the process word. Therefore an 8-channel RTD module reserves the same 16 bytes as an 8-channel AI module — but HW Config displays it as 16 bytes because the module reserves 2 bytes per channel for diagnostic/status data on top of the 2-byte process value when configured in 4-wire mode.

3.3 Thermocouple Modules — Address Gap Phenomenon

The SM 331 AI 8xTC (6ES7331-7KF02-0AB0) is an 8-channel thermocouple module, but only 4 channels are usable when channels are configured as thermocouple inputs (type J, K, T, etc.). The remaining 4 channels are reserved for cold-junction compensation. Each configured channel still occupies 2 bytes, but because HW Config allocates 16 bytes (8 words) for an 8-channel card and only 8 bytes (4 words) are usable, the address range appears to have "gaps."

4. Process Image vs Peripheral I/O Access

S7-300 CPUs maintain two distinct I/O representations:

By default, S7-300 analog modules are configured outside the process image in HW Config (Object Properties → Addresses → "Process Image"). This means the values are not refreshed automatically and must be loaded with peripheral instructions:

// STL example — load analog input directly from peripheral
L PIW 272          // Read AI channel at IW 272 from module register
T DB10.DBW 0       // Store in data block

// Load and scale standard 0-10 V input
L PIW 272
ITD                  // Convert integer to double integer
DTR                  // Convert to real
L 2.7648e+4          // Full-scale value for unipolar 0-10 V
/R                   // Scale to 0.0 - 1.0 engineering unit
T MD 100             // Save scaled value

For modules that are configured inside the process image (the default for digital I/O on most CPU 31x models), use IW / QW directly. The process image guarantees consistent I/O snapshots across one OB1 scan.

4.1 Forcing Analog Modules into the Process Image

To place analog modules inside the process image, open the module in HW Config, select the "Addresses" tab, and change "Process Image" from "None" (default) to "OB1 PA" (process image updated by OB1). This forces OB1 to refresh those addresses on each scan cycle. Note that the CPU imposes a maximum of 2048 bytes for inputs and 2048 bytes for outputs across the entire process image — exceeding this limit returns an SF LED with a configuration error.

5. Indirect Addressing for S7-300/400

When the same logic block must process a variable number of channels, indirect addressing replaces fixed PIW references with computed offsets. The S7-300/400 STL supports two indirect-addressing modes.

5.1 Memory-Indirect Addressing (Intra-Area)

The address offset is stored in a WORD or DWORD tag of the local or global memory area. The address register AR1/AR2 is loaded at runtime:

// STL — memory-indirect PIW access
L 272                    // Initial offset
T MW 200                 // Store as WORD tag

L MW 200                 // Load offset
SLD 3                    // Shift left 3 = multiply by 8 (bit offset)
LAR1                     // Load AR1 with full pointer

L PIW [AR1,P#0.0]        // Indirect peripheral read
T DB20.DBW 0             // Store result

L MW 200                 // Load offset
+ 2                      // Increment by 2 (next word)
T MW 200                 // Save

L MW 200
SLD 3
LAR1
L PIW [AR1,P#0.0]        // Read next channel
T DB20.DBW 2

5.2 Area-Crossing Indirect Addressing (Register-Indirect)

The address pointer can switch between input (I), output (Q), and bit-memory (M) areas without code changes. The address register is 32 bits wide and contains the area identifier plus the byte/bit offset. Refer to the S7-300 Instruction List manual for the full register layout.

6. Module Order Number Reference

The following order numbers cover the most common analog and digital modules used in S7-300 racks. Confirm against current Siemens product catalogs before ordering.

Always consult the Siemens Industry Online Support portal for the latest manual revisions. The S7-300 Module Data manual (entry ID 8859629 in the Siemens support portal) contains the canonical channel-by-channel addressing layout.

7. Verification Procedure

After configuring HW Config and downloading to the CPU, verify addressing with the following sequence:

1. Online → Module Information: Open the project, go Online, right-click the CPU, and select "Module Information." Navigate to the "I/O Addresses" tab. Each module must list the same input and output addresses as your documentation.
2. Monitor/Modify: Right-click any module in the rack view and select "Monitor/Modify." The address dialog shows the configured start address and the process values returned by each channel in real time.
3. Variable Table (VAT):strong> Create a VAT in STEP 7 with the addresses IW272, PIW272, IW304, PIW304, etc. Open the VAT online and verify each address returns a sane value (not 0x7FFF / 0x8000, which indicate overflow or open wire).
4. SF LED check: If the SF (System Fault) LED on the CPU is lit, the address assignment is inconsistent with the physical module plugged into the rack. Cross-check slot numbers against the HW Config.
5. Symbol table audit: Open the symbol table (Options → Symbol Table) and confirm each I/O symbol is bound to the expected absolute address. Inconsistent symbols are a common source of intermittent process faults.

8. Common Addressing Mistakes and Diagnostics

9. Practical Example: Scaling an RTD Input on 6ES7331-7PF01-0AB0

The following FC (function) reads the PT100 RTD on channel 0 of the first RTD module and converts the raw value to degrees Celsius. The 6ES7331-7PF01-0AB0 outputs 0.1 °C per LSB with a range of -200.0 to +850.0 °C. The raw word is signed (bit 15 = sign).

// FC100 — Read PT100 channel 0 of RTD module
// Input:  RTD module @ PIW 304 (8 channels, IW 304-319)
// Output: Temperature in 0.1 °C units (REAL)

L PIW 304               // Read channel 0 raw value
ITD                      // Convert INT to DINT
DTR                      // Convert DINT to REAL
T MD 100                 // Save engineering value

// Optional: 4-wire mode returns value already in 0.1 °C units
// The scaling library FC105 "SCALE" can be used for non-temperature ranges
// but for PT100 it is unnecessary if the module is configured for "RTD-4L" type

For modules configured for raw resistance measurement (0-300 Ω or 0-3000 Ω), the FC105 SCALE function block is required to convert the integer value to engineering units. Use:

CALL FC 105
  IN     := PIW304
  HI_LIM := 3.0e+2          // 300 Ω upper range
  LO_LIM := 0.0e+0          // 0 Ω lower range
  BIPOLAR:= FALSE           // Unipolar
  RET_VAL:= MW200           // Return value (status)
  OUT    := MD100           // Scaled REAL output

10. Communication Between Address Domains

When connecting an S7-300 to third-party HMIs or OPC servers, the address syntax may differ from the STEP 7 representation. Two common mapping conventions are documented below.

The exact syntax depends on the gateway or OPC server in use. The C-more S7-300 addressing documentation and the TIA Portal indirect-addressing reference provide official guidance.

11. Best Practices for S7-300 Addressing

1. Reserve address ranges by function. Group all analog inputs in one contiguous block, all analog outputs in another, and digital I/O in a third. This makes symbol-table maintenance predictable.
2. Always use symbolic names. Bind every absolute address to a symbol in the symbol table. Compile the project to detect unresolved references before downloading to the CPU.
3. Use peripheral access for high-speed diagnostics. When a value must be sampled faster than the OB1 cycle (e.g., in OB35), use PIW directly. For most applications, OB1 process-image access is faster and more deterministic.
4. Document address gaps. Note why an 8-channel thermocouple module reserves 16 bytes even when only 4 channels are usable. The documentation prevents confusion during future expansions.
5. Validate analog ranges in HW Config. Each channel must be configured for the correct measurement type (voltage, current, RTD, TC). A misconfigured channel returns 0x7FFF or 0x8000 immediately.
6. Avoid floating-point math inside peripheral-access loops. When reading large numbers of PIW in a loop, use integer math and convert to REAL only at the end of the scaling chain.
7. Reserve process-image space early. The CPU's maximum process image (typically 2048 bytes in/out for CPU 31x) is set in HW Config → CPU Properties → Cycle/Clock Memory. Set this large enough to accommodate future expansions.