Siemens S7 Indirect Addressing with POINTER Parameters in STL FBs

Overview: From Hardcoded I/O to a Reusable POINTER-Based FB

Hardcoded process outputs such as T QB 22 or T QB 3 are the fastest path to a working program, but they make function blocks (FBs) non-reusable. The moment a customer wants to call the same FB three times for three independent handshake channels, the hardcoded QB 22 forces three separate code blocks and three independent fault paths. The fix is to pass the I/O address as a POINTER parameter and dereference it inside the FB using STL address-register arithmetic.

This article documents the incremental build of a reusable S7-300/400 FB that takes a single POINTER to an output byte area, writes a command byte and two data bytes, polls three acknowledgment input bytes plus two status bits, and latches a fault if the handshake does not complete within 2 seconds. Three iterations are shown: FB3 (byte-index parameter, simplest case), FB4 (POINTER parameter, single byte), and FB5 (POINTER parameter, multi-byte with sealed fault). Each iteration exposes a specific failure mode of the previous one and the STL pattern that fixes it.

Prerequisites and Target Hardware

• CPU: S7-300 (CPU 31x series, e.g. CPU 315-2 DP) or S7-400 (CPU 41x series). The technique is firmware-agnostic within the S7-300/400 family.
• Engineering tool: STEP 7 V5.5 or later, or TIA Portal with the S7-300/400 optional package.
• Programming language: STL (Statement List / AWL). Ladder and FBD cannot dereference POINTER parameters inside the FB body.
• Library access: System Function Block SFB4 (IEC Timer On-Delay) from the Standard library, or a user-defined TON multi-instance.
• Diagnostic block: OB121 (Programming Error OB) loaded as a placeholder BE during development to keep the CPU in RUN while pointer faults are being debugged.
• Working knowledge of: instance DBs, multi-instance FBs, address registers AR1 and AR2, and the 6-byte POINTER format described in the next section.

The 6-Byte POINTER Format in S7-300/400 STL

A POINTER in S7-300/400 STL is a 6-byte (48-bit) structure that locates a single bit inside a memory area. It is the smallest addressing type that can be passed as an FB parameter and dereferenced at runtime.

For P#Q3.0 the 6-byte value is W#16#0000 B#16#82 B#16#00 B#16#00 B#16#18. Loaded as a DWORD (the lower 4 bytes) with L D [... ], the value is DW#16#82000018. The address portion stores the bit position, not the byte number. To convert byte 3 to its 24-bit equivalent, the source uses SLD 3 on the byte value 3, producing 24 (0x18). This is why the diagnostic comment in the source reads 18 = 3 SLD 3.

Core STL Instructions for Pointer Manipulation

Building FB3: Single-Byte Handshake with SLD Pointer

FB3 is the first iteration. The input is a BYTE parameter representing the offset into the Q area, not a full POINTER. This avoids the need for pointer dereferencing and is the simplest possible indirect-access pattern. It also exposes the most common pitfall: a non-zero bit address in a byte-oriented access.

FUNCTION_BLOCK FB 3
TITLE = VERSION : 0.1
VAR_INPUT
  Pnt_QB3 : BYTE;   // byte offset into Q area (e.g. 3 for QB3)
  CmdByte : BYTE;   // command byte to write
END_VAR
VAR_OUTPUT
  Ackd    : BOOL;   // handshake acknowledged (IB = QB)
  FaultBit: BOOL;   // 2 s timeout reached without ack
END_VAR
VAR
  Faulted : SFB 4;  // IEC on-delay timer instance
END_VAR
VAR_TEMP
  temp    : BOOL;
  NotAckd : BOOL;
  DWPntr  : DWORD;
END_VAR
BEGIN
NETWORK TITLE = Handshake with indirect byte offset
  L  #Pnt_QB3;       // load byte offset (e.g. 3)
  T  #DWPntr;        // store as DWORD for indirect use
  SLD 3;             // shift left 3 → 24 = bit address 3.0
                     // (mandatory: byte access requires bit 0 = 0)
  L  #CmdByte;       // load command byte
  T  QB [#DWPntr];   // write to QB at the offset

  L  IB [#DWPntr];   // load echo input byte
  L  QB [#DWPntr];   // load what we just wrote
  ==I ;              // compare
  =  #Ackd;          // set ack if echoed correctly

  AN #Ackd;          // if NOT acked
  =  #NotAckd;       // feed timer input
  IN CALL #Faulted (  // start SFB4 (TON)
       IN := #NotAckd,
       PT := T#2S,    // 2-second handshake window
       Q  := #FaultBit // fault latches if no ack in 2 s
       ET := );
  AN #temp;
  SAVE ;              // save RLO into BR for block boundary
END_FUNCTION_BLOCK

The critical line SLD 3 converts the byte offset 3 into its 24-bit equivalent (24 = 0x18). Without this shift, the indirect access to QB treats the value as a bit address and tries to access a bit that does not exist for byte-aligned access, producing the OB121 alignment error described in the troubleshooting section below.

The ==I instruction (integer compare) checks whether the loaded input byte matches the output byte just written; if they are equal, the Ackd output is set. AN #Ackd inverts the ack signal to drive the IN input of SFB4 (IEC on-delay timer). If the handshake is not acknowledged within 2 seconds, the timer's Q output sets the FaultBit. The unused ET parameter is left open.

Building FB4: The Pointer-to-Pointer Dereference Pattern

FB4 upgrades the interface to a true POINTER parameter. With a POINTER you can pass any memory area (I, Q, M, DB) by reference, but the FB must first dereference the pointer — the parameter value is itself a POINTER stored inside the instance DB, and you must look it up through the instance data area to read the actual target address.

FUNCTION_BLOCK FB 4
TITLE = VERSION : 0.1
VAR_INPUT
  pCmdAddress : POINTER ;   // pass any P#Qx.y or P#Ix.y or P#Mx.y
  CmdByte     : BYTE ;
END_VAR
VAR_OUTPUT
  Ackd        : BOOL ;
  FaultBit    : BOOL ;
END_VAR
VAR
  Faulted     : "TON" ;    // multi-instance TON (also valid)
END_VAR
VAR_TEMP
  temp        : BOOL ;
  NotAckd     : BOOL ;
  DWPntr      : DWORD ;
  wDBNo       : WORD ;
END_VAR
BEGIN
NETWORK TITLE = Dereference POINTER, then handshake
  L  P##pCmdAddress;  // pointer to the parameter slot in the instance DB
  AD  DW#16#FFFFF;    // mask to isolate the address portion
  TAR2 ;              // current FB instance base (AR2 value)
  +D ;                // absolute byte offset of pCmdAddress inside DI
  LAR1 ;              // AR1 ← absolute offset
  L  DINO;            // instance DB number
  T  #wDBNo;          // store
  OPN DB [#wDBNo];    // open instance DB as current DB for L D[AR1,…]
  L  D [AR1,P#2.0];   // read area pointer portion of the passed POINTER
  LAR1 ;              // AR1 ← actual I/O address (e.g. DW#16#82000018)
  T  #DWPntr;         // copy for QB[ ] access

  L  #CmdByte;
  T  QB [#DWPntr];    // write command byte at the pointed-to Q address
  L  IB [#DWPntr];    // read ack input at the same offset
  L  QB [#DWPntr];
  ==I ;
  =  #Ackd;

  AN #Ackd;
  =  #NotAckd;
  IN CALL #Faulted (
       IN := #NotAckd,
       PT := T#2S,
       Q  := #FaultBit
       ET := );
  AN #temp;
  SAVE ;
END_FUNCTION_BLOCK

The dereference sequence is the heart of FB4. Engineers who have not worked with the S7 pointer format before frequently get stuck at L D [AR1, P#2.0] because the AR1 at that point does not contain the I/O address yet — it contains the byte offset of the parameter slot inside the instance DB.

1. L P##pCmdAddress — load the 6-byte address of the parameter slot. The 6-byte format is [DB num | area | addr | addr | addr].
2. AD DW#16#FFFFF — mask the area code so the resulting DWORD can be combined with the instance base to produce a byte offset. The exact mask width depends on the CPU family; the 20-bit mask keeps the bit-address portion and clears the area code byte for S7-300/400.
3. TAR2 — load the current FB instance base address into ACCU1. ACCU1 (with the masked pointer-to-pointer) shifts to ACCU2.
4. +D — add ACCU1 + ACCU2 to produce the absolute byte offset of pCmdAddress within the instance DB.
5. LAR1 — store the result in AR1.
6. L DINO / T #wDBNo / OPN DB [#wDBNo] — get the current instance DB number and open it as the current DB so that the next L D [AR1, ...] reads from instance data.
7. L D [AR1, P#2.0] — read 4 bytes starting at AR1+2. This is the area pointer portion of the stored POINTER (i.e., the actual I/O address to use).
8. LAR1 — load the area pointer into AR1 for subsequent indirect access. After this line, T QB [AR1, P#0.0] writes to the output pointed to by the passed POINTER.

Building FB5: Multi-Byte Handshake with TON Fault Detection

FB5 is the production-ready version. It scales the single-byte pattern to three consecutive output bytes (Command, X data, Y data) and two individual output bits (X-negative flag, Y-negative flag), with matching input acknowledgments and a sealed fault bit. The caller passes a single POINTER to the start of the I/O area; FB5 walks the offsets itself.

FUNCTION_BLOCK FB 5
TITLE = VERSION : 0.1
VAR_INPUT
  pCmdAddress : POINTER ;
  CmdByte     : BYTE ;
  XData       : BYTE ;
  YData       : BYTE ;
  XNeg        : BOOL ;
  YNeg        : BOOL ;
END_VAR
VAR_OUTPUT
  Ackd        : BOOL ;
END_VAR
VAR_IN_OUT
  FaultBit    : BOOL ;     // sealed by caller's SR; reset by caller's fault reset
END_VAR
VAR
  Faulted     : SFB 4 ;    // IEC on-delay timer, 2 s window
END_VAR
VAR_TEMP
  NotAckd     : BOOL ;
  wDBNo       : WORD ;
  AckByt0     : BOOL ;
  AckByt1     : BOOL ;
  AckByt2     : BOOL ;
  AckBits     : BOOL ;
END_VAR
BEGIN
NETWORK TITLE = Dereference and write 3 output bytes + 2 bits
  L  P##pCmdAddress;    // pointer to the parameter slot
  AD  DW#16#FFFFF;      // mask off area code
  TAR2 ;                // instance base
  +D ;                  // absolute offset of pCmdAddress in DI
  LAR1 ;                // AR1 ← offset of pCmdAddress
  L  DINO;              // instance DB number
  T  #wDBNo;
  OPN DB [#wDBNo];      // open DI as current DB
  L  D [AR1,P#2.0];     // read area pointer portion of passed POINTER
  LAR1 ;                // AR1 ← I/O address (e.g. DW#16#82000018)

  L  #CmdByte;          // command byte
  T  QB [AR1,P#0.0];    // QB at offset 0
  L  #XData;            // X data register
  T  QB [AR1,P#1.0];    // QB at offset 1
  L  #YData;            // Y data register
  T  QB [AR1,P#2.0];    // QB at offset 2

  A  #XNeg;             // X-negative flag
  =  Q  [AR1,P#3.1];    // bit 1 of byte 3
  A  #YNeg;             // Y-negative flag
  =  Q  [AR1,P#3.2];    // bit 2 of byte 3

NETWORK TITLE = Read back and compare (3 bytes + 2 bits)
  L  IB [AR1,P#0.0];    // echo byte 0
  L  QB [AR1,P#0.0];
  ==I ;
  =  #AckByt0;          // byte 0 echoed
  L  IB [AR1,P#1.0];
  L  QB [AR1,P#1.0];
  ==I ;
  =  #AckByt1;          // byte 1 echoed
  L  IB [AR1,P#2.0];
  L  QB [AR1,P#2.0];
  ==I ;
  =  #AckByt2;          // byte 2 echoed

  A(  A  #XNeg;
      A  I  [AR1,P#3.1]  // asserted and ack asserted
  O ;
      AN #XNeg;
      AN I  [AR1,P#3.1]  // deasserted and ack deasserted
  ) ;
  A(  A  #YNeg;
      A  I  [AR1,P#3.2]
  O ;
      AN #YNeg;
      AN I  [AR1,P#3.2]
  ) ;
  =  #AckBits;          // both bits echoed correctly

  A  #AckByt0;
  A  #AckByt1;
  A  #AckByt2;
  A  #AckBits;
  =  #Ackd;             // OUT: all four conditions met

NETWORK TITLE = 2 s timeout → latched fault
  AN #Ackd;             // if not acked
  =  #NotAckd;          // timer input TRUE
  IN CALL #Faulted (    // SFB4 TON
       IN := #NotAckd,
       PT := T#2S,      // 2-second handshake window
       Q  := #FaultBit  // FaultBit is VAR_IN_OUT → sealed by caller's SR
       ET := );
  O  #Ackd;             // whether ack on or off, exit cleanly
  ON #Ackd;
  SAVE ;                // preserve RLO into BR for FB boundary
END_FUNCTION_BLOCK

Key design decisions in FB5:

• Single POINTER, multiple bytes. The caller passes the start address; FB5 accesses [AR1,P#0.0], [AR1,P#1.0], and [AR1,P#2.0] for the three bytes. This is far more readable than passing three separate pointers and lets the call site read as a single line per channel.
• Bit flags at offset 3. The X-negative and Y-negative flags are written to Q [AR1,P#3.1] and Q [AR1,P#3.2]. The read-back comparison uses XOR-style equivalence (A #XNeg / A I[AR1,P#3.1] OR AN #XNeg / AN I[AR1,P#3.1]) to handle both the asserted and de-asserted cases correctly.
• SR-style fault latching via VAR_IN_OUT. The fault bit is declared VAR_IN_OUT FaultBit : BOOL so the caller can wire it to a seal-in contact (an SR flip-flop) and reset it with a fault reset signal. VAR_IN_OUT passes the address, so the FB writes directly to the caller's memory without a separate output coil.
• SFB4 (IEC TON). The on-delay timer is the standard S7-300/400 system function block for on-delay timing. PT of T#2S gives a 2-second handshake timeout. The Q output drives the FaultBit IN_OUT; the ET (elapsed time) parameter is left unwired.
• SAVE before end. The SAVE instruction copies RLO to BR memory so the FB exits cleanly without leaving an undefined BR state for the calling block.

The acknowledgment check uses a four-condition AND: byte 0 echoed, byte 1 echoed, byte 2 echoed, and the X/Y negative flag bits echoed with the same polarity they were written. If any condition fails, the timer keeps timing out and the fault bit latches after 2 seconds. Once latched, only the caller's fault reset can clear it.

Common Errors and Their Root Causes

Area Code Reference Table for POINTER Constants

To verify a pointer in your project, create a VAT and watch the DWORD value while online. For example, passing P#Q3.0 to FB4/FB5 should produce DW#16#82000018 in the pCmdAddress parameter slot of the instance DB. If you see DW#16#00000000, the parameter was not wired at the call site; if you see a different area code, the wrong symbol is being passed.

Verification and Commissioning Checklist

1. Declare OB121 as a placeholder block (BE) before commissioning to keep the CPU in RUN during initial testing. Remove or upgrade before site acceptance.
2. Create a VAT with the instance DB and observe pCmdAddress as a DWORD. Confirm the area code matches the intended area (0x81 for I, 0x82 for Q, 0x83 for M).
3. Single-step the FB in STL view with BR breakpoints at SAVE. Verify AR1 contains the correct byte offset before each T QB [AR1,…] and L IB [AR1,…].
4. Cross-reference all T QB / L IB accesses in the FB to confirm no two FBs share the same Q area without an interlock. Overlapping handshakes will produce intermittent fault latches.
5. Test the fault path: disconnect the physical input wiring for the acknowledgment byte (or force the IB to a different value via VAT). Confirm the fault bit latches after 2 seconds exactly.
6. Reset the fault and confirm the handshake resumes without CPU STOP. The VAR_IN_OUT + SR pattern must release cleanly.
7. Repeat steps 2-6 for each call site of the FB. The customer's pattern calls it three times (Command, X, Y); all three must pass independently.
8. Test boundary conditions: byte offset 0, maximum byte offset in the CPU's process image, bit 7 of a byte, and bit 0 of the next byte (to confirm SLD 3 is not double-applied).

LAD vs STL: When Indirect Addressing Forces STL

Ladder does not support POINTER parameters on FBs in the same way STL does. The "ANY Pointer" LAD workaround (right-click the LAD network, set the address type to "ANY pointer", wire it with a MOVE box) is constrained to parameter passing at the call site, not to dereferencing inside the FB body. For dereferencing and indirect I/O access, STL is mandatory in S7-300/400.

For customers who require 100% ladder in the calling code, an alternative is the FB3 pattern: use a BYTE index parameter and call the FB three times — one per handshake channel. The trade-off is three call sites and three independent fault bits instead of one POINTER call, but the calling logic remains pure ladder and the FB body can be STL.

Another alternative is SCL (Structured Control Language). SCL on S7-300/400 supports POINTER types indirectly through the POINTER keyword and the ^ dereference operator, which compiles to STL. If the customer accepts SCL blocks, the readability of the FB body improves dramatically and the pointer arithmetic is hidden behind a POINTER TO BYTE declaration.

S7-1200/1500 Migration Notes

For projects migrating to S7-1200 or S7-1500 with TIA Portal V20, the indirect addressing model changes substantially. The S7-1500 uses 64-bit pointers and a new VARIANT type replaces many POINTER use cases. For detailed semantics, refer to the official TIA Portal V20 documentation on indirect addressing in STL for S7-1500.

Key differences for S7-1500:

• The SLD 3 / pointer-byte conversion is no longer required because the addressing model uses byte granularity natively and the bit number is encoded separately.
• AR1 and AR2 still exist, but the underlying pointer format is 64-bit; the FB instance machinery is different and uses optimized block access by default.
• PEEK and POKE instructions in SCL provide a more readable alternative to STL pointer arithmetic and handle byte/word/dword selection implicitly.
• VARIANT pointers can be passed across FB boundaries without the dereference ceremony required for S7-300/400 POINTERs; TypeOf and IS_NULL operators let the FB validate the passed area at runtime.
• Optimized blocks (the default in TIA Portal) prohibit direct pointer access to instance data; use the standard (non-optimized) block setting or move data through an in/out parameter for the same effect.

FAQ