Siemens SCL STRING to HEX Conversion: Step-by-Step S7-1500 FB

Overview: STRING-to-HEX Conversion in Siemens SCL

Engineers routinely need to push an ASCII STRING payload over a protocol that only understands raw bytes — Profibus DP-V0, Modbus RTU over RS485, MQTT with hex-encoded payloads, or a barcode scanner that returns a string the gateway expects as 0x48 0x45 0x4C 0x4C 0x4F. The simplest way to express a Siemens STRING in hexadecimal form is to walk the bytes one by one, mask the upper and lower nibbles, and emit them as the ASCII characters 0–9 and A–F. A small SCL function block (STR2HEX) is the canonical way to do this and is reusable across S7-1200 and S7-1500 projects.

The conversion algorithm is byte-for-byte identical regardless of controller: for each character C, compute the high nibble H = C / 16 and the low nibble L = C MOD 16, then emit CHR(48 + H) when H <= 9 or CHR(55 + H) when H >= 10. The same rule applies to the low nibble. The result is a STRING whose length is exactly 2 × Len(Input).

This article implements the conversion as a FUNCTION_BLOCK in SCL, walks through every line, and adds edge-case handling, performance notes, and a verification procedure using PLCSIM. The technique is fully compatible with TIA Portal V17, V18, and V19 on any S7-1200 (firmware ≥ 4.2) or S7-1500 (firmware ≥ 1.8) CPU.

Prerequisites: Hardware, Firmware, and Software

All SCL elements used in the example are part of the IEC 61131-3 ST subset that SCL implements; no vendor extension is required. See the S7-1200 system manual and the S7-1500 system manual for the firmware baseline that supports extended STRING operations up to 254 characters.

STRING Memory Layout in STEP 7 and TIA Portal

Before writing the conversion, it is critical to understand how Siemens lays out a STRING in the CPU's load memory. A STRING[254] occupies 256 bytes in total — 2 bytes of administrative header followed by up to 254 bytes of ASCII payload:

• Byte 0 (pASC[1]): Maximum declared string length (e.g., 254).
• Byte 1 (pASC[2]): Current effective length of the string stored in the variable. For the literal 'HELLO!', this byte contains 16#06.
• Byte 2 .. 2 + CurrentLength − 1: ASCII characters. pASC[3] holds 'H', pASC[4] holds 'E', and so on.
• Trailing bytes: Remain at 16#00 after the effective length.

Because SCL STRING indexing is 1-based, you cannot read the raw layout using the STRING type directly. The standard idiom is to overlay an ARRAY [1..256] OF CHAR view using the AT directive:

VAR_INPUT
  ASC_STR  : STRING;
  pASC AT ASC_STR : ARRAY[1..256] OF CHAR;
END_VAR

This overlay is well-formed for any STRING whose declared maximum length is 254, and it gives byte-level access without resorting to POKE / PEEK into the DB. The same AT overlay technique is used on the output so the FB can write directly into the resulting HEX_STR header.

Algorithm Design: ASCII to Hex Nibble Encoding

The conversion uses one nibble of the source byte to index into the canonical ASCII hex character set 0123456789ABCDEF. Numerically:

• For a nibble value N in the range 0..9, the ASCII character is CHR(48 + N). 48 is the ASCII code for '0'.
• For a nibble value N in the range 10..15, the ASCII character is CHR(55 + N). 55 is the offset that places N=10 on CHR(65) = 'A'.

These two offsets (48 and 55) are present in the source code and can be replaced with named constants for readability:

CONST
  ASCII_0  := 48;   // '0'
  ASCII_A  := 55;   // 'A' - 10
  ASCII_SPACE := 32;
  ASCII_TILDE := 126;
END_CONST

Although hard-coded integer literals are functionally identical, naming them makes the code self-documenting and complies with maintenance guidelines that discourage magic numbers. This is one of the cleanup recommendations that came out of the original implementation discussion.

Step-by-Step SCL Implementation (STR2HEX FB)

The complete function block follows. Add it to your project as a new SCL source under Program blocks → Add new block → Function block → Language: SCL and name it STR2HEX.

FUNCTION_BLOCK STR2HEX
{ S7_Optimized_Access := 'TRUE' }
VAR_INPUT
  ASC_STR  : STRING;
  pASC AT ASC_STR : ARRAY[1..256] OF CHAR;
END_VAR
VAR_OUTPUT
  HEX_STR  : STRING;
  pHEX AT HEX_STR : ARRAY[1..256] OF CHAR;
END_VAR
VAR
  StrLen : INT;
  i      : INT;
  C      : INT;
  H      : INT;
END_VAR
BEGIN
  // Read the current effective length from STRING header byte 2.
  StrLen := CHAR_TO_INT(pASC[2]);

  // Pre-set the resulting hex string length = 2 * source length.
  pHEX[2] := INT_TO_CHAR(StrLen * 2);

  // Walk every character and emit two hex nibbles per source byte.
  FOR i := 3 TO (StrLen + 2) DO
    C := CHAR_TO_INT(pASC[i]);

    // Allow printable ASCII only; reject control characters and DEL.
    IF (C >= 32) AND (C <= 126) THEN
      // --- High nibble ---
      H := C / 16;
      IF H <= 9 THEN
        H := H + 48;
      ELSE
        H := H + 55;
      END_IF;
      pHEX[(i * 2) - 3] := INT_TO_CHAR(H);

      // --- Low nibble ---
      H := C MOD 16;
      IF H <= 9 THEN
        H := H + 48;
      ELSE
        H := H + 55;
      END_IF;
      pHEX[(i * 2) - 2] := INT_TO_CHAR(H);
    ELSE
      // Non-printable byte: abort and report error.
      HEX_STR := 'Invalid ACSII character in string';
      RETURN;
    END_IF;
  END_FOR;
END_FUNCTION_BLOCK

Code Walkthrough: Variable Declarations and Length Decode

The VAR block contains four working integers. StrLen holds the effective length read from the second header byte of the input STRING. i is the loop index, which runs from 3 (the first payload byte after the two-byte header) to StrLen + 2 (the last payload byte). C is the integer value of the current source character, and H is reused to hold each nibble in turn before conversion to ASCII.

The expression pHEX[2] := INT_TO_CHAR(StrLen * 2) writes the effective length of the resulting HEX_STR into its own header. Without this assignment the output STRING would still display its old length and the higher bytes — even though physically written — would be invisible to SCL string-handling instructions such as LEN(), LEFT(), or CONCAT().

The multiplication by 2 is intentional. The runtime cost of StrLen * 2 on an INT is identical to a 1-bit left shift. The SCL compiler lowers * 2 to a single shift in the generated MC7 byte-code on both S7-1200 and S7-1500; the explicit shift operator is not necessary in the source.

Code Walkthrough: The Main Conversion Loop

For each character position i from 3 to StrLen + 2:

1. Decode byte. C := CHAR_TO_INT(pASC[i]) lifts the ASCII code of the current character into an INT.
2. Validate range. The condition (C >= 32) AND (C <= 126) accepts printable ASCII characters including space (32), letters, digits, and punctuation up to tilde (126). Characters outside this range are rejected with an error string.
3. High nibble. H := C / 16 extracts the upper 4 bits using integer division. After the offset + 48 or + 55, H is written to pHEX[(i * 2) - 3]. With i = 3, this writes to position 3, which is the first payload byte of the result STRING.
4. Low nibble. H := C MOD 16 extracts the lower 4 bits using the integer modulo. The same offset rule applies, and the result is written to pHEX[(i * 2) - 2], the byte immediately after the high nibble.

The index math (i * 2) - 3 and (i * 2) - 2 places the two hex characters contiguously starting at output position 3. For the first iteration (i = 3) they evaluate to positions 3 and 4 — exactly where the first two hex digits of the encoded result must land.

Edge Cases: Non-Printable, Empty, and Extended Characters

Optimized Variants: Performance vs Readability

The reference implementation optimises for clarity. Two variants are useful when the FB sits inside a high-rate OB (such as OB35 at 100 ms) or inside a time-critical communication interrupt:

Variant A — Fused nibble-to-char with explicit bounds

H := C / 16;
IF H < 10 THEN
  pHEX[(i * 2) - 3] := INT_TO_CHAR(48 + H);
ELSE
  pHEX[(i * 2) - 3] := INT_TO_CHAR(55 + H);
END_IF;

Eliminates the temporary variable H reuse for the high nibble and merges the offset add into the assignment. Saves one assignment per nibble.

Variant B — Numeric output (no uppercase letters)

pHEX[(i * 2) - 3] := INT_TO_CHAR(48 + (C / 16));
pHEX[(i * 2) - 2] := INT_TO_CHAR(48 + (C MOD 16));

Some modbus masters prefer lowercase hex or decimal-only formatting. Replace the offset 55 with 87 to get lowercase 'a'..'f'; for plain decimal representation use INT_TO_STRING(C) per byte instead.

Variant C — Pointer arithmetic via PEEK/POKE (legacy STEP 7 V5.5)

On S7-300/S7-400 with STEP 7 V5.5 the AT overlay on VAR_IN_OUT was the only portable pattern. With SCL in V5.5 you must mark the parameter as VAR_IN_OUT instead of VAR_INPUT for the AT overlay to compile. The conversion logic itself remains identical.

Verifying the Function Block in PLCSIM

1. Compile. Right-click the STR2HEX FB and select Compile → Software (only changes). Resolve any SCL errors from the inspector before continuing.
2. Create an instance DB. In Program blocks, drag STR2HEX into OB1 (or OB35 for cyclic). The instance data block DB_STR2HEX is created automatically.
3. Add test driver logic. In OB1 add three lines of SCL:

   DB_STR2HEX.ASC_STR := 'HELLO!';
   DB_STR2HEX();
   // Inspect DB_STR2HEX.HEX_STR in the watch table.

4. Start PLCSIM. Launch Start → Programs → Siemens Automation → TIA Portal V18 → PLCSIM (TIA Portal V18) and download the project. Run the simulation.
5. Watch table. Open the watch table, add DB_STR2HEX.ASC_STR and DB_STR2HEX.HEX_STR. Force ASC_STR := 'HELLO!' and confirm HEX_STR reads '48454C4C4F21'.
6. Edge case sweep. Repeat with empty string (HEX_STR should be empty), with 'abc' (expect '616263'), and with a string containing a control character ($0A + 'X', expect 'Invalid ACSII character in string').

Field-Proven Pitfalls and Maintenance Notes

The implementation discussion surfaced five real-world pitfalls that engineers regularly hit on Siemens sites. Apply them during code review.

Calling STR2HEX from Other Languages

The FB is callable from LAD, FBD, and STL in addition to SCL. In LAD you place an empty box, type STR2HEX, and wire the input to the ASC_STR parameter and the output to a TEMP_STRING variable. From STL:

CALL  STR2HEX , DB_STR2HEX
      ASC_STR  := "Data".Tag_Source
      HEX_STR  := "Data".Tag_HexResult
      NOP 0

The AT overlays on the input/output make the FB entirely self-contained — no shared ANY pointers, no dual-instance DB tricks, and no global temporary buffers.

Migration Notes: STEP 7 V5.5 → TIA Portal V18

Existing STEP 7 V5.5 SCL sources using the same algorithm typically work after migration, but two changes are routinely needed:

1. Change VAR_INPUT for the AT-overlaid string to VAR_IN_OUT. In TIA Portal VAR_INPUT is read-only by default and the compiler rejects an AT overlay that writes through it.
2. Add the { S7_Optimized_Access := 'TRUE' } attribute to the FB declaration to keep the instance DB symbolically optimised.

Confirm both after migration by recompiling and reviewing the inspector warnings.