Siemens Step 7 Memory Map: Resolving MW/MD Overlap Conflicts

1. Overview of SIMATIC S7 Memory Architecture

The SIMATIC S7-300 and S7-400 memory model organizes data into bit-, byte-, word-, and double-word-sized containers that all share the same underlying address space. Unlike many controllers that allocate a 16-bit or 32-bit value as a discrete primitive, the Siemens S7 CPU treats memory as a contiguous byte array and overlays the wider data types on top of it. This byte-oriented design produces the well-documented overlap between MB, MW, and MD addresses and is the root cause of the "wrong memory map" symptom reported by programmers migrating from other platforms such as Allen-Bradley ControlLogix/CompactLogix, Modicon M340, or ABB AC500.

The principal memory areas are:

• I (Inputs / Process Image Input) - read-only status from field devices
• Q (Outputs / Process Image Output) - actuator commands
• M (Flag / Memory / Bit Memory) - scratch area for user logic
• DB (Data Block) - structured user data with symbolic names
• L (Local / Temp) - block-scoped stack storage

Inside every area, the addressing grammar is identical: append a number and an optional bit offset. The same overlap rules apply to IB0/IW0/ID0, QB0/QW0/QD0, and DB10.DBX0.0/DB10.DBW0/DB10.DBD0. Operators who understand the flag area (M) can apply the same rules to inputs, outputs, and instance DBs without modification.

2. Bit, Byte, Word, and Double Word Size Reference

The crucial point: a is a byte address in every case. A MW consumes two consecutive bytes; a MD consumes four consecutive bytes. Because there is no separate word array, every word address points into the same byte array and overlaps its neighbours.

3. Memory Overlap Rules

The overlap pattern is fully deterministic and can be expressed as a set of address equations:

From these equations the universally cited engineering shorthand falls out:

"MD0 = MB0 + MB1 + MB2 + MB3
MW0 = MB0 + MB1
MW2 = MB2 + MB3
MW1 = MB1 + MB2 (a misaligned word)"

4. Visualizing the Overlap (Inline SVG Map)

The diagram below renders the first 16 bytes of the flag area with the standard container boundaries overlaid. Each row is one address interpretation; shaded blocks are the bytes that the container actually reads or writes.

5. Aligned vs Misaligned ("Unfavorable") Access

STEP 7 enforces no runtime trap on misaligned access, but the Step7 compiler and the SCL/ST editor flag it as a warning, and the generated MC7 code may be larger or slower. Two access patterns are sanctioned by Siemens documentation:

1. Aligned access - the byte address is an exact multiple of the operand size in bytes.
2. Unfavorable access - the byte address is not aligned, e.g. MW1, MD1, MD2, MD3, MW3, etc.

6. Worked Example: Loading the Value 1 into MW0

This is the canonical example that demonstrates why byte ordering matters. The CPU stores the integer 1 in 16-bit two's-complement form 0x0001 and writes the low byte to MB0, the high byte to MB1.

The source text reports the opposite observation; this is because the byte address in the source is MW0 with the value 1, where the LSB fills MB0 in Step 7. The line "MB0 = 0 and MW1 = 1" in the source is a notational shorthand meaning "MW0 = 1, and the bit pattern puts 0x01 in MB0 and 0x00 in MB1"; the keyword to remember is little-endian, low-byte first. In a debugger or VAT, inspecting MW0 shows W#16#0001 (or 1 decimal) while MB0 reads B#16#01 and MB1 reads B#16#00.

Worked code (LAD / FBD equivalent in STL):

// STL fragment, S7-300/400
L 1                  // Load constant 1 into ACCU1
T MW 0               // Transfer ACCU1 to memory word 0
                      // Result: MB0 = B#16#01, MB1 = B#16#00
                      //         M0.0 = 0 ... M0.7 = 0
                      //         M1.0 = 0 ... M1.7 = 0

7. Bit Numbering Convention

Siemens uses the European convention where the bit index increases from right to left inside a byte, with bit 0 being the LSB:

A value of 16#0102 in MW0 therefore has MB0 = 16#02 (set bits M0.1) and MB1 = 16#01 (set bit M1.0). When migrating from controllers that number bits from left to right (e.g. some legacy relay-ladder dialects), always re-derive the polarity with a truth-table test before copying code.

8. Best Practice: Use Data Blocks with Symbolic Addressing

The cleanest fix for the entire class of "wrong memory map" problems is to stop using the absolute MB/MW/MD flag area for application data. Instead:

1. Create one or more shared DBs (DB10, DB20, ...) for global data and instance DBs for FB-local data.
2. Declare every variable with a meaningful symbolic name and a data type (BOOL, INT, REAL, DWORD, STRING, etc.).
3. Let the compiler allocate the byte offset; the programmer never touches DBX0.0 directly again.
4. Optionally tick "Optimized block access" in TIA Portal to obtain symbolic-only addressing with no fixed offset (S7-1200/1500 only; classic S7-300/400 use standard DBs).

Example declaration table for a shared DB in STEP 7 V5.x:

The compiler places Start_PB, Stop_PB, and Motor_Running in the first byte; Motor_Speed_RPM automatically lands on the next even address (byte 2) because it is a 16-bit type; Motor_Current_A lands on the next multiple of four (byte 4) because it is a 32-bit type. The user is freed from manual alignment.

9. TIA Portal Memory Diagnostics

On S7-1200/1500 (and the S7-300 CPUs that support it), TIA Portal exposes online memory diagnostics that are far more useful than the offline reference data:

1. In the project tree, right-click the target CPU and choose "Online > Online and diagnostics".
2. Expand Diagnostics and select "Memory".
3. The display shows current usage of load memory, work memory, and retain memory in bytes and as a percentage, including a per-area breakdown of bit memory, input, output, and DB working data.

Use the same panel to verify that your block (FC/FB/DB) actually fit in the CPU - a classic field failure is the project downloading fine but stopping with SF (System Fault) because the code memory is exhausted.

Official reference: TIA Portal > S7-1200 Manual Collection > Memory Management.

10. Memory Map Errors in Connected Tools

The "memory map" phrase also appears in adjacent contexts. A driver-level example is the Siemens S7 Plus Ethernet Driver manual, where the server publishes a memory map of DB tags whose update rate is governed by the Group Update Rate of the parent group. If the server is reinitialized, current item values are dropped and the next read returns the default/initial value of the tag rather than the live value - relevant when you see "memory map empty" on a SCADA screen after a server restart.

Embedded debuggers (e.g. Texas Instruments CCS) use the same phrase for a different concept: a memory-map error READ access by CPU to address 0x... means the CPU tried to read a section the linker marked as RESERVED or READ-ONLY. The diagnostic is similar in shape but lives in the embedded domain rather than PLC programming; understanding the distinction prevents misrouted support tickets.

11. Field-Proven Programming Rules

12. Verification & Commissioning Checklist

After any change to absolute flag area or DB layout, run the following sequence before powering the field I/O:

1. Open a Variable Table (VAT) in STEP 7 / TIA Portal.
2. Add the suspected overlap pairs as watch rows, formatted as HEX (e.g. MW0 = W#16#???, MB0 = B#16#??, MB1 = B#16#??).
3. Force a known pattern (e.g. L 16#1234; T MW 0) and confirm MB0 = B#16#34 and MB1 = B#16#12.
4. Read the equivalent symbolic tag from a DB and confirm the symbolic view matches the absolute view.
5. Disconnect all field wiring and run the empty scan for at least one full OB1 cycle; the diagnostic buffer must remain free of Area length error (SF, LED pattern) or Stop by programming error.
6. Only after a clean scan should I/O be reconnected and the standard commissioning sign-off procedure (per IEC 61131-3 and your site safety rules) be executed.

FAQ