STEP 7 Basic S7-1200 DB Limits, Indirect Addressing

Overview

STEP 7 Basic is the engineering environment supplied with STEP 7 in the TIA Portal for programming the SIMATIC S7-1200 controller family. It targets the compact-class PLC range and is bundled with every S7-1200 CPU purchase. The integrated editor supports ladder logic (LAD), function block diagram (FBD), and structured text (SCL), with all blocks stored directly in the PLC's load and work memory. Unlike the classic STEP 7 V5.x environment that serves S7-300/400, STEP 7 Basic is tightly integrated with WinCC Basic for HMI configuration and shares a single project database.

This reference consolidates the engineering constraints that frequently arise when migrating from the legacy S7-200 MicroWin platform to the S7-1200:

• Data block (DB) quantity and size limits
• Indirect addressing syntax and what is — and is not — supported
• IEC timer/counter block memory consumption
• Offline code simulation using the integrated PLCSIM option (Basic edition)
• Firmware-dependent features, particularly the SP2 indirect addressing extension

Data Block (DB) Quantity and Size Limits

S7-1200 firmware does not enforce a fixed maximum number of data blocks. The practical limit is determined by the available load memory and work memory on the specific CPU. Every DB consumes:

• Load memory: full block size plus generated block header
• Work memory: runtime portion of the block (typically a subset of load memory)
• Retain memory: only for variables tagged as RETAIN or PERSISTENT

Memory Areas on the S7-1200

DB Types in STEP 7 Basic

STEP 7 Basic supports two distinct DB categories:

• Global DB: a stand-alone data block that holds shared tag memory accessible by any code block. Created via Add new DB in the project tree.
• Instance DB: automatically generated and tied to a specific FB. Stores the static and temporary variables of that FB. Cannot be created manually.

Optimized block access is the default for new blocks created in TIA Portal V13 and later. Optimized DBs sort variables only at symbolic declaration and remove the fixed address layout, allowing the compiler to pack tags more efficiently in work memory.

Symbolic and Absolute Addressing

STEP 7 Basic prefers symbolic addressing. Every DB variable receives a symbolic name and data type at declaration. Direct bit access syntax mirrors classic STEP 7:

"MyMotor".Speed     // symbolic tag access
DB1.DBX0.0          // absolute bit access (DB 1, byte 0, bit 0)
DB1.DBB0            // absolute byte access
DB1.DBW2            // absolute word access
DB1.DBD4            // absolute double-word access

This is absolute addressing — not indirect addressing. It maps directly to a fixed memory offset and is fully resolved at compile time.

Indirect Addressing Capabilities

S7-1200 indirect addressing is the most-misunderstood area for engineers migrating from S7-200 or S7-300/400. The classic pointer-based mechanism used in those platforms is not available in STEP 7 Basic on early firmware versions.

What Is Supported: Array Index Access

The S7-1200 supports indirect access through array index variables. A variable used as an index must be declared as DINT or LREAL (when targeting a floating-point array). The compiler resolves the address by combining the array's base offset with the runtime value of the index tag.

// ARRAY[0..9] of INT declared in DB "Samples"
#LoopIndex : DINT;  // local variable in FB

"Samples".Value[#LoopIndex] := "Samples".Value[#LoopIndex] + 1;

Only an INT, DINT, or LREAL tag may act as the index. Tags of type BOOL, BYTE, or WORD cannot be used as array indices even if their numeric value fits the range.

What Is Not Supported: Pointer Arithmetic

The legacy ANY/POINTER area-crossing addressing typical in S7-300/400 is unavailable in the base S7-1200 firmware. Specifically:

• No P# pointer literals
• No LAR1/TAR1 address register operations in LAD/FBD
• No indirect DB specification (DB[Index]) at block-call level
• No AT-view pointer overlays in the initial S7-1200 firmware releases

Firmware SP2 Extension

The release of STEP 7 Basic V11 SP2 introduced enhanced indirect addressing on the S7-1200, providing a limited pointer-style capability inside SCL source code. With SP2 the following indirect DB-selection patterns are supported:

// SP2+ SCL example: index-based DB read
FOR #i := 1 TO 5 DO
    "Data".Value := "DataBlock"."DB_Slot"[#i].Reading;
END_FOR;

This extension also enables indexed access to multi-instance DBs and to data blocks declared with array structures when compiled by SP2 or later. Programmers should confirm the firmware version on the target CPU matches the TIA Portal version used to compile the project; mixed firmware/TIA combinations may reject the indirect syntax during download.

IEC Timers, Counters, and Memory Consumption

The S7-1200 — like the S7-300/400 — implements timers and counters as IEC function blocks (TP, TON, TOF, CTU, CTD, CTUD) rather than as dedicated word-based memory areas. Each timer or counter instance consumes:

• An instance DB (or multi-instance slot) for its internal state
• Approximately 16–32 bytes of work memory per instance
• No retain memory unless the containing block is declared retain

Because IEC timers/counters are full FB instances, the practical number is bounded by work memory rather than by a fixed integer counter. A CPU 1211C with 50 KB work memory typically supports 200–500 active IEC timer instances depending on program overhead.

IEC Block Naming Convention

These are IEC 61131-3 compliant blocks. There is no separate "timer word" area like the legacy S7-200 T0–T255 range.

Simulation: PLCSIM and HMI Simulation

STEP 7 Basic does not ship with a built-in PLC simulator for the S7-1200 in the same way STEP 7 Professional includes S7-PLCSIM. The base license activates code editing, online diagnostics, and download to a physical CPU. HMI runtime, however, can be exercised through WinCC Basic's integrated simulator:

• WinCC Basic ships with the same TIA Portal installer as STEP 7 Basic
• The Start Runtime command launches the HMI simulation on the engineering PC
• Tags configured on the HMI map to PLC variables and can be manipulated from the simulation panel

For full closed-loop S7-1200 code testing, the practical options are:

1. PLCSIM (S7-1200 edition): introduced in TIA Portal V14 SP1, available with the STEP 7 Basic license upgrade to a "Professional" SKU. Provides a virtual S7-1200 CPU that runs compiled code on the engineering PC and exposes the standard online interface for monitoring and forcing.
2. Hardware-in-the-loop test rig: physical CPU plus signal simulator. Use for final validation; mandatory for safety-related code.
3. Real CPU + operator panel: the most common field approach. Upload after compile and observe behaviour on-site.

Migrating From S7-200 Micro/Win

The S7-200 uses Micro/Win (STEP 7 Micro/WIN) which is a different engineering tool, not a predecessor of STEP 7 Basic. Migrating a Micro/Win project to TIA Portal requires either:

• Manual reconstruction of program logic in STEP 7 Basic
• Use of the Migrate Project tool shipped with TIA Portal, which translates S7-200 STL/LAD into S7-1200 equivalents with manual remediation of pointer-based access and special-function (SFR) calls

The major differences an engineer must refactor:

Firmware and Software Version Compatibility Matrix

Verification Procedure for DB and Indirect-Addressing Projects

1. Compile the project (Project > Compile > All). Note any warnings about block size or unreachable code.
2. Open PLC > Properties > Memory to view predicted work-memory usage.
3. Download to target CPU and check Online > Diagnostics > Memory for actual runtime consumption.
4. Force the array index variable to the boundary values (0 and upper array bound) and verify access succeeds without a CPU goes to STOP event.
5. Check the diagnostic buffer for SF (system fault) entries after every indirect access test. A common fault is SF: area length error when the index exceeds the array declaration.
6. Confirm retain behaviour by power-cycling the CPU and observing which DB tags persist.

Field-Proven Caveats and Best Practices

• Always declare index variables as DINT. A common mistake is using INT, which forces signed-16-bit arithmetic and can produce negative array indices if the calculation wraps.
• Pre-validate array bounds in code. Wrap indirect access with an IF Index >= 0 AND Index < ARRAY_SIZE guard before any read or write. Out-of-range access throws a non-recoverable fault and stops the CPU.
• Use optimized DBs unless an HMI or external OPC client needs fixed offsets. Optimized blocks reduce work-memory footprint and improve access performance, but disable absolute addressing if forced to mix optimized and standard access modes in the same DB.
• Enable Know-How Protection on finished blocks. Available in the block properties; prevents upload of source code in plain text without the password.
• Keep one backup of every project on the SIMATIC Memory Card. The card stores the CPU program as a fallback if internal flash is corrupted; this is the recommended Siemens recovery procedure.
• Use SCL over LAD for any indirect access logic. LAD/FBD can express array index access but the syntax is awkward and error-prone; SCL is the canonical environment for indexed operations.

Troubleshooting Matrix

Frequently Asked Questions