Understanding PIB Addressing in Siemens S7-300 and S7-400 PLCs

The mnemonic PIB stands for Peripheral Input Byte, and the numeric suffix (for example, the 1 in PIB1) is the byte address assigned to a physical I/O slot in the hardware configuration. The address is not arbitrary; it is the slot offset produced by STEP 7 HWConfig for the analog or digital module that occupies the corresponding position in the rack. This article explains the address model behind the P prefix, the difference between peripheral access and image-table access, and the engineering rules for reading analog channels with PIW and the FC105 SCALE block.

1. The Siemens S7 Address Model: Process Image vs. Peripheral I/O

The S7-300 and S7-400 CPUs expose two distinct read paths to physical I/O:

1. Process image (I and Q areas) — a memory mirror of the input and output modules that the CPU refreshes once per OB1 scan at a deterministic point in the cycle. The user program reads IB0, IW4, QB12, etc. The values are stable for the duration of OB1 execution and represent a snapshot of the I/O at scan start.
2. Peripheral I/O (PI and PQ areas) — a direct, non-buffered path to the module's hardware register. Accessing PIB0 or PIW256 triggers an immediate read on the backplane bus every time the instruction is executed. There is no scan-stable buffer.

The P prefix is the mnemonic marker for the peripheral area. The full address family is summarized below.

The numeric suffix on every address is the byte offset within the chosen area. PIB1 therefore means: byte 1 of the peripheral input area. PIW256 means: word at byte offset 256, i.e. bytes 256 and 257, of the peripheral input area (words are little-endian, low byte at the lower address).

2. Why Two Address Spaces? The Engineering Rationale

The process image exists to give a deterministic, race-free view of all inputs at the moment logic decisions are made. The peripheral area exists for cases where the snapshot semantics are wrong:

• Analog modules with slow update rates. The S7-300 analog input modules (SM331, SM332, SM334) update their conversion registers only every few milliseconds to tens of milliseconds depending on the configured integration time. Forcing the user to read PIW directly lets the application pick up the most recent conversion at the exact moment it is needed.
• Time-critical interrupts (OB40, OB82). In hardware interrupts, the process image may not be current; peripheral access is the only way to read the true state of the line that triggered the interrupt.
• Modules that physically sit outside the configured process image partition. By default, HWConfig assigns the lower addresses to the process image. The upper area of the address space is reserved for peripheral-only modules; accessing them with IB is impossible because no image entry exists.

3. Default Address Ranges in S7-300 and S7-400

STEP 7 HWConfig partitions the I/O address space as follows by default. These limits are configurable in the CPU properties dialog and must be verified against the actual project, but the defaults shown are the values seen in the majority of installed systems.

For an S7-300 with the default 128-byte image, the first valid peripheral input byte is PIB128, and an analog module slotted in the first free slot is typically assigned PIW256, PIW258, … (word-aligned, even address). For an S7-400, the boundary is PIB256, with analog modules usually starting at PIW512.

4. The "xxx" in PIBxxx: What the Number Really Means

The numeric suffix is the logical I/O address in the STEP 7 project, not a physical slot number, not a channel number, and not a sequential counter. It is generated by HWConfig and follows these rules:

1. STEP 7 scans the configured racks (0, 1, 2, … for S7-300; up to 18 for S7-400) in slot order, starting with slot 4 (slots 1–3 are reserved for the CPU, IM, and PS).
2. For each module it reads the number of input and output bytes declared in the GSD or module description.
3. It assigns addresses starting at the configured process image boundary, incrementing by the module's I/O size, and aligns words on even byte addresses.
4. The address is written to the project as the module's "logical address." The same address is downloaded to the CPU's system data and burned into the module's diagnostic table.

Therefore, in a typical S7-300 layout with default settings:

• Slot 4: SM321 DI32 × 24 V DC → IB 0 … IB 3 (process image)
• Slot 5: SM321 DI32 × 24 V DC → IB 4 … IB 7 (process image)
• Slot 6: SM331 AI8 × 12 bit → PIW 256 … PIW 270 (peripheral only, 8 channels × 2 bytes)
• Slot 7: SM332 AO4 × 12 bit → PQW 272 … PQW 278 (peripheral only)

Channel 0 of the analog card is PIW256, channel 1 is PIW258, channel 2 is PIW260, and so on. To inspect the actual mapping in your project, right-click the module in HWConfig and select Monitor/Modify, or open the System Data blocks (SDB) in the offline project view.

5. PIB vs. IB: Update Semantics in Detail

The behavioural difference between PIB and IB is not merely a matter of address range. The two read paths execute differently inside the CPU:

6. Reading PIB1: A Practical Example

The forum example MOVE PIB1 to IB1 is technically legal but architecturally questionable. The correct interpretation and the recommended patterns are as follows.

6.1 Why the original example is unusual

PIB1 in the default S7-300 layout lies inside the process image area, so it refers to the same physical byte as IB1. The two read paths will return identical values during the OB1 scan; the only difference is that PIB1 performs a fresh backplane read at the moment the MOVE executes, while IB1 returns the cached value. Because the cache is refreshed at the start of OB1, the two are functionally interchangeable inside OB1 itself.

The MOVE from PIB1 to IB1 will succeed, but it will be overwritten at the next OB1 start when the CPU refreshes the image from the module. The write is therefore wasted unless the program disables the process image update (S7-400 only, see section 10).

6.2 The legitimate use case for storing PIB to a memory location

Storing a peripheral read into a merker (M), DB, or input (I) byte is justified when the program needs a frozen snapshot of a transient value, for example:

• Capturing a peak value from an analog input that the module no longer holds in its conversion register.
• Reading a counter or frequency value from a fast FM350 module and writing it to a DB for a recipe archive.
• Logging a digital event within a hardware interrupt (OB40) where the process image update for the partition owning that module is not guaranteed.

6.3 Recommended STL snippet (STEP 7 v5.x)

// Read PIW 256 (analog channel 0) and store the raw value in DB100.DBD0
L     PIW 256
T     DB100.DBD 0

// Alternative with explicit byte swap if the module is bipolar and
// the high/low byte need ordering correction:
L     PIW 256
CAW                       // reverse byte order inside the accumulator
T     DB100.DBD 0

6.4 Recommended SCL snippet (STEP 7 v5.x or TIA Portal)

// SCL function block fragment
#rawValue  := WORD_TO_INT("PIW256");    // 0..27648 or +/-27648
#scaledEng := SCALE_DB.IN  := INT_TO_REAL(#rawValue);
#scaledEng := SCALE_DB.OUT;            // engineering unit output

7. Raw Analog Value Representation in S7-300 / S7-400

The S7-300 analog modules (SM331, SM332, SM334) and the S7-400 analog modules (SM431, SM432) represent each channel value as a 16-bit signed integer with a fixed full-scale range. The nominal value ranges are:

The S7-300/400 SM331 manual also defines the integration time vs. noise rejection trade-off: a 60 Hz integration time setting yields the highest noise rejection at the cost of channel update latency (~50 ms per active channel when 8 channels are enabled). For fast loops, switch to 50 Hz (or 20 ms) at the expense of noise immunity. The relevant module data and wiring rules are documented in the SIMATIC S7-300 S7-300 Module Data manual on Siemens Industry Online Support.

8. Scaling with FC105 SCALE and FC106 UNSCALE

The TI-S7 Converting Blocks library (formerly shipped with STEP 7 as the "Standard Library / TI-S7 Converting Blocks") provides two essential blocks:

• FC105 SCALE — converts a raw integer to a real engineering value.
• FC106 UNSCALE — inverse, converts a real engineering value to a raw integer for writing to PQW.

8.1 FC105 SCALE interface

8.2 FC105 RET_VAL error codes

8.3 Example call in STL

// Convert PIW 256 (0..27648) to 0.0..100.0 percent
CALL  FC   105
     IN       := MW100                 // loaded elsewhere from PIW 256
     HI_LIM   := 1.000000e+002
     LO_LIM   := 0.000000e+000
     BIPOLAR  := FALSE
     RET_VAL  := MW110                 // check for W#16#0007..0009
     OUT      := MD120                 // scaled real, e.g. 47.3 (percent)

8.4 Worked scaling formula

For unipolar signals the math is a straight linear interpolation:

OUT = ((IN - 0) × (HI_LIM - LO_LIM)) / 27648 + LO_LIM

For bipolar signals the math centres on zero:

OUT = (IN × (HI_LIM - LO_LIM)) / 27648 + (HI_LIM + LO_LIM) / 2

For inverted scales (e.g. 4…20 mA → 100…0 %, as used in some valve positioners) set LO_LIM = 100.0 and HI_LIM = 0.0. FC105 automatically detects the inverted limits and returns the correct inverted output.

9. Process Image Partitioning (TP / PIP)

For S7-400 (and S7-300 CPUs that support it, such as 317 and 319), the process image can be subdivided into up to 31 partitions, each assignable to a specific OB. This is configured in HWConfig on the module properties under Addresses / Process Image. The relevant OBs are:

When a module is assigned to partition TP n, the CPU updates the corresponding IB/QB bytes only when the owning OB is entered. Outside that OB, the user program should use PIB / PQB for an immediate read/write, otherwise it sees stale data.

10. Disabling Process Image Updates on S7-400

For certain deterministic applications, the S7-400 CPU allows the process image update to be disabled in the scan cycle. The relevant SFC is SFC 26 UPDAT_PI (input) and SFC 27 UPDAT_PO (output), which refresh selected process image partitions under program control. The calling pattern is:

CALL  SFC 26
     PART     := 0                     // partition 0 (OB1 portion)
     RET_VAL  := MW200                 // W#16#0000 on success
     FLADDR   := MW202                 // first byte that failed (if any)

When the automatic scan-end update is disabled in the CPU properties (Cycle / Update Process Image cyclically unchecked), the program becomes fully responsible for invoking SFC 26 / SFC 27 at the desired points. This is the proper way to avoid the "PIB1 value overwritten by next OB1 image refresh" issue raised in the field report.

11. Programming Patterns and Best Practices

11.1 Use PIW for analog, IB for digital (when stable)

Default rule: digital input modules participate in the process image, so use I addresses. Analog modules are always accessed via PIW because their conversion registers are not mirrored in the process image by default. Counting modules (FM350) likewise use PIW for the count register.

11.2 Do not move PIB into IB inside OB1

It is wasteful and confusing. The next OB1 pass will overwrite your IB1 with the live input. Use an M or a DB byte if you need a frozen snapshot.

11.3 Group adjacent PIW reads

To minimise backplane bus traffic, read an entire 16-byte analog block with a single L PIW per channel rather than scattering reads. If a module supports 8 channels starting at PIW256, the eight reads are PIW256 … PIW270. Avoid reading the same channel twice in OB1 unless the logic demands it.

11.4 Handle 0x7FFF / 0x8000 diagnostics

Always check the raw value for the overflow tag 0x7FFF (32767) and the wire-break tag 0x8000 (-32768) before scaling. A raw of 32767 in a 4…20 mA loop usually means an open input or a shorted cable. FC105 will scale these to LO_LIM or HI_LIM and set the appropriate clipping flag, but your logic should still log the event and raise a process alarm.

11.5 Verify the address in HWConfig before commissioning

STEP 7 will allow you to type any address in the editor, but the CPU will return an I/O access error (SF LED + diagnostic buffer entry) if the address is not configured. Use PLC → Monitor/Modify → Monitor to verify the address space online before downloading the program.

12. Troubleshooting Matrix

13. Reference: Equivalent Addresses Across Siemens Families

On S7-1500 the P prefix is replaced by an explicit "Direct I/O Access" attribute on the PLC tag. Under the hood the backplane behaviour is the same: the read is performed on the bus at the moment of access, bypassing the process image update. For migration of S7-300/400 code, swap PIW256 for %IW256 in the S7-1500 tag and mark the tag as "direct" in the tag table.

14. Field-Commissioning Checklist

1. Open HWConfig, double-click the CPU, and record the configured "Size of the process image" limits.
2. List every analog module and write down the logical PIW and PQW addresses from the module properties dialog.
3. In Monitor/Modify, watch PIW values to confirm a live signal is present at the module terminals (multiply by engineering factor for sanity: e.g. 4…20 mA at 10 V should read about 13824 for 50 % of range).
4. Verify the diagnostic buffer is clean (no "Peripheral I/O error" entries).
5. Test the FC105/FC106 scaling path with a known input signal (e.g. calibrator at 12.000 mA, expect 50 % of range).
6. Document the address map in the project documentation so that the next engineer does not have to repeat the analysis.

15. Summary

The number after PIB is the byte address within the peripheral input area, generated by STEP 7 HWConfig and downloaded to the CPU as part of the system data. The P prefix is the marker for direct, immediate I/O access that bypasses the process image. The two address spaces (image and peripheral) co-exist because they serve different engineering goals: deterministic snapshot semantics for digital logic, low-latency direct access for analog and interrupt-driven reading. Understanding where the boundary between them sits in the configured CPU — typically PIB128 on S7-300 and PIB256 on S7-400 — and verifying the assignment in HWConfig is the first step to writing correct, maintainable STEP 7 code. Use PIW for analog channels, scale with FC105 into engineering units, and always check the raw value for the 0x7FFF overflow and 0x8000 wire-break diagnostic tags before trusting the scaled result.

Frequently Asked Questions