Decoding Address Parameters in Exported PCS 7 Hardware Configuration CFG Files

In SIMATIC PCS 7 and STEP 7 HW Config, an exported station configuration file (.cfg) encodes hardware properties in structured text lines where module addressing is formatted as ADDRESS , , , , , . Understanding each positional parameter allows automation engineers to verify I/O address allocations, confirm process image partition (PIP) scheduling, and audit distributed ET 200 module addressing without launching graphical engineering tools.

Structure and Purpose of STEP 7 HW Config Export CFG Files

In SIMATIC PCS 7 projects, system integrators frequently automate configuration validation or interface with third-party computer-aided engineering (CAE) systems by exporting hardware station descriptions.

In HW Config, executing Station -> Export... generates an ASCII text file with the .cfg extension:
* Human-Readable Text Format: Contains declarations for subracks, communication processors, interface modules (IM), and signal modules (SM).
* Automation Engineering Utility: Used to compare hardware revisions across project versions, verify I/O maps, and audit hardware consistency without loading heavy binary STEP 7 databases.

Positional Syntax of the ADDRESS Parameter Line

When examining signal modules in a .cfg file, each I/O channel group is declared with an ADDRESS statement. For example:
ADDRESS 516, 0, 8, 0, 0, 32

This corresponds to the general syntax:
ADDRESS <A>, <B>, <C>, <D>, <E>, <F>

ParameterIdentifier in ExampleTechnical FunctionEngineering DescriptionA516Start AddressThe initial byte offset of the module within the controller's I/O space (e.g., IB 516 or QB 516).B0Bit OffsetBit offset for compacted digital addressing (typically 0 for byte-aligned modular I/O).C8Length in BytesThe total address span occupied by the module channels (e.g., 8 bytes = 8 digital channels or 4 analog channels).D0Process Image PartitionProcess Image Partition assignment (0 = OB1 process image OB1-PA; 1 to 15 = PIP 1 to PIP 15).E0Subrack / Rack PositionTopology indicator: 0 denotes central rack allocation; values > 0 designate decentralized station numbers.F32Addressing Mode FlagsBit-mapped module property flags: Bit 5 (value 32) designates distributed I/O module addressing.

Decoding Parameters D, E, and F: Partitions, Racks, and Module Flags

Understanding the last three positional parameters resolves configuration ambiguities:

Parameter D: Process Image Partition (PIP / TPA)

In PCS 7, cyclic interrupt OBs (OB30 to OB38) require synchronized process image updates.
When a channel block (Pcs7AnIn, Pcs7DiIn) runs in OB35, its hardware module is assigned to a matching Process Image Partition (e.g., TPA 1).
If Parameter D is 0, the module is read cyclically in the background OB1 process image. Values 1 through 15 map directly to PIP 1 through PIP 15.

Parameter E: Central vs. Distributed Hierarchy

Indicates the physical topological tier of the module.
Central racks (UR1, UR2) report 0. Distributed field stations (such as ET 200M or ET 200SP stations on PROFIBUS DP or PROFINET IO) encode the bus address or station offset.

Parameter F: Module Property and Addressing Flags

Parameter F represents an internal bitmask interpreted by the STEP 7 HW Config compiler:
Bit 0–4: Hardware architecture classification.
Bit 5 (32): Indicates ET 200 distributed modular I/O architecture with channel-level diagnostic buffering.

Step-by-Step Procedure: Exporting and Parsing HW Config Files

Open the Automation Station in SIMATIC Manager.
Double-click Hardware to open the HW Config editor.
Select Station -> Export... from the main menu.
In the export dialog:
* Specify the target directory and filename (e.g., AS01_Hardware.cfg).
* Select format: Readable (Text).
Open the exported .cfg file in a text editor to inspect ADDRESS parameters and confirm channel offsets.

Verification

In HW Config, select the module at start address 516 and open Object Properties -> Addresses.
Confirm that:
Start address equals 516.
Process Image Partition matches Parameter D (OB1-PI or assigned PIP).
Verify that CFC chart driver compilation generates proper peripheral pointers matching parameter byte spans.

Limitations and Operational Precautions

Do Not Edit CFG Manually for Production: While .cfg files can be imported via Station -> Import..., manual text editing risks introducing syntax or CRC errors. Always execute a consistency check (Station -> Check Consistency) after import.
Overlapping Addresses: Ensure module byte lengths (Parameter C) do not overlap with existing hardware modules in the same process image partition.
Symbol Table Alignment: Exporting hardware configuration does not update the symbolic name table (Symbols); symbols must be imported separately via the Symbol Editor.

Engineer FAQ

What does Parameter D = 0 represent in the ADDRESS line?
Parameter D = 0 denotes the standard OB1 process image partition (OB1-PA).
Can an address line have a non-zero bit offset (Parameter B)?
Yes, older S7-300 digital sub-modules with compacted I/O addressing can specify non-zero bit offsets.
What does Parameter F = 32 indicate?
Bit 5 (decimal 32) indicates that the module is deployed in an ET 200 distributed modular peripheral station.
How are analog input module lengths calculated in Parameter C?
Each analog channel occupies 2 bytes (one 16-bit word); a 4-channel analog input module has length 8 bytes.
Can I use exported .cfg files to clone station configurations?
Yes, exported text files can be imported into a new station in HW Config after updating station names.
Does exporting the CFG file interrupt PLC operation?
No, exporting hardware configuration in STEP 7 is an offline engineering operation that does not affect running controllers.
What happens if two modules share the same start address in .cfg?
Importing the file will trigger an address overlap error during consistency validation.
Are PROFINET device names stored in the .cfg file?
Yes, PROFINET device names and IP parameter records are included in the station header section.
Which tool compares differences between two .cfg files?
Standard text comparison tools (such as Beyond Compare, WinMerge, or Git diff) efficiently identify hardware modifications.
Where should hardware ordering numbers (MLFBs) found in .cfg be validated?
All module MLFBs listed in exported files should be checked against the official Siemens Industry Mall.

Technical References

Siemens Manual: SIMATIC Configuring Hardware and Communication Connections STEP 7 (A5E00706939-01).
Siemens Industry Online Support Entry ID 109801081: Exporting and Importing Hardware Configurations in STEP 7.
PCS 7 Released Modules Catalog.