Understanding Data Block Byte Offsets and REAL Data Types in SIMATIC S7

A Data Block (DB) offset is the numeric starting byte address of a variable within the controller's memory block. In SIMATIC S7-300, S7-400, and S7-410 controllers, data is byte-addressed starting at offset 0.0. A REAL data type occupies exactly 4 contiguous bytes (32 bits) formatted according to IEEE 754 floating-point standards (e.g., DBD 4 spans bytes 4, 5, 6, and 7). Understanding byte offsets is critical when configuring communication drivers (Modbus, OPC, BSEND/BRCV) that require explicit byte pointers to read and write floating-point values.

Memory Addressing and Byte Offset Principles in SIMATIC S7

In SIMATIC S7 programmable logic controllers (S7-300, S7-400, and S7-410), Data Blocks (DBs) are structured memory storage regions. Unlike high-level programming languages that abstract memory locations behind variable names, the underlying S7 CPU architecture relies strictly on physical memory byte offsets:
* Every Data Block begins at byte address 0.0 (DBB 0).
* An offset specifies the exact distance in bytes (and bits for Boolean values) from the very first byte of the data block to the start of a specific variable.
* For example, the designation DB10.DBD 8 indicates that the data begins at byte offset 8 of Data Block 10 and spans a Double Word (4 bytes: bytes 8, 9, 10, and 11).

Data Lengths and Memory Alignment of S7 Data Types

Different data types require specific amounts of memory and enforce alignment rules in classic S7 systems:

Data TypeBit LengthByte LengthS7 Address FormatExample AddressIEEE 754 FormatBOOL1 bit1/8 byteDBX [Byte].[Bit]DB1.DBX 0.0N/ABYTE / CHAR8 bits1 byteDBB [Byte]DB1.DBB 1N/AINT / WORD16 bits2 bytesDBW [Byte]DB1.DBW 2N/ADINT / DWORD32 bits4 bytesDBD [Byte]DB1.DBD 4N/AREAL32 bits4 bytesDBD [Byte]DB1.DBD 81 sign bit, 8 exp, 23 mantissa

Word Alignment Rules

In SIMATIC S7-300/400 memory architecture:
* 16-bit variables (INT, WORD) and 32-bit variables (DINT, DWORD, REAL) must align on even byte boundaries (offset 0, 2, 4, 6, 8...).
* If a Boolean variable (DBX 0.0) is followed immediately by an integer or real variable, the compiler inserts an internal padding byte so that the next integer begins at byte offset 2.0 (or real at 2.0 or 4.0).

Practical Application: Communication Pointers and Modbus Mapping

The concept of "offset into DB where real is located" is essential when configuring industrial communication drivers:
1. Modbus TCP / RTU Mapping:
* When using the MB_REDCL or MBTCP_Client block, the Job List (JOBLST) requires specifying the target destination pointer.
* If you poll a 32-bit floating-point power meter reading, you must configure the job to write into a specific byte offset (e.g., DB_Offset := 12). The block writes the 4-byte float into bytes 12, 13, 14, and 15 of the target DB.
2. ANY Pointer Construction in SCL:
* When configuring block transfers via BLKMOV (SFC 20) or S7 communication (BSEND / BRCV), an S7 ANY pointer encodes the starting byte offset as a 24-bit pointer in bytes 6 through 9 (e.g., P#DB10.DBX 8.0 BYTE 4).
3. OPC and SCADA Tags:
* Legacy OPC DA servers addressing S7 controllers directly address memory via byte offsets: S7:[Connection]DB10,REAL8.

Verification

In SIMATIC Manager, open any user Data Block in the LAD/FBD/STL Editor.
Switch to Declaration View (or tabular view).
Inspect the left-hand column labeled Address (Offset).
Observe that the first variable starts at 0.0, and each subsequent variable's offset increments exactly by the byte size of the preceding variable.
Switch the CPU to RUN and monitor the DB online. Confirm that floating-point values (e.g., 23.5 or 101.3) render correctly as REAL numbers at their designated offsets.

Limitations and Operational Precautions

Modifying variable declarations in an existing DB shifts the byte offsets of all subsequent variables. This can corrupt external Modbus maps, SCADA tag bindings, and HMI communication if tags are addressed by absolute offsets rather than symbolic names.
Be vigilant regarding Endianness: Siemens S7 controllers utilize Big-Endian byte ordering (most significant byte at the lowest address). Many third-party Modbus devices use Little-Endian or word-swapped formats, requiring high/low word swapping before interpreting floats.

Engineer FAQ

Can a REAL variable start at an odd byte offset (e.g., DBD 5)?
No. In S7-300 and S7-400 architecture, 32-bit variables must be aligned on even byte offsets (e.g., DBD 4, DBD 6, DBD 8).
How do I swap words if a Modbus REAL displays an incorrect number?
Use the standard SCL instruction ROR / ROL or swap words using the SWAP instruction in STL/CFC to realign the byte order.
Why does the DB offset show '0.0' instead of just '0'?
The .0 indicates the bit offset. For byte, word, and real variables, the bit offset is always .0. Only Boolean flags utilize bit offsets .1 through .7.

Technical References

SIMATIC STEP 7 V5.6 Statement List (STL) for S7-300 and S7-400 Programming Manual.
IEEE Standard 754-2008 for Floating-Point Arithmetic.
Siemens Industry Online Support Entry ID 109801081: Structure of the S7 ANY Pointer and Data Block Addressing.