Siemens S7 Address Converter
Decode %MW/%M/DB addresses, the bytes they cover, and overlaps.
Overlap — %MW100 and %MW101 share storage
%MW100 · %MW102 · %MW104 · %MW106
%MW99 · %MW101
This tool reads Siemens S7 address notation and tells you exactly which storage it occupies. Enter %MW100, %M10.3 or DB1.DBW20 and it returns the area, the access width, the byte range covered and the absolute bit index — then checks a second address for overlap. Reference: %MW100 covers bytes 100–101, so it overlaps %MW101 but not %MW102.
How it works
An S7 address is not an index into a list of variables. It names a byte offset inside a memory area, together with how many bytes to read from there. That single rule explains everything else: a word access covers two bytes and a double word covers four, so addresses of different widths — and even of the same width — can occupy the same storage. The tool turns the notation into the byte range it really means, which is the form you need when you are laying out a data block or matching a device's memory map.
The overlap check exists because the failure it catches is quiet. Nothing warns you that %MW100 and %MW101 share byte 101; the program compiles and downloads, and one value simply corrupts the other at runtime. Engineers coming from controllers whose registers are indexed one by one — where D100 and D101 are genuinely separate — meet this the hard way. Stepping words by two and double words by four is the fix, and the allocation list here generates that layout for you.
Worked example
%MW101 → area M, word, bytes 101–102
shared byte 101 · overlap
%MW102 → bytes 102–103 · no overlap
safe run of four: %MW100 · %MW102 · %MW104 · %MW106
Parameters
| Parameter | Value | Notes |
|---|---|---|
| %I / %E | Input area | E = Eingang |
| %Q / %A | Output area | A = Ausgang |
| %M | Bit memory | |
| DBx.DB… | Data block x | |
| X | Bit | bit number 0–7 |
| B | Byte | 1 byte |
| W | Word | 2 bytes, big-endian |
| D | Double word | 4 bytes, big-endian |
The arithmetic
/* S7 addressing in one line of arithmetic:
* an address = area + byte offset + access width
*
* width bytes covered
* X 1 (one bit inside it, 0-7)
* B 1
* W 2 offset .. offset+1
* D 4 offset .. offset+3
*
* absolute bit index = byte * 8 + bit %M10.3 -> 83
*
* Overlap test for two accesses in the same area:
* overlap = !(aLast < bFirst || bLast < aFirst)
*
* %MW100 -> 100..101
* %MW101 -> 101..102 shares byte 101 -> OVERLAP
* %MW102 -> 102..103 disjoint -> safe
*/FAQ
▸Do %MW100 and %MW101 overlap?
Yes. An S7 address names a byte offset, and a word is two bytes, so %MW100 occupies bytes 100 and 101 while %MW101 occupies bytes 101 and 102. They share byte 101, and writing one corrupts part of the other. Consecutive words step by two: %MW100, %MW102, %MW104. Double words step by four.
▸What does %M10.3 mean?
Bit 3 of byte 10 in the bit-memory area. The number before the dot is always a byte offset and the number after it is the bit within that byte, so it only runs 0 to 7 — %M10.8 does not exist. Counting from the start of the area, %M10.3 is absolute bit 83 (10 × 8 + 3).
▸How do I read DB1.DBW20?
Data block 1, word access, starting at byte 20 — so bytes 20 and 21 of that block. The same block also supports DBX (bit, written DB1.DBX20.3), DBB (byte) and DBD (double word). Two different data blocks never overlap each other, even at the same offset.
▸Why does my 32-bit value read back wrong?
Two common causes. Either the double word overlaps a neighbour — %MD100 covers bytes 100 to 103, so %MD102 collides with it — or the byte order is being reinterpreted. S7 stores words and double words big-endian (most significant byte at the lowest address); a device or driver expecting word-swapped order will show the halves the wrong way round.
▸Does it accept the German mnemonics?
Yes. E (Eingang) is read as I and A (Ausgang) as Q, so E0.0 and %I0.0 are the same address. The leading % is optional and case does not matter.
▸Is my data uploaded?
No. Every address is parsed locally in your browser.