Where Reference Addresses come from?

[rbmafra]

Hallo Thomas 👋,

I really appreciate your effort in making the solution open source it has been very helpfull for me 🙏.

I've been working with the HMI runtime file (.fwc) and ran into some issues with symbolic addresses, as I couldn't map them to the corresponding PLC addresses. I found a reference address (e.g., 8A0E0038.2C.13.A.1) in the runtime file, but I couldn't locate it elsewhere. I knew it had to mean something, and thankfully, I came across your solution, which helped me map the addresses.

I have a question: Do you know if these addresses are stored in any specific file within the TIA project that I could parse? Out of curiosity, do you know exactly what these addresses represent? It seems that they are used for mapping internal addresses within connected Siemens systems, allowing, for instance, the HMI and PLC to recognize which addresses they are exchanging, even when dealing with symbolic and optimized blocks.

Is it possible to pass the reference address using S7CommPlus and retrieve the corresponding symbolic address? From what I understand about how the communication works, it seems unlikely, but it would be extremely helpful for me 😁.

Vielen Dank!

[thomas-v2]

In the early versions of TIA we tried to analyze the TIA project files. But it's not easy, and Siemens changes the project format with every TIA version. So I stopped working on it.

If you need the addresses, I'd take a look into the Scada Export Tool for TIA, which exports the data for Siemens WinCC Scada.
At least it exports a structure which should be the same format, as you can use the export file from different TIA versions in the same WinCC Scada version. But as it's done by Siemens, it's also not human readable, even when you may see json files in there.

What the address sequence represent, for your example: 8A0E0038.2C.13.A.1

8A0E0038 is the Base Area, where 8A0E stands for datablock, and 0038 is the datablock number in hexadecimal -> DB 56. Or you can see it as an offset of 2316173312, where 2316173313 = DB1 and so on. There are other base areas, like input (0x50), output (0x51) or marker (0x52)8a0.

The following numbers are the sequence of IDs. Each variable in an area gets an unique ID in the TIA engineering system. If I remember correctly, the ID does not change if you change the variable name, but changes if you change the datatype. If you delete a variable with ID 10 for example, and add a new one, you wont't get the 10, but a new ID (there must be an internal counter in the engineering system).

There's an option in the protocol to use a symbol checksum over the symbol names, which I don't use for now. Means, if you change the variable name in the PLC, you could still access the variable under it's ID sequence. If you are using the symbol checksum, access would fail.

Array variables have also an ID in this sequence, which always start at 0 for the first element, independant of the array declaration like array [-5..5]. Between the ID of a struct-array and the array index is a constant 1.

It's the same style of PLC address which you can see for example in Siemens WinCC Scada. I guess you won't find complete sequences in any TIA portal file, only the IDs for single variables in a struct level and you have to combine them on your own.

So I can only say about your address sequence, that it's addressing a variable inside DB56, and is nested inside 3 levels. Which may be inside 3 structs or arrays with possible more dimensions, or a mix of both.