PLC Addressing Explained: I/O Addresses, Memory, and Tags

Every physical signal that enters or leaves a PLC — a pushbutton, a proximity sensor, a motor contactor — must be mapped to a location in memory before your program can read or write it. That mapping is PLC addressing: the system that gives every I/O point and every internal memory location a unique, unambiguous name the CPU can find in microseconds.

Get addressing right and your program is readable, debuggable, and maintainable for the next engineer. Get it wrong and you introduce hard-to-trace faults, duplicate references, and hours of wiring-to-software mismatches during commissioning.

This guide walks through how addressing works from the physical rack to the symbolic tag, covering the two dominant conventions — Allen-Bradley and Siemens — and the modern shift away from numeric addresses toward tag-based systems.

---

What Is PLC Addressing?

PLC addressing is the method by which a controller's CPU identifies a specific piece of data — whether that data comes from a physical input module, is destined for a physical output module, or lives entirely in internal memory.

Every I/O point, timer, counter, data register, and flag has an address. When the PLC executes a rung or network, it reads the value stored at that address, evaluates the logic, and writes results back to the appropriate address. The address is the bridge between your ladder diagram and the real world.

Two broad models exist:

• Address-based (numeric): Locations are identified by a fixed notation tied to hardware position or memory area. Used in classic Allen-Bradley SLC/PLC-5 and all Siemens S7 families.
• Tag-based (symbolic): Locations are identified by a descriptive name that the compiler resolves to a physical address. Used in Allen-Bradley Logix5000 (Studio 5000 / RSLogix 5000) and Siemens TIA Portal with symbolic access enabled.

Both models accomplish the same goal; they just differ in how visible the underlying numeric address is to the programmer.

For a broader foundation, see PLC programming basics and fundamentals before diving deeper here.

---

Physical I/O Addressing: Rack, Slot, and Point

In a rack-mounted PLC system, hardware is organized in three levels:

Level	What it describes	Example
Rack	The physical backplane chassis	Rack 0, Rack 1
Slot	The module position within the rack	Slot 2, Slot 5
Point (bit)	The individual terminal on the module	Point 0 through Point 15

How rack/slot/point creates an address

When a field device is wired to terminal 3 on an input module sitting in slot 2 of rack 0, the PLC firmware can locate that exact bit using the notation Rack:Slot/Point. This three-part path is unambiguous — there is only one slot 2 in rack 0, and only one terminal 3 on that module.

Example address path:

I:1/4

Read as: Input file (I), slot 1, bit 4.

This notation is classic Allen-Bradley SLC-500 style, but the rack/slot/point concept underlies nearly every fixed and modular PLC on the market. The notation varies by vendor; the concept does not.

Why slot matters during commissioning

When a module is physically moved from slot 2 to slot 4 — perhaps because another module was added — every address referencing the old slot must be updated. In address-based systems this is a manual, error-prone task. It is one of the key motivations for tag-based addressing, where the tag name stays constant and only the underlying hardware assignment changes.

---

Memory Areas: Inputs, Outputs, Markers, and Data

A PLC's memory is divided into functional areas, each serving a distinct role in the scan cycle. Understanding these areas is essential for writing correct logic and for interpreting any manufacturer's addressing notation.

Input image (I / %I / PIW / E)

At the start of every scan cycle the CPU reads all physical input modules and copies their states into the input image table. Your program logic reads from this copy, not from the hardware directly. This ensures consistent data throughout a single scan.

• Allen-Bradley SLC: I:slot/bit
• Siemens S7: I0.0, IW2, ID4

Output image (O / %Q / PQW / A)

Logic writes results to the output image table during execution. At the end of the scan the CPU copies this image to the physical output modules. Again, this prevents partial updates mid-scan.

• Allen-Bradley SLC: O:slot/bit
• Siemens S7: Q0.0, QW2, QD4

Internal memory / markers (B / M / %M)

Internal bits and registers have no physical I/O counterpart. They hold intermediate calculation results, flags, latch states, and interlocks that exist purely in software.

• Allen-Bradley SLC: B3:0/0 (binary file 3, word 0, bit 0)
• Siemens S7: M0.0, MW10, MD20

Data / data blocks (N / DB)

Larger data structures — integers, floating-point values, strings, arrays, structures — live in dedicated data areas.

• Allen-Bradley SLC: N7:0 (integer file 7, element 0)
• Allen-Bradley Logix: Tags with DINT, REAL, BOOL data types
• Siemens S7: DB1.DBX0.0, DB1.DBW2, DB1.DBD4

Understanding these memory areas also informs how you use PLC data types, where data size and format map directly to the memory footprint of each address.

---

Allen-Bradley Addressing

Allen-Bradley (Rockwell Automation) has two distinct addressing worlds: the legacy file-based system used in PLC-5 and SLC-500, and the modern tag-based system used in all Logix5000 platforms.

Legacy file-based addressing (PLC-5 / SLC-500)

The legacy system organizes memory into numbered files, each with a type prefix:

File type	Prefix	Example	Meaning
Input	I	I:1/3	Slot 1, bit 3
Output	O	O:2/7	Slot 2, bit 7
Binary	B	B3:0/15	File 3, word 0, bit 15
Timer	T	T4:0.ACC	Timer 0, accumulated value
Counter	C	C5:1.PRE	Counter 1, preset value
Integer	N	N7:10	File 7, element 10
Float	F	F8:2	Float file 8, element 2

The colon separates file type from slot or element number. The forward slash separates word from bit. The dot separates element from sub-element (.ACC, .PRE, .DN, .EN).

Practical example — reading a start pushbutton at I:1/0 and sealing it with an output at O:0/0:

|--] [-- I:1/0 --|--] [-- O:0/0 --|--(  )-- O:0/0 --|
   START PB          OUTPUT SEAL       MOTOR RUN

This notation is still encountered daily on equipment installed in the 1990s and 2000s and still running in production environments worldwide.

Modern tag-based addressing (Logix5000 / Studio 5000)

ControlLogix, CompactLogix, and all Logix5000 platforms eliminate the file-based structure. Instead, every I/O point and data element is a tag — a named variable with a defined data type. Tags are stored in a controller tag database and can be organized into User-Defined Types (UDTs) and program-scoped or controller-scoped namespaces.

A Logix5000 I/O tag for slot 1 of a 16-point input module looks like:

Local:1:I.Data.0

But in practice, programmers alias this to a descriptive tag:

ConveyorStart_PB        BOOL

The program references ConveyorStart_PB throughout. The hardware assignment is made once in the I/O tree. If the module moves, only the alias mapping changes — not a single rung in the program.

For a complete walkthrough of the Logix5000 development environment, see the RSLogix 5000 / Studio 5000 programming guide.

---

Siemens Addressing

Siemens S7 addressing uses a compact, consistent notation that directly encodes the memory area, byte offset, and bit number into the address string.

Absolute addressing format

The general format is:

<Area><Byte>.<Bit>

For word and double-word access, the bit portion is dropped and a size modifier is added:

<Area><Size><Byte>

Area	Meaning	Bit example	Word example	DWord example
I	Process image inputs	I0.0	IW0	ID0
Q	Process image outputs	Q1.4	QW2	QD4
M	Bit memory (markers)	M10.3	MW20	MD40
DB	Data block	DB1.DBX0.0	DB1.DBW4	DB1.DBD8
L	Local (temp) data	L0.0	LW2	—

Reading a Siemens address

I0.3 means: process image input area (I), byte 0, bit 3.

MW20 means: marker word (M), starting at byte 20 (a 16-bit word).

DB5.DBD12 means: data block 5, double-word (32-bit) starting at byte offset 12 within that block.

Bit numbering runs 0–7 within each byte, with bit 0 being the least significant. Byte numbering is sequential from 0.

Symbolic addressing in TIA Portal

In Siemens TIA Portal, absolute addresses are supplemented — and increasingly replaced — by symbolic names entered in the PLC tag table. A tag ConveyorMotor_Run mapped to Q2.5 means the program reads ConveyorMotor_Run while the compiler writes Q2.5 to the CPU.

TIA Portal also supports optimized block access in data blocks, where Siemens manages the memory layout automatically and absolute byte offsets are no longer exposed to the programmer. This is the default for S7-1200 and S7-1500 data blocks.

For a detailed guide to TIA Portal workflows, see the TIA Portal programming tutorial.

---

Tag-Based vs Address-Based: Modern PLCs

The industry has moved decisively toward tag-based addressing over the past two decades. Understanding why helps you make better decisions on new projects and explains design choices in platforms you encounter.

Address-based systems: strengths and weaknesses

Strengths:

• Compact notation — experienced programmers read I:1/3 instantly
• Low memory overhead on constrained hardware
• Deterministic layout aids low-level diagnostics

Weaknesses:

• Addresses reveal hardware position, not intent — I:1/3 tells you nothing about what is wired there
• Moving a module requires a global search-and-replace
• Large programs become unreadable without separate I/O documentation
• Onboarding new engineers requires referencing I/O lists constantly

Tag-based systems: strengths and weaknesses

Strengths:

• Self-documenting — ConveyorEmergencyStop communicates intent immediately
• Hardware abstraction — remapping a tag does not touch program logic
• UDTs and arrays enable structured, scalable code
• Easier code reuse across similar machines
• Reduced wiring-to-software mismatch errors during commissioning

Weaknesses:

• Larger tag databases consume more memory
• Requires disciplined naming conventions to avoid a different kind of chaos
• Tag databases must be maintained as hardware changes

The verdict for new projects: Tag-based addressing is the correct choice for any new installation on a platform that supports it. The productivity and maintainability gains outweigh the modest overhead costs. Address-based notation remains relevant for maintaining legacy equipment.

---

Symbolic Naming and Best Practices

Whether you are using full tag-based addressing or adding symbolic aliases to an address-based system, naming discipline is the single biggest factor in long-term program maintainability.

Naming conventions that work in practice

Use a consistent structure. A widely adopted pattern is:

<Location>_<Device>_<Signal>

Examples:

• Conv01_StartPB_Input — Conveyor 1, start pushbutton, input bit
• Conv01_DriveRun_Output — Conveyor 1, drive run command output
• Mixer_TempHigh_Alarm — Mixer, high temperature alarm bit

Avoid abbreviations that are not industry-standard. PS could mean pressure switch or power supply. Write PressureSwitch or PwrSupply — be explicit.

Prefix by function area or equipment area. Group related tags alphabetically when the tag database is sorted.

Avoid numeric suffixes without context. Motor1, Motor2 tells you nothing about where these motors are or what they do. FeedConv_Motor and DischargeConv_Motor are immediately meaningful.

Data types and addressing precision

Match the data type to the signal:

• Digital (on/off) signals: BOOL
• Analog counts or small integers: INT / UINT
• Scaled engineering values: REAL / DINT
• Recipe parameters, set points: REAL or DINT with documented engineering units

Mismatched data types are a common source of scaling errors. A 4–20 mA analog input returns raw counts (0–32767 on a typical 15-bit module); without proper scaling the address holds a count, not degrees Celsius or bar. Document the scaling in tag comments or UDT descriptions.

---

Aliasing: Connecting Hardware to Software

Aliasing is the explicit act of mapping a descriptive tag name to a hardware I/O address. It is the core mechanism that gives tag-based addressing its hardware-independence.

How aliasing works in Studio 5000

In a Logix5000 project, every physical I/O module creates a set of automatically named I/O tags such as:

Local:1:I.Data.0    (first input bit on local chassis, slot 1)
Local:1:I.Data.1    (second input bit)

You create an alias tag:

Tag Name:    ConveyorStart_PB
Type:        ALIAS
Alias For:   Local:1:I.Data.0
Data Type:   BOOL
Description: Conveyor 1 start pushbutton — cabinet door, XB4-BA31

Every rung in your program uses ConveyorStart_PB. If the module moves to slot 3, you change the Alias For field once. The program logic is untouched.

How aliasing works in TIA Portal

TIA Portal's PLC tag table performs the same function. You define a symbolic name and assign it to an absolute address:

Name	Data type	Address	Comment
ConveyorStart_PB	Bool	I0.0	Conveyor 1 start pushbutton
ConveyorMotor_Run	Bool	Q2.5	Conveyor 1 motor run output
ConveyorSpeed_SP	Int	MW100	Speed setpoint (RPM)

Once defined, the program can reference either the symbolic name or the absolute address. Siemens best practice — and the default in TIA Portal — is to use symbolic names exclusively and hide absolute addresses.

The I/O list as the source of truth

The alias or tag table is only as reliable as the underlying I/O list. A well-maintained I/O list is the single source of truth for every physical signal in the system:

• Terminal number on the field device
• Cable number
• Junction box / marshalling cabinet terminal
• PLC module and terminal number
• PLC address or tag name
• Signal type (24 VDC digital, 4–20 mA analog, etc.)
• Description and P&ID reference

Keeping the I/O list synchronized with the tag database throughout commissioning prevents the most common root cause of troubleshooting failures: the program says one address, the drawing says another, and the wire goes somewhere else entirely.

For a look at the full development environment and project structure that manages this, see what is PLC programming.

---

Frequently Asked Questions

What is PLC addressing?

PLC addressing is the system that assigns a unique memory location to every I/O point and internal data element in a programmable logic controller. It allows the CPU to read physical inputs (sensor states, switch positions) and write to physical outputs (relay coils, drive commands) by referencing the corresponding address in its memory map.

What does rack/slot/point mean in PLC addressing?

Rack refers to the physical backplane chassis that holds the modules. Slot is the position of a specific module within that rack. Point (or bit) is the individual terminal on that module. Together, rack/slot/point provides a three-level path that uniquely identifies any field device terminal in the system.

What is the difference between Siemens and Allen-Bradley addressing?

Allen-Bradley's legacy SLC/PLC-5 systems use file-based notation with type prefixes (I:, O:, B3:, N7:) followed by slot and bit numbers. Siemens S7 systems use area/byte/bit notation (I0.3, Q2.5, M10.0, DB1.DBW4). Both Allen-Bradley Logix5000 and Siemens TIA Portal support symbolic (tag-based) addressing that largely replaces direct numeric notation in modern programs.

What is tag-based addressing in a PLC?

Tag-based addressing replaces numeric hardware addresses with descriptive named variables. Instead of referencing I:1/3, you reference ConveyorStart_PB. The tag compiler resolves the name to the underlying hardware address. This improves readability, simplifies hardware changes, and reduces errors when multiple engineers work on the same program.