PLC Address Entry — Complete Guide by Protocol

This reference collects, in one place and organized by protocol, the PLC address and data type / format fields that cause the most confusion on the tag registration screen. For details on each PLC, links point to the corresponding page in the Guide by PLC Type.

---

1. Common — the 4 fields on the registration form

The 4 fields you enter along with the PLC address on the tag registration screen (Tag Registration):

Field	Meaning	Example
PLC address	The raw address the driver sends to the PLC	D00309 (LS), D100 (Melsec), DB1.DBW0 (S7)
Data type	The type Java/JS receives	Integer / Long / Float / Double / String / Boolean
format (format helper)	Option that reinterprets the same address	DW / UI / REAL / STR[10] / BIN[3], etc.
formula (fomula)	Arithmetic expression applied after read	${VALUE}*0.1 / sqrt(${VALUE})

💡 format is the key: the same PLC address can be interpreted as 16-bit / 32-bit / floating point / string / bit. If format is left empty, a 16-bit signed integer is assumed (the default for most drivers).

---

2. LS XGT (XGI / XBC / XBM) — LS driver

Memory areas

Letter	Area	Commonly used
D	Data Register	✅ Data (most common)
M	Memory (bit)	✅ Status bits
K	Keep Relay (non-volatile)	✅ Retained on power loss
F	Flag	System bits
T	Timer	Timer current value
C	Counter	Counter current value
R	File Register	(depends on series)
P	I/O	External I/O

Notation examples

PLC value	Data type	format	Address example	Notes
16-bit signed	Integer	(empty)	D00309	default
16-bit unsigned	Integer	UI or UW	D00300	0–65535
32-bit signed	Integer	DW	D00600	D00600~D00601
32-bit unsigned	Long	UDW or DUW	D00690	0–4_294_967_295
64-bit signed	Long	(empty + dt=Long)	D00700	D00700~D00703
32-bit float	Float	REAL	D00450	IEEE 754
64-bit double	Double	LREAL	D00500	IEEE 754
Bit (M/K/F/T/C/P)	Boolean	(empty)	M02704	Bit area
Bit N of a word	Boolean	BIN[N]	D00309 (BIN[3])	Bit 3
String of N words (= 2N characters)	String	STR[N]	D00500 (STR[10])	low-byte-first
Byte	Integer	B or UB	D00100	1 byte

Details: LS Electric

---

3. Mitsubishi MELSEC (Q / L / iQ-R) — MELSEC driver

Memory areas

The devices the driver can read and write are limited to those below.

Letter	Area	Unit	Commonly used
D	Data Register	Word	✅ Most common
M	Internal Relay	Bit	✅
B	Link Relay	Bit	✅
X / Y	Input / Output	Bit	I/O
W	Link Register	Word
R	File Register	Word
T / C	Timer / Counter	Word	Current value
L	Latch Relay	Bit
F	Annunciator	Bit	Alarms
V	Edge Relay	Bit
S	Step Relay	Bit
Z	Index Register	Word

SD · SM · ZR cannot be read

System devices (SD / SM) and extended file registers (ZR) are not supported by this driver. Reads will fail even if you register them as tags. If you need system status values, copy them to the D area in the PLC program and read that address instead.

Notation examples

Data	Type	format	Address example
16-bit signed	Integer	(empty)	D100
16-bit unsigned	Integer	UW	D100
32-bit signed	Integer	DW	D100 (D100~D101)
32-bit unsigned	Long	UDW	D100
32-bit float	Float	REAL	D100
Bit	Boolean	(empty)	M100, B0010
String	String	STR[N]	D200 (N words)

⚠ The controller type (controller-type) option is on the registration form — because the device codes differ between the Q/L series and iQ-R. If set incorrectly, Wrong device code.

Details: Mitsubishi MELSEC

---

4. Siemens S7 (S7-300 / 400 / 1200 / 1500) — S7 driver

Memory areas

Area	Notation	Meaning
DB (Data Block)	DB<n>.DB<X>0	Most common — user-defined data block
M (Merker)	M<X>0	Internal memory
I (Input)	I<X>0 or E<X>0	Input
Q (Output)	Q<X>0 or A<X>0	Output
C / T	C0 / T0	Counter / Timer

<X> = data width:

• B = Byte (8-bit)
• W = Word (16-bit)
• D = DWord (32-bit, integer or float)
• X<bit> = Bit (e.g. M0.3)

Notation examples

Data	Type	format	Address example
16-bit signed	Integer	(empty)	DB1.DBW0
32-bit signed	Integer	DW	DB1.DBD0
32-bit float	Float	REAL	DB1.DBD4
Bit	Boolean	(empty)	DB1.DBX0.0 (bit 0 of byte 0 in DB1)
String	String	STR[N]	DB1.DBB0 (includes the S7 STRING header)

⚠ rack / slot option — the PLC's Rack / Slot numbers in TIA Portal (usually 0/1 or 0/2). If wrong, you get connection refused.

Details: Siemens S7

---

5. Modbus TCP — MODBUS driver

Areas / function codes

Area	Function code	Bit/Word	Notation
Coil	FC1 / FC5 / FC15	Bit	coil:<n>
Discrete Input	FC2	Bit (read-only)	discrete-input:<n>
Holding Register	FC3 / FC6 / FC16	Word	holding-register:<n>
Input Register	FC4	Word (read-only)	input-register:<n>

Notation examples

Data	Type	format	Address example
16-bit signed	Integer	(empty)	holding-register:1
16-bit unsigned	Integer	UI	holding-register:1
32-bit signed	Integer	DW	holding-register:1 (HR1+HR2)
32-bit float	Float	REAL	holding-register:1
32-bit float (byte-swap)	Float	REAL_BS	(depends on driver option)
Bit	Boolean	(empty)	coil:5
Input bit (read-only)	Boolean	(empty)	discrete-input:0

Address base — 1 or 0?

This varies by vendor (the Modbus slave's starting number). The gateway's MODBUS driver sends your input as-is in the PDU, so enter the PDU address from the slave manual directly.

Details: Modbus TCP

---

6. OPC-UA — OPCUA driver

NodeId notation

OPC-UA identifies items by NodeId — standard form:

ns=<NamespaceIndex>;s=<StringId>
ns=<NamespaceIndex>;i=<NumericId>
ns=<NamespaceIndex>;g=<GuidId>
ns=<NamespaceIndex>;b=<ByteStringId>

Notation examples

Server	NodeId	Notes
Kepware	ns=2;s=Channel1.Device1.Tag1	channel.device.tag
Ignition	ns=1;s=[default]Tag1/Sub	Tag path
PlantPulse built-in OPC-UA server	ns=2;s=SITE_00001.OPC_00303.TAG_TEST_00042	site.opc.tag
Numeric ID	ns=2;i=1234	Numeric ID

Data types

In OPC-UA the server itself owns the type — the gateway's 데이터 타입 / format are used only as interpretation hints. Generally:

Server node type	Register as	format
Int16 / Int32 / Int64	Integer / Long	(empty)
Float / Double	Float / Double	(empty)
Boolean	Boolean	(empty)
String	String	(empty)

Details: OPC-UA

---

7. AB EtherNet/IP / Logix — EIP / LOGIX drivers

Notation (based on Logix tag names — Symbol Addressing)

ControlLogix / CompactLogix are accessed directly by tag name:

Data	Type	format	Address example
DINT	Integer	DW	MyTag
INT	Integer	(empty)	Pump.Speed
REAL	Float	REAL	Tank.Level
BOOL	Boolean	(empty)	Motor.Run
STRING	String	(Logix STRING structure)	Recipe.Name
Array	(scalar)	(empty)	Array[5] (index directly)

Notation (PLC-5 / SLC-500 — Logical Addressing)

AB-ETH cards use a different form:

Data	Address example
Word	N7:0 (file 7, element 0)
Float	F8:0
Bit	B3:0/0

backplane / slot option — which slot the PLC occupies. 1 (CPU) is common.

Details: AB EtherNet/IP

---

8. HTTP push — HTTP driver (reverse direction)

The gateway does not read from the PLC — this is a mode where an external system pushes to the gateway.

Notation	Meaning
<area>/<key>	Free-form identifier — matched against the path sent by the external system

POST body example:

{ "tag_id": "TAG_OUTDOOR_TEMP", "value": "23.4" }

format / 데이터 타입 are simple storage metadata. The PLC address is an arbitrary key — name it freely according to the key the external system pushes.

Details: HTTP push

---

9. Motor Sense — MOTOR_SENSE driver (via OPC-UA)

Receives KOPENS Motor Sense devices over OPC-UA. Discovered automatically per asset.

Kind	Auto-filled PLC address
HEALTH INDEX	<ASSET_ID>.health.<metric>
SIGNAL	<ASSET_ID>.signal.<metric>

Manual entry is normally unnecessary — assets are discovered automatically.

Details: Motor Sense

---

10. OMRON FINS — FINS driver

Memory areas

Letter	Area
D	DM (Data Memory) — most common
H	Holding Relay
W	Work Area
A	Auxiliary
T / C	Timer / Counter
CIO	Core I/O

Notation examples

Data	Type	format	Address example
16-bit signed	Integer	(empty)	D100
32-bit signed	Integer	DW	D100
Float	Float	REAL	D100
Bit	Boolean	(empty)	H0.05 (bit 5 of word 0)

Network/Node/Unit options — routing information in the FINS header (SA1 / DA1, etc.). Configure according to the PLC manual.

---

11. PANASONIC MEWTOCOL — MEWTOCOL driver

Memory areas

Letter	Area
DT	Data Register
R	Internal Relay
X / Y	Input / Output
T / C	Timer / Counter

Notation examples

Data	Type	format	Address example
16-bit signed	Integer	(empty)	DT0
32-bit signed	Integer	DW	DT0
Bit	Boolean	(empty)	R0.0

---

12. FATEK FACON — FATEK driver

Memory areas

Letter	Area
R	Register (Word)
M / Y / X	Memory / Output / Input (Bit)
D	Discrete

Notation examples

Data	Type	format	Address example
16-bit signed	Integer	(empty)	R0
Bit	Boolean	(empty)	M0, Y10

---

13. GE SRTP — GE driver

Memory areas (GE Fanuc / Emerson PACSystems)

Letter	Area
R	Register
AI / AQ	Analog Input / Output
I / Q	Discrete Input / Output
M	Internal

Notation examples

Data	Type	format	Address example
16-bit signed	Integer	(empty)	R1
32-bit signed	Integer	DW	R1
Float	Float	REAL	R1
Discrete	Boolean	(empty)	I1

---

14. EMERSON DELTAV — DELTAV driver (planned)

DeltaV DST (Data Service Tag) or I/O reference notation:

Notation	Meaning
MODULE/PARAMETER.FIELD	e.g. MOD01/AI1.PV

Before the official driver is implemented — going through an OPC-UA or OPC-DA gateway (Kepware) is recommended.

---

15. AB EtherNet (PLC-5 / SLC-500) — AB-ETH driver

Same as the PLC-5/SLC-500 notation section in 7. EIP / Logix:

Area	Notation
Word	N7:0
Float	F8:0
Bit	B3:0/0
Output	O:0/0
Input	I:0/0

---

16. Beckhoff TwinCAT/ADS — ADS driver (planned)

TwinCAT variable name notation (symbol-based):

Data	Notation example
Variable	MAIN.PumpSpeed
Array	MAIN.Tanks[5].Level
Struct	GVL.Recipe.Name

Additional NetID + Port options (usually 851 for PLC1).

---

17. PROFINET — PROFINET driver (planned)

Slot/Subslot-based notation for Siemens / generic Profinet IO:

Notation	Meaning
<slot>/<subslot>/<index>	e.g. 1/1/0

A real-time control protocol — the gateway will support non-real-time reads only.

---

18. CANopen — CANOPEN driver (planned)

CANopen OD (Object Dictionary) notation:

Notation	Meaning
<index>:<sub>	e.g. 0x6041:0 (Statusword)

Requires a CAN bus interface card (USB-CAN / PCIe-CAN).

---

19. BACnet/IP — BACNET driver (planned)

BACnet object notation:

Notation	Meaning
<object-type>:<instance>.<property>	e.g. analog-input:1.present-value
Object types	analog-input / analog-output / analog-value / binary-input / binary-output / binary-value / multi-state-*

Building automation / HVAC / lighting domain.

---

20. KNXnet/IP — KNXNET driver (planned)

KNX Group Address (3-level) notation:

Notation	Meaning
<main>/<middle>/<sub>	e.g. 1/0/5 (lighting channel 5)
DPT (Data Point Type)	DPT_Switch / DPT_Value_Temp, etc.

Building automation standard (mainly EU).

---

21. Open Protocol (Atlas Copco) — OP driver

Based on tightening (screwdriver / torque controller) result messages:

Notation	Meaning
MID:<msg-id>.<param>	e.g. MID:0061.tightening_id (tightening result ID)
Common MIDs	0001 (communication start) / 0030 (parameter set) / 0061 (tightening result)

Specialized for line tightening / assembly processes — interfaces with a controller, not a PLC.

---

22. format options — combined table for all drivers

Values commonly entered in the format helper field of the registration form. Support varies by driver:

format	Meaning	Supporting drivers
(empty)	16-bit signed integer (default for most)	All
B	8-bit signed byte	LS / Melsec
UB	8-bit unsigned byte	LS / Melsec
UI / UW / UWORD	16-bit unsigned word	LS / Melsec / Modbus
DW	32-bit signed dword	LS / Melsec / S7 / Modbus / EIP / Logix
UDW / DUW / UDWORD	32-bit unsigned dword	LS / Melsec / Modbus
UL	64-bit unsigned long	LS
REAL	32-bit float (IEEE 754)	All
LREAL	64-bit double	LS / S7
STR[N]	String of N words / N bytes	LS (words) / Melsec / S7 / Modbus
BIN[N]	Extract bit N of a word	LS
X or BIT	Bit (synonym for Boolean)	LS / Modbus

If the option does not match exactly, matching is done case-insensitively and with whitespace removed. dw / Dw / D W are all recognized as DW.

---

23. Common pitfalls — applies to all drivers

Symptom	Cause / resolution
A 32-bit value shows a completely different number	format left empty → interpreted as 16-bit. Specify DW or REAL
Floating-point value is 0 or NaN	Byte order (endianness) issue. Try REAL_BS (byte-swap) or the fomula swap32
A bit is always false	Bit notation used on a word area (D) — use a bit area (M/B/coil:) or BIN[N]
Garbled string characters	Difference between low-byte-first and high-byte-first. LS handles this automatically; S7 STRING includes a header — get the STR[N] length exactly right
Wrong device code (Melsec)	controller-type set incorrectly for Q/L vs iQ-R. Change it on the form and restart OPC
BadTypeMismatch (OPC-UA)	The registered data type differs from the server node type. Match it to the server-side type
connection refused (S7)	Wrong rack / slot. Verify the exact values in TIA Portal
All tags read 0	The address area is correct but the PLC is not publishing that address. Check the PLC program logic that writes values to that memory

---

24. Learn more

• Registration procedure (preparation + step by step): Add a New PLC Connection
• Tag registration (single / CSV): Tag Registration
• Monitoring after registration: Connection List / Tag List
• Details per PLC: Guide by PLC Type
• Driver internals: Advanced → Driver Technical Reference