PLC indirect addressing is one of the most powerful and versatile techniques available to automation engineers and programmers. By allowing a program to dynamically reference memory locations rather than hardcoding them, indirect addressing enables the creation of scalable, flexible, and efficient control logic. Whether you are designing a complex manufacturing line, a batch process, or a packaging system, mastering indirect addressing can dramatically reduce programming time and simplify maintenance.
In this comprehensive guide, we will explore the fundamentals of indirect addressing in PLCs, compare it to direct addressing, examine real-world applications, and provide practical examples from major PLC platforms such as Allen-Bradley (Rockwell), Siemens, and Mitsubishi. By the end, you will have a deep understanding of how to leverage indirect addressing in your own automation projects.
What Is PLC Indirect Addressing?
In a typical PLC program, instructions reference fixed memory locations such as inputs (I), outputs (Q), or memory registers (M, D, or N). This is known as direct addressing, where the address of the operand is explicitly written into the instruction. For example, an instruction may read from I0.1 or write to Q0.3.
Indirect addressing, on the other hand, uses a pointer—a variable that holds the address of another memory location. Instead of writing the actual address into the instruction, the programmer writes the pointer. The PLC then reads the pointer to determine which actual memory location to access. This dynamic approach allows the same instruction to operate on many different addresses, simply by changing the value of the pointer.
Direct Addressing vs. Indirect Addressing
Understanding the difference between direct and indirect addressing is critical for any PLC programmer. The table below summarizes the key distinctions:
| Feature | Direct Addressing | Indirect Addressing |
|---|---|---|
| Address Source | Hardcoded in the instruction | Stored in a pointer variable |
| Flexibility | Low — fixed at compile time | High — changeable at runtime |
| Code Size | Larger for repetitive tasks | Compact — same code handles many addresses |
| Maintenance | Difficult for large repetitive systems | Easier — modify the pointer instead of the code |
| Common Use Cases | Simple on/off control, fixed I/O mapping | Recipe management, data logging, indexing, batch processing |
How PLC Indirect Addressing Works
The core concept behind indirect addressing is the pointer. A pointer is a memory location that holds the address of another memory location rather than a data value. When the PLC executes an instruction using indirect addressing, it follows this process:
- Read the pointer value — The CPU reads the value stored in the pointer register.
- Resolve the target address — The pointer value is interpreted as the address of the actual memory location to be accessed.
- Perform the operation — The instruction reads from or writes to the resolved target address.
- Update the pointer — In many cases, the pointer is incremented or modified to point to the next location, enabling sequential operations.
For example, if a pointer contains the value 50, and the instruction is configured to use indirect addressing on a data register, the PLC will access D50. If you later change the pointer to 100, the same instruction will access D100—without modifying the program itself.
Indirect Addressing in Major PLC Platforms
Different PLC manufacturers implement indirect addressing with slightly different syntax and conventions. Here is a quick comparison:
| PLC Brand | Pointer Notation | Example Syntax |
|---|---|---|
| Allen-Bradley (ControlLogix/CompactLogix) | Tag-based with array indexing | MyArray[index] |
| Siemens (S7-1200/1500) | P# / ANY pointers, array indexing | DB1.DB[index] |
| Mitsubishi (GX Works) | Z register indexing | D0Z0 |
| Omron (CX-Programmer) | Indirect address using IR/SR registers | D[DM0] |
Example: Allen-Bradley Indirect Addressing
In Allen-Bradley ControlLogix systems, indirect addressing is typically achieved through the use of arrays. If you have a tag called Recipe_Data[0..99] (an array of 100 real numbers), you can dynamically access any element using a variable index:
- Create a tag Index (DINT type) to hold the array position.
- Use Recipe_Data[Index] in your logic to read or write the value.
- Increment Index in a loop or counter to traverse the array.
Example: Siemens S7 Indirect Addressing
In Siemens S7-1200 and S7-1500 PLCs, indirect addressing is performed using array indexing or pointer arithmetic. A common pattern is:
- Declare a data block (e.g., “Recipe”) containing an array Values : ARRAY[1..50] OF REAL.
- Use an integer tag i as the index.
- Access any element via “Recipe”.Values[i].
Common Applications of Indirect Addressing
Indirect addressing is used in a wide variety of industrial automation scenarios. Some of the most common applications include:
- Recipe Management — Storing and retrieving production parameters for different products without changing the program.
- Sequential Operations — Iterating through a series of valves, motors, or sensors in a defined order.
- Data Logging and Reporting — Storing historical data in arrays and processing them dynamically.
- Shift Registers and FIFO Buffers — Implementing queueing systems using pointer manipulation.
- Trailer Tracking and Sorting Conveyors — Following packages through multiple zones using dynamic pointer updates.
- Alarm and Event Management — Storing the most recent alarms in a circular buffer for display on an HMI.
Benefits of PLC Indirect Addressing
Implementing indirect addressing in your PLC programs offers several significant advantages:
- Reduced Code Size — Instead of writing dozens or hundreds of nearly identical rungs, you can write a single block of code that handles many cases.
- Improved Maintainability