Siemens S7-300 Operating Instructions Manual page 57

Direct write access to control signals
The byte addresses are defined with an offset to the input address of the module. The bit
names correspond to the names in the channel DB.
In STL, you access the data using the PQB (write 1 byte) and PQW (write 2 bytes)
commands.
Address
Byte 0
Byte 1
Byte 2
Byte 3
Example: Actual position value (ACT_POS)
The start address of the module is 512.
STL
L PID 516
FM 352 electronic cam controller
Operating Instructions, 05/2011, A5E01071724-03
7 6 5
0 CNTC1_EN CNTC0_EN
Programming the FM 352
7.10 High-speed access to module data
Bit number
4 3
Internal
CAM_EN DIR_P
TRACK_EN
Read the current actual position value
(ACT_POS) with direct access:
Module start address + 4
2 1 0
DIR_M 0 0
57