Professional Documents
Culture Documents
Siemens Simatic Step 7 Programmers Handbook
Siemens Simatic Step 7 Programmers Handbook
1/63
7/26/12
digging in.
Training Material
Theres gold in that website if you just do a little digging! If youre having a tough go with the manuals then
you should definitely download the training material. Theres a lot more screen shots and even a picture of
a balding pudgy guy to point things out to you. What more could you want?
Flash Tutorials
www.plcdev.com/book/export/html/373
2/63
7/26/12
If youre not the manual type (and even if you are) check out the Siemens Step 7 Flash tutorials. These
are very professionally done with a nice sounding narrator to take you through all the basics of the Step 7
software and hardware.
What's Next?
Of all the starting places to dig for more info I find the support section the best especially if you have a part
number or key word you can search on. Clicking on the Product Support link will bring up a tree on the
left hand side that can be expanded down to the product of your affection. Good luck and happy hunting.
www.plcdev.com/book/export/html/373
3/63
7/26/12
First Impressions
For a user of the regular STEP 7 software the first thing to notice is there is no SIMATIC Manager. Thats
because the Lite version doesnt support multi-projects or networking. The STEP 7 Lite software opens
right up to the editor screen.
www.plcdev.com/book/export/html/373
4/63
7/26/12
The overall aim of the Lite package was to make the interface easier for new users. I think theyve done
that while making it friendlier for everyone involved. The added graphics and color are a welcome addition.
Another nice friendly feature is the extended hover help on the menus and icons where clicking on the tool
tip expands it into more help text. On that note all the pop up dialogs are clearer then its STEP 7
counterpart.
One of the major differences can be seen on the left hand side window. Pretty much everything the
programmer needs for maintaining the project is neatly organized here. Theres even a convenient thumb
tack to pin it or make it automatically slide in and out when needed.
On the right hand side is the old familiar tree structure of commands and blocks. Its missing the quick little
reference help window on the bottom which has been replaced by just hovering your mouse over the
command to get a fuller title (the F1 key works just the same too). The FC and FB blocks have been
moved from here to a more logical place in the project window on the left hand side.
5/63
7/26/12
Its also nice to have all the blocks clearly color coded and nicely arranged.
You can drag and drop then anywhere in the list. Theres even a new feature
of Category which is simply an organizational label inserted between blocks.
In this screen Ive inserted the category Engine Data and Special Data.
This could be really helpful for logically grouping blocks in larger projects.
I also like the new way of creating blocks. From the pull down menu select
Insert | Block and this nifty dialog box pops up with all the selections on it.
Even the OB selection has a nice drop down box of all the OBs available with
its symbolic name.
www.plcdev.com/book/export/html/373
6/63
7/26/12
The Editor
Much of the editor is like its big sister STEP 7. One noticeable part thats missing in action is the detail
view that gives quick access to info, cross reference, address info, etc. One part I like is a slight revamp of
the declaration table. Instead of the tree like structure its one simple table with a column indicating its
declaration. That means no having to dig through the tree just to see all the declaration variables.
www.plcdev.com/book/export/html/373
7/63
7/26/12
Conclusion
Other then what weve all ready listed there are no other major differences. The symbol table,
monitor/modify (a.k.a. VAT), and the reference data are all very similar to STEP 7. Overall, if you can live
with the limitations, the STEP 7 Lite version is a great little package. Hopefully some of the better
implementations will find there way into the STEP 7 software.
P.S. One little caveat is that it kept crashing on my plenty beefy enough Windows XP Home
computer. Save often, arrgh!
www.plcdev.com/book/export/html/373
8/63
7/26/12
3. An Ethernet cable
www.plcdev.com/book/export/html/373
9/63
7/26/12
The CP5512 card and the PC Adapter can communicate on either an MPI or PROFIBUS port. Note that
PROFIBUS is labeled as DP on the Siemens connection ports. These cables can piggyback on existing
connectors. Be aware that the PC Adapter draws its power to work from the connection port so check
the power LED for proper operation. The CP5512 card draws its power from the computer.
For Ethernet (TCP/IP) use a standard Ethernet cable from the computer to a CPU with an Ethernet port, a
CP 343/443 module or a network switch all ready attached to the PLC network.
Checking Communications
With the programming cable plugged in, you can check for proper operation by clicking on the Accessible
Nodes icon.
If communications are successful, you'll see a window pop up similar to the one below. If so, then close the
Accessible Nodes window and proceed to the download or upload section.
www.plcdev.com/book/export/html/373
10/63
7/26/12
This indicates that the cable is not in the right computer port or the cable is not plugged in properly.
The following dialog box will open up displaying all the different interfaces (i.e. communication drivers).
www.plcdev.com/book/export/html/373
11/63
7/26/12
Each cable has its own interface. For Ethernet select the TCP/IP interface for your computers network
card. Be careful not to select your wireless Ethernet connection.
To get it working quickly it is best to select the interface with the Auto designation. This will discover
working settings and use them automatically.
For the PC Adapter click on the Properties button and make sure the Station Parameters Address is a
unique network address. It should not conflict with existing PLC and slave devices on the network. Also,
check under the Local Connection tab and make sure connection selection matches the port the cable is
connected into.
Once the proper interface is selected and the properties are set then click OK and use the Accessible
Nodes window to check for successful communications. It should work. If not double-check the
connection and cable. With the CP5512 and PC Adapter cables, you should use the MPI port, as this is
the default connection for Siemens.
If this doesn't work then I don't know what to tell you.
Downloading
First, in order to enable the download menu commands, you must select the Block folder in the project's
station you wish to download.
www.plcdev.com/book/export/html/373
12/63
7/26/12
Partial Download
Partial downloads are used in existing projects where only one or more blocks will be downloaded. To
perform this type of download select the block(s) you wish to download and then select the PLC >
Download menu item or the download button
Holding down the Ctrl key or the Shift key allows more then one block to be selected at a time. Be careful
though as the order of download will occur in the order that the blocks were selected. This may mean that
an error will occur if a block is called before it is downloaded.
The CPU will need to be in Stop mode before downloading the System Data Block (SDB) as this is
equivalent to a hardware configuration download. This is usually not necessary in a PLC that has all ready
had its hardware configured. If you do download the system data, the following messages will prompt you
through the transitions.
www.plcdev.com/book/export/html/373
13/63
7/26/12
If the CPU is in Run mode then you will be prompted to Stop the CPU. The software will do the Run to
Stop transition when you click OK.
After downloading the SDB you will be prompted to Run the CPU again.
Clicking Yes will automatically put the CPU back into run mode.
Full Download
To download all the blocks at once make sure you are in the Block folder and select the Edit > Select All
menu item. Click on the Download icon
. You will be prompted to overwrite any existing blocks and if
you want to load the system data (see above).
www.plcdev.com/book/export/html/373
14/63
7/26/12
The following dialog box will pop up prompting you about the deletion of all the blocks and project data in
the PLC. Click Yes to perform the operation.
Uploading
There are two methods for uploading. The first is when you have the original project and you want to
preserve the symbols and comments. The second method, when you don't have the original project, will
upload everything from the CPU but will have no associated documentation (i.e. symbols and comments).
www.plcdev.com/book/export/html/373
15/63
7/26/12
This will open up another window called the Online Partner. It shows the existing blocks inside the CPU.
The Online version is indicated by the highlighted title bar.
www.plcdev.com/book/export/html/373
16/63
7/26/12
There is a connection between these two versions so that uploading from the online partner makes sure to
preserve all the symbols and comments. Be careful. After uploading, make sure to close the online partner
and do all work from the offline version.
To upload individual blocks, select them in the Online view and choose the PLC > Upload to PG menu
item. For a full upload, select the Block folder and do the same.
17/63
7/26/12
In the next screen, fill in the slot the CPU is in (this is always 2 for S7-300) and the node address of the
communication port on the CPU. In the case below we are talking to a CPU over MPI with node address
10.
After clicking OK, the whole contents of the PLC including all blocks and hardware configuration will be
uploaded into a new station in the project.
www.plcdev.com/book/export/html/373
18/63
7/26/12
While this project contains no documentation, it can be used as a backup to download later if needed.
STEP 7
Professional
STEP 7
Configuring
PLCs
S7-300/C7
S7-300/S7-400/C7/WinAC
Digital, analog
I/O, IFM
centralized only
Networking/communications
No
Distributed I/O
No
Yes
No
Yes
Yes, in CPU
only
Modules
www.plcdev.com/book/export/html/373
19/63
7/26/12
Export/import
Program,
symbols
Documentation function
Included
Multi-language documentation
of projects
Yes
Yes
Multi-user engineering
No
Yes
Programming
Languages
LAD/FBD/STL
LAD/FBD/STL and
STL sources
As Step 7
+ S7-Graph
(sequencer)/S7-SCL
(textual high-level
language)
Structured/symbolic
programming
Yes/Yes
Yes/Yes
Check/establish program
consistency
Yes/Yes
Yes/Yes
Yes/No
Yes/Yes
Online access
MPI
Test functions
Monitor,
control, force
Comparison function
offline/online
Program,
hardware
configuration
Program
Online functions
www.plcdev.com/book/export/html/373
20/63
7/26/12
Diagnostics
System
diagnostics
Optional packages
Optional programming
languages
None
S7-Graph, S7-SCL,
S7-HiGraph, CFC
S7-PLCSIM, S7S7-PLCSIM,
Teleservice, S7S7-Teleservice
DOCPRO, S7-Pdiag
S7-HiGraph, CFC
Terminology
Offline program The program that is stored on the hard disk of the computer. This will contain the
documentation. Its very important to keep a pristine copy of the offline program as the associated
documentation is not stored in the PLC.
Online program This is the program resident in the PLC.
Download The act of taking the offline program on the computer and downloading it into the PLC.
Upload Taking the program in the PLC and bringing it up to the computer. Doing this without having the
associated offline program open will cause a loss of documentation.
www.plcdev.com/book/export/html/373
21/63
7/26/12
Save Stores the open block onto the hard drive. Its important to realize that an edited block can be
downloaded to the PLC without saving it offline. Note that this only saves the opened block and not any
others that are concurrently open.
These may seem like simple terms but its important to understand how theyre used in the Siemens
environment.
Here are some other terms that may come up.
PG/PC This is Siemens way of referring to a PC or laptop running the SIMATIC software.
Nodes Refers to any programmable device (in our case a PLC) in the network which will have its own
unique address.
Best Practice
The best practice is to make sure you are working from an offline file. There really isnt any reason to be
working on the program inside the PLC. Of course, this assumes that you have a good working copy to
begin with. The golden copy of the program should live somewhere on a network server or have a
dedicated place on one computer or laptop. Ive even heard of some companies using USB memory
sticks to store the latest and greatest which is great but an original copy should still live on a computer that
is backed up.
1. Open the offline file from the File pull down menu and select Open or use the Open
Project icon
on the toolbar. In the dialog box select the project under the User Project
tab. Click OK. You may have to select Browse to find it in the directory structure. Note if the
Manager was closed with a project open then it will open back up to that project automatically.
2. Expand the project tree down to the program files and select the Blocks folder. Good
www.plcdev.com/book/export/html/373
22/63
7/26/12
www.plcdev.com/book/export/html/373
23/63
7/26/12
These dialog boxes are telling you that it cannot find the documentation for the local parameters and
symbols. More then likely it will also not show any network comments or titles.
The result of opening the block looks like this
www.plcdev.com/book/export/html/373
24/63
7/26/12
This is an example void of documentation. Notice the local parameters all say TEMP. There are no
comments or titles. There are no symbols so its all in direct addressing. The properly documented copy
looks like this...
www.plcdev.com/book/export/html/373
25/63
7/26/12
www.plcdev.com/book/export/html/373
26/63
7/26/12
Conclusion
Programming with SIMATIC Step 7 is different enough from other types of PLCs to throw off the casual
user. Always working from the offline copy will make it less likely to screw up. Opening up a block from
the accessible nodes window is always a no-no. Likewise, opening a block from a window that has a
highlighted blue title bar will also cause potential problems. Be sure and read all dialog boxes especially
the ones weve shown in the article. Avoid the pitfalls and keep that documentation. Mystery solved.
Footnote:
(1) Siemens dialog boxes have an option that says, Do not display this message again. This is handy for
www.plcdev.com/book/export/html/373
27/63
7/26/12
some annoying pop ups but it is really not a good idea to turn off important ones like warnings for
overwriting blocks. These warnings are especially crucial if you are working on real machinery. If more
then one person is using the software then you can reset these messages to display again by going to the
SIMATIC Manager and select the menu Options | Customize. Click the General tab and press the
Activate button. If its grayed out then all messages are set to display.
S7 Library Functions
I couldn't find a complete listing of all the function blocks in the standard Siemens S7 Libraries so I made
one myself. It helps me get a better overview of what is available. The complete listing is also available as
an Excel spreadsheet so you can sort or adjust to your needs.
Family
Description
SFB 0
CTU
IEC_TC
Count Up
SFB 1
CTD
IEC_TC
Count Down
SFB 2
CTUD
IEC_TC
Count Up/Down
SFB 3
TP
IEC_TC
Generate a Pulse
SFB 4
TON
IEC_TC
Generate an On Delay
SFB 5
TOF
IEC_TC
SFB 8
USEND
SFB 9
URCV
SFB 12
BSEND
SFB 13
BRCV
SFB 14
GET
SFB 15
PUT
SFB 16
SFB 19
START
SFB 20
STOP
SFB 21
RESUME
SFB 22
STATUS
SFB 23
USTATUS
SFB 29
HS_COUNT COUNTERS
SFB 30
FREQ_MES COUNTERS
www.plcdev.com/book/export/html/373
28/63
7/26/12
SFB 32
DRUM
TIMERS
SFB 33
ALARM
SFB 34
ALARM_8
SFB 35
SFB 36
NOTIFY
SFB 37
AR_SEND
SFB 38
HSC_A_B
COUNTERS
SFB 39
POS
ICONT
SFB 41
CONT_C
ICONT
SFB 42
CONT_S
ICONT
SFB 43
PULSEGEN ICONT
SFB 44
ANALOG
TEC_FUNC
SFB 46
DIGITAL
TEC_FUNC
SFB 47
COUNT
TEC_FUNC
SFB 48
FREQUENC TEC_FUNC
SFB 49
PULSE
TEC_FUNC
SFB 52
RDREC
DP
SFB 53
WRREC
DP
SFB 54
RALRM
DP
Receiving an Interrupt
SFB 60
SEND_PTP
TEC_FUNC
SFB 61
RECV_PTP
TEC_FUNC
www.plcdev.com/book/export/html/373
Implement a Sequencer
29/63
7/26/12
SFB 62
RES_RECV
TEC_FUNC
SFB 63
SEND_RK
TEC_FUNC
SFB 64
FETCH_RK TEC_FUNC
SFB 65
SERVE_RK
TEC_FUNC
SFB 75
SALRM
DP
SFB 81
RD_DPAR
IO_FUNCT
Family
Description
SFC 0
SET_CLK
CLK_FUNC
SFC 1
READ_CLK
CLK_FUNC
SFC 2
SET_RTM
CLK_FUNC
SFC 3
CTRL_RTM
CLK_FUNC
SFC 4
READ_RTM
CLK_FUNC
SFC 5
GADR_LGC
IO_FUNCT
SFC 6
RD_SINFO
DB_FUNCT
SFC 7
DP_PRAL
DP
SFC 9
EN_MSG
SFC 10 DIS_MSG
SFC 11 DPSYC_FR
DP
SFC 12 D_ACT_DP
DP
SFC 14 DPRD_DAT
DP
SFC 15 DPWR_DAT DP
SFC 17 ALARM_SQ
SFC 18 ALARM_S
SFC 19 ALARM_SC
www.plcdev.com/book/export/html/373
30/63
7/26/12
SFC 20 BLKMOV
MOVE
Copy Variables
SFC 21 FILL
MOVE
SFC 22 CREAT_DB
DB_FUNCT
SFC 23 DEL_DB
DB_FUNCT
SFC 24 TEST_DB
DB_FUNCT
SFC 25 COMPRESS
DB_FUNCT
SFC 26 UPDAT_PI
IO_FUNCT
SFC 27 UPDAT_PO
IO_FUNCT
SFC 28 SET_TINT
SFC 29 CAN_TINT
SFC 30 ACT_TINT
SFC 31 QRY_TINT
SFC 32 SRT_DINT
SFC 33 CAN_DINT
SFC 34 QRY_DINT
SFC 35 MP_ALM
SFC 36 MSK_FLT
DIAGNSTC
SFC 37 DMSK_FLT
DIAGNSTC
SFC 38 READ_ERR
DIAGNSTC
SFC 39 DIS_IRT
IRT_FUNC
SFC 40 EN_IRT
IRT_FUNC
SFC 41 DIS_AIRT
IRT_FUNC
SFC 42 EN_AIRT
IRT_FUNC
SFC 43 RE_TRIGR
SFC 44 REPL_VAL
DIAGNSTC
SFC 46 STP
SFC 47 WAIT
SFC 48 SNC_RTCB
CLK_FUNC
SFC 49 LGC_GADR
IO_FUNCT
SFC 50 RD_LGADR
IO_FUNCT
SFC 51 RDSYSST
DIAGNSTC
www.plcdev.com/book/export/html/373
31/63
7/26/12
SFC 54 RD_PARM
IO_FUNCT
SFC 55 WR_PARM
IO_FUNCT
SFC 58 WR_REC
IO_FUNCT
SFC 59 RD_REC
IO_FUNCT
SFC 60 GD_SND
SFC 61 GD_RCV
SFC 62 CONTROL
SFC 63 AB_CALL
PLASTICS
SFC 64 TIME_TCK
CLK_FUNC
SFC 65 X_SEND
SFC 66 X_RCV
SFC 67 X_GET
SFC 68 X_PUT
SFC 69 X_ABORT
SFC 70 GEO_LOG
IO_FUNCT
SFC 71 LOG_GEO
IO_FUNCT
SFC 72 I_GET
SFC 73 I_PUT
SFC 74 I_ABORT
SFC 78 OB_RT
DIAGNSTC
SFC 79 SET
BIT_LOGC
SFC 80 RSET
BIT_LOGC
www.plcdev.com/book/export/html/373
32/63
7/26/12
SFC 81 UBLKMOV
MOVE
SFC 82 CREA_DBL
DB_CTRL
SFC 83 READ_DBL
DB_CTRL
SFC 84 WRIT_DBL
DB_CTRL
SFC 85 CREA_DB
DB_FUNCT
SFC 87 C_DIAG
SFC 90 H_CTRL
HF_FUNCT
SFC
100
SET_CLKS
CLK_FUNC
SFC
101
RTM
CLK_FUNC
SFC
102
RD_DPARA
IO_FUNCT
Redefined Parameters
SFC
103
DP_TOPOL
DP
SFC
104
CIR
SFC
105
READ_SI
SFC
106
DEL_SI
SFC
107
SFC
108
ALARM_D
SFC
112
PN_IN
PROFIne2
SFC
113
PN_OUT
PROFIne2
SFC
114
PN_DP
PROFIne2
Update DP interconnections
SFC
126
SYNC_PI
IO_FUNCT
SFC
127
SYNC_PO
IO_FUNCT
www.plcdev.com/book/export/html/373
33/63
7/26/12
Family
FC 61
GP_FPGP
FC 62
GP_GPFP
FC 63
GP_ADD
FC 64
GP_SUB
FC 65
GP_MUL
FC 66
GP_DIV
FC 67
GP_VGL
FC 68
RAD_GP
FC 69
MLD_TG
FC 70
MLD_TGZ
FC 71
MLD_EZW
FC 72
MLD_EDW
FC 73
FC 74
MLD_SAM
FC 75
MLD_EZ
FC 78
MLD_EDWK S5_CNVRT Message of first value with double flashing light, wordwise,
A+M
FC 79
MLD_EZK
S5_CNVRT Message of first value with single flashing light, bitwise, A+M
FC 80
MLD_EDK
S5_CNVRT Message
of first value with double flashing light, bitwise, A+M
FC 81
COD_B4
FC 82
COD_16
FC 83
MUL_16
FC 84
DIV_16
FC 85
ADD_32
FC 86
SUB_32
FC 87
MUL_32
FC 88
DIV_32
FC 89
RAD_16
www.plcdev.com/book/export/html/373
Description
34/63
7/26/12
FC 90
REG_SCHB
FC 91
REG_SCHW
FC 92
REG_FIFO
FC 93
REG_LIFO
FC 94
DB_COPY1
FC 95
DB_COPY2
FC 96
RETTEN
FC 97
LADEN
FC 98
COD_B8
FC 99
COD_32
FC 100
AE_460_1
FC 101
AE_460_2
FC 102
AE_463_1
FC 103
AE_463_2
FC 104
AE_464_1
FC 105
AE_464_2
FC 106
AE_466_1
FC 107
AE_466_2
FC 108
RLG_AA1
FC 109
RLG_AA2
FC 110
PER_ET1
FC 111
PER_ET2
FC 112
SINUS
FC 113
COSINUS
FC 114
TANGENS
FC 115
COTANG
FC 116
ARCSIN
FC 117
ARCCOS
FC 118
ARCTAN
www.plcdev.com/book/export/html/373
35/63
7/26/12
FC 119
ARCCOT
FC 120
LN_X
FC 121
LG_X
FC 122
B_LOG_X
FC 123
E_H_N
FC 124
ZEHN_H_N
FC 125
A2_H_A1
Family Description
FC 1
AD_DT_TM IEC
FC 2
CONCAT
FC 3
D_TOD_DT IEC
FC 4
DELETE
IEC
FC 5
DI_STRNG
IEC
FC 6
DT_DATE
IEC
FC 7
DT_DAY
IEC
FC 8
DT_TOD
IEC
FC 9
EQ_DT
IEC
FC 10
EQ_STRNG IEC
FC 11
FIND
IEC
FC 12
GE_DT
IEC
FC 13
GE_STRNG IEC
FC 14
GT_DT
FC 15
GT_STRNG IEC
FC 16
I_STRNG
IEC
FC 17
INSERT
IEC
FC 18
LE_DT
IEC
FC 19
LE_STRNG IEC
FC 20
LEFT
IEC
FC 21
LEN
IEC
www.plcdev.com/book/export/html/373
IEC
IEC
36/63
7/26/12
FC 22
LIMIT
IEC
FC 23
LT_DT
IEC
FC 24
LT_STRNG IEC
FC 25
MAX
IEC
FC 26
MID
IEC
FC 27
MIN
IEC
FC 28
NE_DT
IEC
FC 29
NE_STRNG IEC
FC 30
R_STRNG
IEC
FC 31
REPLACE
IEC
FC 32
RIGHT
IEC
FC 33
S5TI_TIM
IEC
FC 34
SB_DT_DT
IEC
FC 35
SB_DT_TM IEC
FC 36
SEL
IEC
FC 37
STRNG_DI
IEC
FC 38
STRNG_I
IEC
FC 39
STRNG_R
IEC
FC 40
TIM_S5TI
IEC
Family
Description
FB 41
CONT_C
ICONT
Continuous Control
FB 42
CONT_S
ICONT
Step Control
FB 43
PULSEGEN ICONT
FB 58
FB 59
TCONT_S
Pulse Generation
Communication Blocks
Number Name
Family
Description
FB 2
CP_300
IDENTIFY
www.plcdev.com/book/export/html/373
37/63
7/26/12
properties
FB 3
READ
CP_300
FB 4
REPORT
CP_300
FB 5
STATUS
CP_300
FB 6
WRITE
CP_300
FB 8
USEND
CP_300
FB 9
URCV
CP_300
FB 12
BSEND
CP_300
FB 13
BRCV
CP_300
FB 14
GET
CP_300
FB 15
PUT
CP_300
FB 20
GETIO
FB 21
SETIO
FB 22
GETIO_PART
FB 23
SETIO_PART
FB 55
IP_CONFIG
CP_300
FB 63
TSEND
COMM
FB 64
TRCV
COMM
FB 65
TCON
COMM
FB 66
TDISCON
COMM
FB 67
TUSEND
COMM
FB 68
TURCV
COMM
FC 1
DP_SEND
CP_300
www.plcdev.com/book/export/html/373
38/63
7/26/12
FC 2
DP_RECV
CP_300
FC 3
DP_DIAG
CP_300
FC 4
DP_CTRL
CP_300
FC 5
AG_SEND
CP_300
FC 6
AG_RECV
CP_300
FC 7
AG_LOCK
CP_300
FC 8
AG_UNLOCK
CP_300
FC 10
AG_CNTRL
CP_300
FC 11
PNIO_SEND
CP_300
FC 12
PNIO_RECV
CP_300
FC 40
FTP_CONNECT CP_300
FC 41
FTP_STORE
FC 42
FTP_RETRIEVE CP_300
FC 43
FTP_DELETE
CP_300
FC 44
FTP_QUIT
CP_300
FC 50
AG_LSEND
CP_300
FC 60
AG_LRECV
CP_300
FC 62
C_CNTRL
CP_300
CP_300
Family
Description
FB 80
FB 81
DCAT
TIMERS
FB 82
MCAT
TIMERS
www.plcdev.com/book/export/html/373
39/63
7/26/12
FB 83
IMC
FB 84
SMC
FB 85
DRUM
TIMERS
FB 86
PACK
MOVE
Pack Data
FC 80
TONR
TIMERS
FC 81
IBLKMOV
MOVE
FC 82
RSET
FC 83
SET
FC 84
ATT
TABLE
Add to Table
FC 85
FIFO
TABLE
FC 86
TBL_FIND
TABLE
Table Find
FC 87
LIFO
TABLE
FC 88
TBL
TABLE
Table
FC 89
TBL_WRD
TABLE
FC 90
WSR
SHIFT
FC 91
WRD_TBL
TABLE
Word to Table
FC 92
SHRB
SHIFT
FC 93
SEG
FC 94
ATH
FC 95
HTA
FC 96
ENCO
FC 97
DECO
FC 98
BCDCPL
FC 99
BITSUM
FC 100
RSETI
FC 101
SETI
FC 102
DEV
MATH_FP
Standard Deviation
FC 103
CDT
TABLE
FC 104
TBL_TBL
TABLE
Table to Table
FC 105
SCALE
www.plcdev.com/book/export/html/373
40/63
7/26/12
FC 106
UNSCALE
Miscellaneous Blocks
Number Name
Family
Description
FB 60
SET_SW
FB 61
FB 62
FC 60
LOC_TIME TIMEFUNC reads the time status or time of the CPU and calculates the local
time. It is therefore only useful on CPUs with time status.
FC 61
BT_LT
TIMEFUNC calculates the local time from the base time given at the input.
FC 62
LT_BT
TIMEFUNC calculates the base time from the local time given at the input.
FC 63
S_LTINT
TIMEFUNC sets the required time interrupt to the preset time. This time is
given in local time.
Term
Description
C7
CFC
CP
DB
Data Block
FB
Function Block
FBD
FC
Function Call
FM
Function Module
GSD
Explanation
Generic Station
www.plcdev.com/book/export/html/373
41/63
7/26/12
Description
HiGraph
IM
Interface Module
LAD
M7
Programmable modules
MMC
MPI
OB
Organization Block
OP
Operator Panel
PCS
PG
Programming Terminal
PPI
Profibus
DP
Profibus Decentral
Peripherals
Profibus
PA
Profibus Process
Automation
S7
SCL
Structured Control
Language
SFB
SFC
SM
Signal Module
STL
Statement List
TP
Touch Panel
UDT
VAT
Example in STL
42/63
7/26/12
Bits
BOOL (Bit)
1 Boolean
text
BYTE
(Byte)
WORD
(Word)
DWORD
(Double
word)
16 Binary
number
TRUE/FALSE
2#0 to
2#1111_1111_1111_1111
TRUE
L B#16#10
L byte#16#10
L 2#0001_0000_0000_0000
L W#16#1000
L word#16#1000
BCD
C#0 to C#999
L C#998
Decimal
number
unsigned
B#(0,0) to B#(255,255)
L B#(10,20)
L byte#(10,20)
32 Binary
number
2#0 to
2#1111_1111_1111_1111_
1111_1111_1111_1111
L 2#1000_0001_0001_1000_
1011_1011_0111_1111
Hexadecimal W#16#0000_0000 to
number
W#16#FFFF_FFFF
L DW#16#00A2_1234
L dword#16#00A2_1234
Decimal
number
unsigned
B#(0,0,0,0) to B#
(255,255,255,255)
INT
(Integer)
16 Decimal
number
signed
-32768 to 32767
L 101
DINT
(Double
integer)
32 Decimal
number
signed
L#-2147483648 to
L#2147483647
L L#101
REAL
(Floatingpoint
number)
32 IEEE
Floatingpoint
number
L 1.234567e+13
S5TIME
(SIMATIC
time)
16 S7 time in
steps of
10ms
(default)
S5T#0H_0M_0S_10MS to
S5T#2H_46M_30S_0MS and
S5T#0H_0M_0S_0MS
L S5T#0H_1M_0S_0MS
L
S5TIME#0H_1H_1M_0S_0MS
TIME (IEC
time)
32 IEC time in
steps of 1
ms, integer
signed
T#24D_20H_31M_23S_648MS L T#0D_1H_1M_0S_0MS
to
L TIME#0D_1H_1M_0S_0MS
T#24D_20H_31M_23S_647MS
www.plcdev.com/book/export/html/373
43/63
7/26/12
DATE (IEC
date)
16 IEC date in
steps of 1
day
D#1990-1-1 to
D#2168-12-31
L D#1996-3-15
L DATE#1996-3-15
TIME
_OF_DAY
(Time)
32 Time in
steps of 1
ms
TOD#0:0:0.0 to
TOD#23:59:59.999
L TOD#1:10:3.3
L TIME_OF_DAY#1:10:3.3
CHAR
(Character)
8 ASCII
characters
L 'E'
S5TIME NOTES
Underscores in time and date are optional
It is not required to specify all time units (for example: T#5h10s is valid)
Maximum time value = 9,990 seconds or 2H_46M_30S
S5TIME Format
00
100 ms
01
1s
10
10 s
11
Data Type
Address
Range
44/63
7/26/12
I/O Signals
I
Input bit
BOOL
0 to 65535.7
IB
EB
Input byte
BYTE, CHAR
0 to 65535
IW
EW
Input word
0 to 65534
ID
ED
0 to 65532
Output bit
BOOL
0 to 65535.7
QB
AB
Output byte
BYTE, CHAR
0 to 65535
QW
AW
Output word
0 to 65534
QD
AD
0 to 65532
Marker Memory
M
Memory bit
BOOL
0 to 65535.7
MB
MB
Memory byte
BYTE, CHAR
0 to 65535
MW
MW
Memory word
0 to 65534
MD
MD
0 to 65532
Peripheral I/O
PIB
PEB
BYTE, CHAR
0 to 65535
PIW
PEW
0 to 65534
PID
PED
0 to 65532
PQB
PAB
BYTE, CHAR
0 to 65535
PQW
PAW
0 to 65534
PQD
PAD
0 to 65532
Timer
TIMER
0 to 65535
Counter
COUNTER
0 to 65535
www.plcdev.com/book/export/html/373
45/63
7/26/12
Logic Blocks
FB
FB
Function block
FB
0 to 65535
OB
OB
Organization block
OB
1 to 65535
FC
FC
Function
FC
0 to 65535
SFB
SFB
SFB
0 to 65535
SFC
SFC
System function
SFC
0 to 65535
DB
Data block
1 to 65535
UDT
0 to 65535
Data Blocks
DB
UDT
Introduction
The most common form of addressing used in the Siemens S7 PLCs is direct and symbolic. When a direct
addressed is referenced by an instruction there is no question as to the location in memory. The following
are examples of direct addressing:
Inputs:
Outputs:
Markers:
Timers:
T34
www.plcdev.com/book/export/html/373
46/63
7/26/12
Counters:
C23
Local:
Data Block:
By using the methods of indirect addressing the address used by an instruction can be varied to point to
any number of locations. In this case, a memory location stores a pointer to another memory location.
While this may increase the difficulty of troubleshooting, its advantage is to greatly reduce the number of
networks and instructions needed to control a process. It is also a method that must be understood to use
some of the library and system function calls provided by Siemens.
Format
Example
Memory Storage
P#<byte>.<bit>
P#8.0
P#124.3
4 Bytes
P#<area><byte>.<bit>
P#M50.0
P#I4.0
6 Bytes
P#<area><byte>.<bit><length>
P#DB25.DBX0.0 BYTE 14
P#M0.0 WORD 2
P#I0.0 DWORD 5
10 Bytes
The ANY data type is used to pass a parameter of an unknown or undefined data type. Some functions in
the library use the ANY data type to work on whole sections of memory. To do this, the last pointer
method is used to describe an area. For example the address P#DB25.DBX 0.0 Byte 14 points to the first
byte of DB25 with a length of 14 bytes.
NOTE: A DINT can be converted to a POINTER by simply shifting the double word left by 3 bits.
47/63
7/26/12
instruction can open either a shared data block (DB) or an instance data block (DI).
OPN
DB
10
DBW
36
MW
22
OPN
DI
20
DIB
12
DBB
37
When monitoring in STL the shared DB number is displayed in the DB1 column and the instance DB
number is displayed in the DB2 column.
Furthermore, there are instructions to confirm that the correct DB number is opened and that it is large
enough for the next operation.
L
DBNO
DBLG
DINO
DILG
MW
T [MW 2]
OPN
DB [#DB_Temp]
The memory area identifiers I, Q, M, L, DB use a double word (32-bit) location using the POINTER data
type.
www.plcdev.com/book/export/html/373
48/63
7/26/12
P#0.7
MD
I [MD 2]
M [MD 2]
OPN
DB
//Open DB5
P#2.0
#TempPointer
DBW [#TempPointer]
>D
When monitoring memory indirect addressing the INDIRECT column displays the current address the
instruction is using.
Note that math can be done on the POINTER data type using the double math instructions (e.g. P#2.0 +
P#5.0 = P#7.0).
L
P#2.0
P#5.0
+D
T
MD
Since the bit position only goes to eight the result of P#8.7 + P#1.1 = P#10.0 and not P#9.8. These
methods can be used to offset the address or increase/decrease the pointer in a loop.
Description
LAR1
LAR1 P#M100.0
LAR1 MD24
www.plcdev.com/book/export/html/373
49/63
7/26/12
LAR1 AR2
TAR1
TAR1 MD28
TAR1 AR2
CAR
Addition can be directly accomplished on AR1 and AR2 with the following:
STL
Description
+AR1
Adds the contents of ACCU1 to AR1 and stores the result back into AR1
+AR1 P#100.0
Adds the pointer constant to AR1 and stores the result back into AR1
P#0.7
www.plcdev.com/book/export/html/373
7/26/12
LAR1
I [AR1, P#0.0]
Q [AR1, P#1.1]
P#I0.7
LAR1
L
LAR2
[AR1, P#0.0]
[AR2, P#1.1]
This next example shows area-crossing methods using a word and double word format.
L
P#M0.0
LAR1
W [AR1,
P#10.0]
OPN
DB
//Open DB5
P#DBX 0.0
LAR2
L#0
D [AR2,
P#50.0]
Exercise #1
1. Comment the lines of STL below to describe what this network does:
A
JC
M001
P#M10.0
www.plcdev.com/book/export/html/373
0.0
51/63
7/26/12
JU
M002
M001:
P#Q0.0
M002:
LAR1
A
0.1
[AR1, P#0.1]
Exercise #2 (Advanced)
1. Create a DB with an array of 10 real numbers. Populate the array with random values.
2. Create a function that will return the max number in the array and its position. Use the indirect
addressing method of your choice.
BR
CC0
CC1
OV
OS
OR
STA
RLO
/FC
Each instruction may do the following to each bit in the status word.
-
No read or write
Read
www.plcdev.com/book/export/html/373
52/63
7/26/12
Reset to "0"
Set to "1"
The status word can be seen by displaying the STATUS column while monitoring in STL view. The RLO
(bit 1) and the STA (bit 2) are also displayed in the RLO and STA column.
www.plcdev.com/book/export/html/373
53/63
7/26/12
2. On the second line, the /FC bit is now 1 indicating that this line needs to use the RLO from the
previous line. The address I1.1 is on so the STA = 1. The RLO from the last line is 1 and this is
anded with the current STA with a result of 1 in the current RLO.
3. The same thing happens on the second line but this time 1 and 0 makes the current RLO = 0.
4. The fourth is the Assign instruction which takes the RLO and writes it out to the corresponding
address. In this case the final RLO = 0 so the output will be off. If M0.0 was 1 then the And
operation will evaluate to true making the RLO = 1 which will then turn on the output Q1.0.
www.plcdev.com/book/export/html/373
54/63
7/26/12
ACCU 2 = ACCU 1
Result = 0
www.plcdev.com/book/export/html/373
55/63
7/26/12
Result < 0
Result > 0
Gradual underflow
www.plcdev.com/book/export/html/373
56/63
7/26/12
Result = 0
Result <> 0
57/63
7/26/12
Software requirements
Siemens SIMATIC NET software v6.1 SOFTNET-S7 Industrial Ethernet
IFIXSCADA v5.x or above
Windows XP + SP1
Hardware requirements
Standard network card
S7-300 with CPU315-2 DP
Siemens power supply PS30/5A
Siemens CP343-1 TCP
The hardware modules occupy the following slots in the Siemens PLC:
1. Siemens power supply
2. S7-300 CPU 315-2 DP
3. Ethernet CP343-1 TCP
Example configuration
All wiring should be installed according to Siemens documentation.
58/63
7/26/12
You must log in as an Administrator to install the SIMATIC NET software. Close all other running
applications, including any antivirus software you may be running.
1. On the SIMATIC NET flash screen, start the installation by clicking Install SIMATIC NET
Software.
2. The PC configuration screen appears. Click Next.
3. Select the English language option, then click Next. Click Next again.
4. Click yes to the licensing agreement screen.
5. Enter your Name and Company on the User Registration screen.
6. If you already have SIMATIC NET software installed, this will be the drive selected by default.
Clear the Run automatic authorization option, and then click next. The Setup: Configuration
screen appears.
7. Select all application options to be installed. (This is necessary if you do not already have STEP7
installed on your machine. If STEP7 v5.2 or higher is already installed, you do not have to select the
NCM PC/S7 v5.2 application.) Click Next.
8. The applications you selected are installed. At the prompt, click OK to restart your system. The
system restarts and installs the selected applications. Click Finish to restart your system again.
The SIMATIC NET software is now installed.
59/63
7/26/12
Note: The name of the application is the VFD name. This comes later in the IFIX Project Editor
under Communication | Ports in the Special options text box.
5. Click Next. This screen appears, confirming you have completed configuring the module:
6. The configuration is saved and the PC station is reconfigured. Your existing configuration data is
overwritten. Click OK to confirm at the prompt.
This completes the module configuration.
60/63
7/26/12
Configuration
example
IFIX Info
IFIXS7
VFD/Application Name
VFD1
61/63
7/26/12
Variable declaration
The next step is to declare the variables.
1. Open the Tags Form by choosing Tags | Variable Tags.
2. Create a variable with the following information:
Variable Tag Name: TestInteger
I/O Device Name: IODev
Type: INT
Address: DB190,0
62/63
7/26/12
Question: I receive the following error message when downloading the PC station in the SIMATIC NCM
PC manager:
"The module "station manager" cannot be contacted. Change the on-line interface."
"For On-line connections via the PC internal interface a station name must be assigned in the
component configurator. This name must be identical to the name of the PC station, as configured in
the STEP7 (or Simatic Net) project."
"Online: No connection could be made. The participant does not announce itself."
Solution
1. Check in SIMATIC NCM PC Manager under the Menu option Options | Set PG/PC Interface,
whether the point of entrance S7ONLINE is linked with the PC internal (local) interface.
2. The Station Configuration Editor tells you whether your module is Online. You can start the
Station Configuration Editor by double-clicking the icon. This should not be OFFLINE, so to
change its mode of operation, click Change Mode. The mode of operation should now change to
ONLINE.
3. Check the station name in the Station Configuration Editor. This must match with the name in
SIMATIC NCM PC Manager. You can change the station name in the Station Configuration Editor
by clicking Station Name.
4. Open the Station Configuration Editor and the SIMATIC NCM PC Manager. Check the order and
the number of configured components and the indexes that are used. These should match.
www.plcdev.com/book/export/html/373
63/63