S7-SYSTEM-Romania

date: zondag 3 november 2013

subject: System course SIMATIC S7-300/400
by: Industrial Automation
for:
Global content
– SIMATIC S7 System Overview.
– Operation of the SIMATIC S7 PLC.
– Structure of a program.
– STEP7 BASIC software package:
• global settings (authorization, language and PG/PC interface);
• dealing with projects (create, modify, download and upload);
• hardware configuration and symbolic names;
• clearing the PLC / programming memory cards / documentation;
• reference data (cross reference list, program structure, etc.);
• testing the program (debug / status / control);
– Reading the diagnostic buffer with STEP7.
– Troubleshooting hardware and software Setting up a STEP7 project:
– Programming
 7

System overview
 8

Modules
• PS Power Supply

• CPU Central Processing Unit

• SM Signal Module: I/O-kaarten

• CP Communication Processor, e.g.:

» Profibus FMS
» Industrial Ethernet (iSO/TCP-iP)

• FM Function Module, bv.:

» counting / positioning / controlling

• IM Interface Module
 9

CPU parameters
• The size of the work memory.
• The size of the loaded memory.
• The number or timers and counters than can be programmed.
• The number of markers.
• The speed at which the instructions can be processed.
• Special versions, such as a CPU with standard onboard inputs
and outputs, or a PROFIBUS-DP interface.
Timers & Counters
• The CPU provides internal timers, counters and “memories”
(markers) that can be used from within the user program. The
required number depends on the application.

– CPU 312 contains 128 Timers and 128 Counters

– CPU 417 contains 2048 Timers and 2048 Counters

Memory
• The number of memory’s depends of the application.

– CPU 312 contains 1024 memory’s

– CPU 417 contains 131072 memory’s

CPU processing speed
• CPU processing speed is provided in milliseconds per 1k (1024)
binary instructions.

• By example: 0,1 ms/1k

A I 0.0 0,1 micro sec

A M 3.5 0,1 micro sec 0,3 micro sec
= Q 4.7 0,1 micro sec
 9

Interfaces
Every CPU has an MPI (multi-point interface) as standard. A
number of CPUs also have a PROFIBUS-DP and/or PN, and
sometimes another optional interface.

• Standard CPU
– CPU with 1 interface: MPI-interface*

• Special versions of CPU’s:

– CPU with 2 interfaces: MPI* and Profibus-DP
– CPU with 3 interfaces: MPI*, Profibus-DP, 1 optional
– CPU with 4 interfaces: MPI*, Profibus-DP, 2 optional
 10

MPI and Profibus DP bus

 13

SIMATIC S7-300
 13

S7-300 CPU’s
Standard CPU’s Compact CPU’s Failsafe CPU’s

CPU 312
CPU 312C
CPU 315F-2DP

CPU 314
CPU 313C
CPU 315F-2PN/DP

CPU 315-2 DP
CPU 313C-2 PtP
CPU 317F-2DP

CPU 315-2 PN/DP
CPU 313C-2 DP
CPU 317F-2PN/DP

CPU 317-2 DP
CPU 314C-2 PtP
CPU 319F-3PN/DP

CPU 317-2 PN/DP
CPU 314C-2 DP

CPU 319-3 PN/DP Technology CPU’s

CPU 315T-2DP

CPU 317T-2DP
 14

S7-300 Hardware structure

rack 3

rack 2

rack 1

rack 0
 15

S7-300 specifications
S7-300 Compact CPU specifications

312C 313C 313C-2PtP 313C-2DP 314C-2PtP 314C-2DP

Work memory 32 64 64 64 96 96
in kilobytes (RAM)

Load memory
integrated
- EPROM - - - - - -
insertable
- MMC 4 MB 8 MB 8 MB 8 MB 8 MB 8 MB

Processing time
0.2 0.1 0.1 0.1 0.1 0.1
per bit instruction (µs)

Timers 128 256 256 256 256 256

Counters 128 256 256 256 256 256

Memories (bytes) 128 256 256 256 256 256

Clock memory byte 8 8 8 8 8 8

I/O digital
- internal 10/6 24/16 16/16 16/16 24/16 24/16
- Digital Input 266 1016 1008 8064 1016 7856
- Digital Output 262 1008 1008 8064 1008 7904

Analogue I/O
- internal -/- 4/2 -/- -/- 4/2 4/2
- Analogue Input 64 253 248 503 253 494
- Analogue Output 64 250 248 503 250 495

maximum number
- Modules 8 31 31 31 31 31
- Profiles 1 4 4 4 4 4

internal clock Yes (s/w) yes yes yes yes yes

 18

SIMATIC S7-400
 18

S7-400 CPU’s
Standard CPU’s Failsafe en PROFINET CPU’s Redundant CPU’s

CPU 412-1 DP
CPU 414-3 PN/DP
CPU 412-3H

CPU 412-2 DP
CPU 416F-2
CPU 414-4H

CPU 414-2 DP
CPU 416-3 PN/DP
CPU 417-4H

CPU 414-3 DP

CPU 416-2 DP

CPU 416-3 DP

CPU 417-4 DP
 20

S7-400 specifications S7-400 CPU specifications

414- 416-
CPU 412-1 412-2 414-2 414-3 416(F)-2 416-3 417-4 412-3H 414-4H 417-4H
3PN/DP 3PN/DP

Work memory 144 kB 256 kB 512 kB 1.4 MB 2.8 (1.4) MB 5.6 MB 15 MB 512 kB 1.4 MB 15 MB 1.4 MB 5.6 MB
Program 144 kB 256 kB 512 kB 1.4 MB 2.8 (1.4) MB 5.6 MB 15 MB 256 kB 1.4 MB 15 MB 1.4 MB 5.6 MB
Data

Load memory 512 kB 512 kB 512 kB 512 kB 1MB (256k) 1 MB 1 MB 256 kB 256 kB 256 kB 512 kB 1 MB
internal RAM 64 MB 64 MB 64 MB 64 MB 64 MB 64 MB 64 MB 64 MB 64 MB 64 MB 64 MB 64 MB
insertable

Processing time 0.075 0.075 0.045 0.045 0.03 (0.04) 0.03 0.018 0.075 0.045 0.018 0.045 0.03
per bit instruction
(µs)

Timers 2048 2048 2048 2048 2048 2048 2048 2048 2048 2048 2048 2048

Counters 2048 2048 2048 2048 2048 2048 2048 2048 2048 2048 2048 2048

Marker memories 4096 4096 8192 8192 16384 16384 16384 8192 8192 16384 8192 16384
(bytes)

Clock memory byte 8 8 8 8 8 8 8 8 8 8 8 8

Digital I/O -
maximum number 4096 4096 8192 8192 16384 16384 131072 8192 8192 16384 8192 16384
via Process Images

Digital I/O
32768 32767 65536 65536 131072 131072 131072 65536 65536 131072 65536 131072
maximum number

Analogue I/O -
2048 2048 4096 4096 8192 8192 8192 4096 4096 8192 4096 8192
maximum number

Number of
21 21 21 21 21 21 21 21 21 21 21 21
expansion racks

Interfaces:
IF1: MPI/DP MPI/DP MPI/DP MPI/DP MPI/DP MPI/DP MPI/DP MPI/DP MPI/DP MPI/DP MPI/DP MPI/DP
IF2: - DP DP DP DP DP DP DP DP DP DP DP
IF3: - - - option - option option option option option PN PN
IF4: - - - - - - option option option option - -

internal clock yes yes yes yes yes yes yes yes yes yes yes yes
 21

internal structure
PII: ROM: RAM: RAM: external load
Process Image operating work load memory:
Inputs system memory memory
RAM or

FEPROM or

MMC
Memories
Timers
Counters MPI/DP
interface
CPU control unit
PIQ:
Process Image Interfaces:
Outputs
PROFIBUS

PROFINET

serial

Periphery:

Digital
DI DO AI AO CP FM CPU

Analogue

Communication and

Function modules
system bus
internal structure of the CPU
 22

Work and load memory

• CPU Memory management
– Work memory:
• logical blocks (OB/FC/FB);
• data blocks (DB);
• Memory’s, timers and counters.
– Load memory
• Logical blocks (OB/FC/FB)
• data blocks (DB)
• system data
• data formats
• Global Data (GD) communication
• Retentive* T/M/C/D (only at S7-300 CPU’s with MMC)
• ‘zip’-project (blocks/hardware/symbols/comment) (not within old S7-300 CPU’s)
* Data areas in data blocks (DBs), timers, counters and flags are considered retentive if their content is not lost as a result of restart or power off.
 68

Downloading
downloading
 23

Memory management
Memory cards
• Memory cards (Flash or MMC)
– Flash
• Storage of the program (backup)
• Storage of the project (not all CPU’s)
• Only retentive with battery but not on Flash (separate CPU memory)
– MMC (new 300 CPU’s)
• Storage of the program (backup)
• Storage of the project
• Storage of retentive data (T/C/M/D)
– Size of the MMC (6ES7 953-8L..0-0AA0)
• 64kB / 128kB / 512kB / 2MB / 4MB / 8 MB
Memory cards (example calculating size)
• Example of CPU 315-2 DP, 128 kByte RAM
– Backup of the program (MC7-code):
• MMC/Flash = 1,5 x RAM = 192 kByte
– Backup of the project (only in compressed format, eg. zip)
• MMC/Flash = about 15% of the project size on hard disk
• E.g.. 2 Mbyte a 15% = 300 kByte
– Retentive data T/C/M/D (only on MMC)
• E.g.. 2048 (max.) Memory Bytes = 2 kByte (negligible?)

– Total Memory = Program + Project + Retentive Data

• MMC =192 kByte + 300 kByte + 2 kByte = 494 kByte
 26

Program cycle
CPU in stop

CPU startup Cycle trigger (watchdog)

QB 0
CPU in QB 1
RUN DQ QB 2
QB 3
Set PIQ Etc.

IB 0
Read PII IB 1
DI IB 2
IB 3
Etc.
OB1

A I 0.0
AN M 2.4
PII = Process Image Inputs
S Q 4.7
PIQ = Process Image Outputs
 27

CPU mode selector

S7-300/400 CPU’s Old S7-300/400 CPU’s
RUN-P
RUN RUN

STOP

MRES STOP
MRES

RUN RUN-Program
CPU program is executed and CPU program is executed and
writable writable
RUN
CPU is write protected
STOP STOP
Program is not executed Program is not executed
Memory Reset Memory Reset
Clearing the CPU memory Clearing the CPU memory
 29

Startup behavior
CPU in stop

Mode selector through STEP7

Voltage return
STOP > RUN STOP > RUN

Yes
Error?

No

CPU in startup

OB100

OB101

OB102

CPU in RUN
 30

Startup blocks
Startup methods
Type of Characteristic Startup OB S7-300 S7-400
startup
WARM New start with retained memory settings OB100 x x
(WRST) 2)

HOT (HRST) Restart (program continues from where it OB101 x

stopped) 2) 3)

COLD (CRST) New start without retained memory settings OB102 x x

(only for the 1)
318-2DP
CPU)

1) Parameter settings required

2) For the S7-400, the choice of WRST or HRST is a parameter setting
3) Not for the S7-400H
 31

Buffering of the program (data)

• Buffering of data
– Battery (not within S7-300 with MMC) at least 1 year.
• Buffering of:
– program (logical and data blocks);
– retentive timers, counters en memory’s;
– clock.
– Capacitor (only S7-300)
• Buffering of:
– Part of the total retentive memory without battery;
– CPU Clock of the “new” S7-300’s, 6 weeks at 40°C (exception: 312C).
– Accumulator (starting from CPU314, not within “new” S7-300’s) 120h at 25°C /
60h at 60°C
• Buffering of
– CPU clock
 32

Step7 and optional packages

• Software packages
– STEP 7 Basic
• LAD Ladder diagram (German: KOP)
• STL Statement List (German : AWL)
• FBD Function Block Diagram (German : FUP)

– Optional software packages

• SCL Structured Command Language
• S7-Graph Sequence control for S7
• S7-HiGraph Asynchronous State Diagram
• CFC Continuous Function Chart
• PLC SIM Simulation of the PLC program
• DOCPRO Extended documentation
• Teleservice Service via modem
 33

STEP7 programming tools

LAD
Standard within STEP 7

FBD
Standard within STEP 7

STL
Standard within STEP 7
 33

Optional software
S7-SCL S7-GRAPH
VAR_INPUT // input variable S1
enable : BOOL := 0 ; // declaration T1
END_VAR S2
IF meas_value > max // Limitation T2
THEN meas_value := max;
END_IF; S3 S7

S7-PLCSIM
S7-Teleservice

SIMATIC S7

STEP 7

TS-adapter
 Extra dia

Addressing of bits, bytes & words

1 bit Status 0 of 1

7 6 5 4 3 2 1 0
1 byte =
8 bits

15 8 7 0
1 word =
2 bytes = 7 0 7 0
16 bits
 Extra dia

Addressing of bits

Q 3.5
Bit address (0 to 7)
Separator character
Byte address
Operand I/Q/M/D/L
Inputs / Q outputs / Memory’s / Data / Local data
 Extra dia

Addressing
7 6 5 4 3 2 1 0 Bit address
Byte 0
address
1
2

3 X

:
Q 3.5
65535
Program structure
• STEP7 Program structure
– A program consists of the following blocks
• OB Organization Block;
• FC Function
• FB Function Block;
• DB Data Block.
– Each block consists of networks
• Up to 999 networks
– Each network consists of instructions
• Up to 2000 instructions
 36

Number of blocks
Maximum number of Blocks

Blocks S7 300 S7 400

FB FB 0 ..... FB 1023 FB 0 ...... FB 6144

FC FC 0 ..... FC 1023 FC 0 ...... FC 6144

DB DB 1 ..... DB 2047 DB 1 ...... DB 8192

 36

Types of Blocks
• Programmable Blocks (Their numbers vary by type)
Types of Blocks

Block Description

OB Organization Blocks

FB Function Blocks (has an Instance DB as its memory)

FC Functions
DB Data Blocks (Global and Instance)

• System Blocks (STEP 7 library)

System Blocks

Block Discription

SFB System Function Blocks

SFC System Functions

SDB System Data Blocks

 36

Block parameters
• overview
Block parameters
Type of Block IN OUT IN/OUT TEMP STAT
Organization Block OB - - - x -
Function FC x x x x -
Function Block FB x x x x x

• Every logical block (OB, FC and FB) has a

declarations table for defining temporary
variables and sometimes also static
variables and block parameters.
 37

Example of a Program structure

OB FB FC

FB FB SFC
CPU
Operating
system

FC
 38

Organization Blocks
Examples of the commonest organization blocks

Block Type Explanation Priority

OB1 Cyclic After the startup of each program cycle: OB1 is therefore called cyclically 1
OB1 can also be used to call other blocks.
OB1 has the lowest priority of all the OBs; all other OBs can therefore
interrupt OB1.
OB10 Timed alarm One-off after reaching a predefined date and time or using intervals of one 2
minute up to 1 year.
OB20 Delay alarm After expiry of a given time interval (ms). 3
OB35 Wake-up alarm After fixed intervals of 1 ms to 1 minute. 12
OB40 Process alarm Responds to errors in a peripheral card. 16
OB80 - Asynchronous These are errors such as: 26
OB87 errors module errors
power supply faults
a defect in an I/O card such as a short circuit
calling a non-existent block
OB100 Startup After a transition from STOP to RUN using the operating mode switch on the 26
CPU or via the STEP7 package.
OB121 Software error After a software error during program execution, e.g. calling a non-existent **
block. If no OB121 has been programmed, the CPU goes into STOP status.
OB122* Module After an error reading or writing data to/from a peripheral module. **
* Only for the S7-300
** Priority is determined by the block from which OB121 or OB122 is called
 45

System requirements STEP7 v5.5

Operating System Minimum Requirements for:
Processor Expanded memory Graphics
configuration
MS Windows XP Professional 600MHz 512 MB *) XGA 1024x768
16-bit color depth
MS Windows Server 2003 2.4 GHz 1 GB XGA 1024x768
16-bit color depth
MS Windows 7 Professional 1 GHz 1GB **) XGA 1024x768
16-bit color depth
MS Windows 7 Ultimate 1 GHz 1GB **) XGA 1024x768
16-bit color depth
MS Windows 7 Enterprise 1 GHz 1GB **) XGA 1024x768
16-bit color depth
*) At least 1 GB expanded memory configuration is recommended
**) At least 2 GB expanded memory configuration is recommended
 46

Online interface
MPI-Interface
CP5611 (pci)

SIMATIC S7

PG/PC

CP5512 (pcmcia)

PC adapter USB,
CP5711
 47

Authorization- License key

 48

PG/PC Interface
 49

Language settings
 53

Project structure
Project Station Blocks Blocks
Programmable
Program Symbols Symbols
modules
Project Sources Sources
name
S7-300
CPU315-
2DP
S7
Program(1)
S7-400
Blocks
S7-program
OB1
Connection

Symbols

FC0
 65

CPU memory reset

• By mode selector
RUN-P
RUN RUN

STOP

STOP
MRES
MRES

• By STEP7

What happens after a reset with a CPU which contains a memory card?
Downloading
PG/PC SIMATIC S7-300/400

downloading

Work memory Work memory

download

Download user
save program to memory MMC/internal load memory
Hard disk Open card
offline

FEPROM/external load
Save/retrieve to/from memory
memory card
Project
 68

Memory cards
PG/PC SIMATIC S7-300/400

Work memory Work memory

download

Download user
save program to MMC/internal load memory
Hard disk Open memory card
offline

FEPROM/external load
Save/retrieve to/from memory
memory card
Project
 73

Reference data
• Cross References
• Assignment List
• Program structure
• Unused symbols
• Addresses without symbol

• In the SIMATIC Manager select the menu

– Options > Reference data > Display
 83

Test functions
• Debug > Monitor
– Block status in LAD/FBD/STL (OB/FC/FB/DB)
• Modify Address
– Modifying addresses during Debug (I/Q/M/D/L)
• Monitor/Modify
– Monitoring and Modifying through a VAT (VAriable Table),
• Enable Periferal Outputs
– Setting outputs in STOP mode
• Force
– Used for permanent control (forcing) of variables
 104

Force / Modify - comparison

Force/Modify comparison
Item/Function Force Modify
S7-300 S7-400
Bit memory (M) - x x
Timers and counters (T, C) - - x
Data blocks (DB) - - x
Peripheral inputs (PIB, PIW, PID) - x -
Peripheral outputs (PQB, PQW, PQD) - x x
Inputs and outputs (I, Q) x x x
Number of variables 10 64 -
Defining triggers Always triggers directly x
Affects only variables in the visible part of the window Affects all variables x
User program can overwrite Modify/Force values - - x
The variables retain their values if the application is exited. x x -
The variables retain their values if the connection to the CPU is broken. x x -
Address errors allowed no yes, the last one in the table
e.g. IW 0 Modify/force value: 1 becomes active
IW 0 Modify/force value: 0
 106

CPU information
• Set Time of Day
• Operating Mode
• Module Information
– Scan Cycle Time
– Memory
– Performance data
– Diagnostic Buffer
 115

Comparing Blocks
 119

Project backup
STEP7 – Hardware Diagnostics
STEP7 – System Diagnostics
STEP7 - Diagnostic buffer
• The system diagnostics is a buffer in the CPU that contains
system messages that were caused by events within the PLC
system. Possible causes that can be diagnosed are:
– internal and external errors from a module, plus the diagnosis
– System errors
– Operating mode transitions
– Bug in the user program
– Removing and inserting modules
• Maximum size of the buffer:
– S7-300: 100 messages
– S7-400: 120 messages (adjustable up to 3200)
Overview “diagnostic information”
CPU
The diagnostic function of the
CPU recognizes a system error
The diagnostic function of the
CPU recognizes a software error
SM/FM/CP modules
The diagnostic function for
a module recognizes an
error and generates a
diagnostic alarm (OB82)

diagnostic alarm
system status list
diagnostic
buffer

SFCs

user program
CPU Error handling

CPU in RUN

Yes
Error?
Message in buffer:
No “Error in ….” E.g. “addressing error”

Error OB no
in CPU?
CPU in STOP
Yes
CPU remains in
RUN
Message in buffer :
“OB not found”
CPU in STOP
Error Organization Blocks
Examples of the commonest organization blocks

Block Type Explanation Priority

OB1 Cyclic After the startup of each program cycle: OB1 is therefore called cyclically 1
OB1 can also be used to call other blocks.
OB1 has the lowest priority of all the OBs; all other OBs can therefore
interrupt OB1.
OB10 Timed alarm One-off after reaching a predefined date and time or using intervals of one 2
minute up to 1 year.
OB20 Delay alarm After expiry of a given time interval (ms). 3
OB35 Wake-up alarm After fixed intervals of 1 ms to 1 minute. 12
OB40 Process alarm Responds to errors in a peripheral card. 16
OB80 - Asynchronous These are errors such as: 26
OB87 errors module errors
power supply faults
a defect in an I/O card such as a short circuit
calling a non-existent block
OB100 Startup After a transition from STOP to RUN using the operating mode switch on the 26
CPU or via the STEP7 package.
OB121 Software error After a software error during program execution, e.g. calling a non- **
existent block. If no OB121 has been programmed, the CPU goes into
STOP status.
OB122* Module After an error reading or writing data to/from a peripheral module. **
4 Addressing of I/O
• Slot specific addressing
– Only for old S7-300 CPU’s
• Adjustable addressing
– For all common CPU’s

• The S7-300/400 still has what is known as default addressing. This is the
situation after resetting the CPU, without downloading the hardware
configuration.
 Compact CPU’s
Compact CPU’s

Bytes 312C- 313C- 313C-2PtP 313C-2DP 314C-2PtP 314C-2DP

5BD01 5BE01 6BE01 6CE01 6BF01 6CF01

rack0: Digital
0-31 external default

rack1:
32-63 Digital Digital Digital Digital Digital
rack2: external default external default external default external default external default
64-95

rack3:
96-123

digital digital digital digital digital digital

124-127
internal internal internal internal internal internal

Blue cells: non-default non-default non-default non-default non-default non-default

128-255
are written cyclically into the address range address range address range address range address range address range
PII and PIO.
rack0: Analogue
Yellow cells: 256-383 external default
can only be used with
peripheral instructions. rack1:
384-511 analogue analogue analogue analogue analogue
Light grey cells: external default external default external default external default external default
are used for other purposes, rack2:
e.g. redirecting, 512-639 non-default
adjustable digital/analogue rack3: address range
ranges and fieldbus IO. 640-751
White cells: 752-767 analogue analogue analogue
cannot be addressed by the internal internal internal
non-default non-default
CPU in question.
non-default non-default address range address range non-default non-default
768-1023
address range address range address range address range
 Standaard en PROFISafe CPU’s
Standard and PROFISafe CPU’s

Bytes 312- 314- 315-2DP 315-2PN/DP 317-2DP 317-2PN/DP 318-2DP 319-3PN/DP

1AD10 1AF10 2AG10 2EG10 2AJ10 2EJ10 318-2AJ00 318-3EL00

digital
0-31 external
default
digital digital digital digital
32-63 external external external external digital digital digital
default default default default external external external
64-95
default 256 default 256 default 256
96-127 max. 2k* max.2k* max.2k*

non-default non-default non-default non-default non-default

128-255 address address address address address
range range range range range

analogue
Blue cells:
256-383 external
are written cyclically into the
default analogue analogue analogue analogue analogue analogue
PII and PIO. analogue
external external external external external external
384-511 external
Yellow cells: default 512 default 512 default 512 default 512 default 512 default 512
default
can only be used with 512-639 max.2k* max.2k* max.8k* max.8k* max.8k* max.8k*
peripheral instructions.
640-767
Light grey cells:
768-1023 non-default non-default
are used for other purposes,
address address
e.g. redirecting, non-default non-default
range range
adjustable digital/analogue address address
ranges and fieldbus IO. range range non-default non-default non-default non-default
1024-2047 address address address address
White cells: range range range range
cannot be addressed by the
CPU in question.
2048-8191
 Failsafe en Technology CPU’s
Fail-safe and PROFINET CPUs
Bytes 315F-2DP 315F-2PN/DP 315T-2DP 317F-2DP 317F-2PN/DP 317T-2DP
6FF01 6FH10 6TG10 6FF00 2FJ10 6TJ10

0-31

32-63

digital digital digital digital

digital digital
external external external external
64-95 external external
default default default default
default 384 default 384
1024 2k*

96-127

128-255 non-default
address range
Blue cells:
are written cyclically into the analogue analogue analogue
analogue
256-383 external external external
PII and PIO. default
external
default: 128 default: 128
default
max. 2k* max.: 8k*
Yellow cells:
can only be used with 384-511 Analogue Analogue
peripheral instructions. digital ext. default: ext. default
analogue analogue ext. 512 digital 512
external external default max. 2k* external max. 8k*
Light grey cells: 512-639
default: 512 default: 512 1024 default
are used for other purposes, max. 2k* max: 2k* 2k*
non-default
e.g. redirecting,
adjustable digital/analogue address range non-default
640-767
ranges and fieldbus IO. address range

768-1023 non-default
White cells: non-default
non-default non-default address
cannot be addressed by the range address
address range address range
range
CPU in question. 1024-2047
non-default
non-default
2048-8192 address range
address range
S7-300 - digital addresses
Module Slot number with default addressing
carrier
2 3 4 5 6 7 8 9 10 11

3 IM 96 100 104 108 112 116 120 124

97 101 105 109 113 117 121 125
98 102 106 110 114 118 122 126
99 103 107 111 115 119 123 127

2 IM 64 68 72 76 80 84 88 92
65 69 73 77 81 85 89 93
66 70 74 78 82 86 90 94
67 71 75 79 83 87 91 95

1 IM 32 36 40 44 48 52 56 60
33 37 41 45 49 53 57 61
34 38 42 46 50 54 58 62
35 39 43 47 51 55 59 63

0 C IM 0 4 8 12 16 20 24 28
P 1 5 9 13 17 21 25 29
U 2 6 10 14 18 22 26 30
3 7 11 15 19 23 27 31
S7-300: analogue addresses
Module Slot numbers with fixed byte addressing
carrier
2 3 4 5 6 7 8 9 10 11

3 IM 640 656 672 688 704 720 736 752

: : : : : : : :
: : : : : : : :
655 671 687 703 719 735 751 767

2 IM 512 528 544 560 576 592 608 624

: : : : : : : :
: : : : : : : :
527 543 559 575 591 607 623 639

1 IM 384 400 416 432 448 464 480 496

: : : : : : : :
: : : : : : : :
399 415 431 447 463 479 495 511

0 CPU IM 256 272 288 304 320 336 352 368

: : : : : : : :
: : : : : : : :
271 287 303 319 335 351 367 383
 S7-400: addressing standard CPU’s Address Standard CPUs

Digit./ analog. Bytes 412-1/2 414-2/3 416-2/3 417-4

0 digital
- default:128
127 max. 4 k * digital
default 256
128 max. 8 k * digital digital
Digital - default: 512 default 1024
255 max. 16 k * max. 16 k *
non-default
address range
256
non-default
-
address range
511(1023)

512
-
1023
analogue
Blue cells: default: 2k
1024
are written cyclically into the -
PII and PIO. 2047
analogue
default: 4k
Yellow cells: 2048 analogue analogue
can only be used with - default: 8k default: 8k
peripheral instructions. 3071

Light grey cells: Analogue 3072

are used for other purposes, -
e.g. redirecting, 4096
adjustable digital/analogue non-default
4096
ranges and fieldbus IO. address range
-
8191
White cells:
cannot be addressed by the 8192 non-default
CPU in question. - address range
16384 non-default non-default
address range address range
 S7-400: addressing redundant/failsafe CPU’s
Address Redundant and Failsafe CPUs

Digit./analog. Bytes 412-3H 414-4H 417-4H 414-3PN/DP 416F-2 416-3PN/DP 416F-3PN/DP

0
-
127 Process Process
Image Image
default: 256 default: 256 Process Process Process Process Process
128 max. 8k * max. 8k* Image Image Image Image Image
Digital - default:1024 default:1024 default:1024 default:1024 default:1024
255
max. 16 k * max. 16 k * max. 16 k * max. 16 k * max. 16 k *

256 non-default non-default

- address address
511(1023) range range

512
-
1023

Blue cells: 1024

are written cyclically into the -
PII and PIO. 2047
analogue 4k analogue 4k
Yellow cells: 2048 analogue analogue analogue analogue analogue
can only be used with - default: 8k default: 8k default: 8k default: 8k default: 8k
peripheral instructions. 3071

Light grey cells: Analogue 3072

are used for other purposes, -
4096
e.g. redirecting,
adjustable digital/analogue 4096
ranges and fieldbus IO. -
8191
White cells: non-default non-default
8192
cannot be addressed by the - address address
CPU in question. 16384 range range non-default non-default non-default non-default non-default
address address address address address
range range range range range
S7-400- default addresses after CPU reset
Slot number with corresponding digital default address
digital 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

0 4 8 12 16 20 24 28 32 36 40 44 48 52 56 60 64 68

analogue Slot number with corresponding analogue default address

1 2 3 4 5 6 7 9 9 10 11 12 13 14 15 16 17 18

512 576 640 704 768 832 896 960 1024 1088 1152 1216 1290 1344 1408 1472 1536 1600
 S7-400: Slot addressing

PS CPU DI DO

0 0

1 1

2 2

3 3

Default after CPU reset: 0 4 8 12 16 20 24 …………………………………………...

H5. Editing Blocks
• method for a new project:
• Make a project;
• Configure the Hardware;
• Editing Blocks (programming);
Timers (appendix D)
TYPES OF TIMERS

Description STL Operation (AWL German) LAD/FBD

Pulse S5 Timer: SP (SI) S_PULSE

Start a timer from a pulse signal
Extended Pulse S5 Timer: SE (SV) S_PEXT
Start a timer from an extended pulse signal
On-Delay S5 Timer: SD (SE) S_ODT
Start a timer for a delayed switch-on action
Retentive On-Delay S5 Timer: SS (SS) S_ODTS
Start a timer for a delayed switch-on action with
marker memory
Off-Delay S5 Timer: SF (SA) S_OFFDT
Start a timer for a delayed switch-off action
Timer settings
The general format of the time value looks like this:
T0
– S5T#aHbMcSdMS

• a: number of hours
• b: number of minutes
• c: number of seconds
• d: number of milliseconds
TIMER RANGE AND RESOLUTION
Range [S5TIME] Range Resolution
[seconds] [seconds]
10MS to 9990MS 0.01 to 9.99 0.01

100MS to 1M_39S_900MS 0.1 to 99.9 0.1

1S to 16M_39S 1 to 999 1

10S to 2H_46M_30S 10 to 9990 10

Counters (appendix E)
TYPES OF COUNTERS
Description STL Operation (AWL German) LAD/FBD
Up-Down counter: CU (ZV) S_CUD
Upward/downward counter CD (ZR)
Up counter: CU (ZV) S_CU
Upward (incrementing) counter
Down counter: CD (ZR) S_CD
Downward (decrementing) counter
 58

Counter settings
• The general format of the counter value looks like this :

– C#XXX

• where 0 ≤ XXX ≤ 999 (BCD)

C12
C_CUD
I 0.5 CU

I 0.6 CD

I 0.7 S CV

MW14 PV CV_BCD Q0.7

I 0.4 R Q =
H6. Datatypen
• Elementary data types
• <= 32 bits (E.g. I0.3, Q5.7, C#999, MW10)
• Complex data types
• > 32 bits (bv. ARRAY, STRING)
• User Defined Data Types
• UDT

• Parameter types (TIMER, COUNTER, BLOCK_xx, Pointer, ANY) are data types too, but they can only be used when transferring
block parameters (see our course S7-PROG2: Advanced programming)
Elementary data types I
ELEMENTARY DATA TYPES
Data type Description bits Example
BIT data type Data elements of this type are 1 bit, 8, 16 or 32 bits
BOOL Bit 1 TRUE, FALSE, 1, 0

BYTE Byte 8 minimum maximum

8-bit hexadecimal number B#16#00 B#16#FF
8-bit binary number 2#0000_0000 2#1111_1111
WORD Word 16 W#16,0000 W#16#FFFF
16-bit hexadecimal number 2#0000_0000_0000_0000 2#1111_1111_1111_1111
16-bit binary number
DWORD Double word 32 DW#16,0000_0000 DW#16#FFFF_FFFF
32-bit hexadecimal number 2#0000_0000_0000_0000_ 2#1111_1111_1111_1111_
32-bit binary number 0000_0000_0000_0000 1111_1111_1111_1111
4 x 8-bit unsigned decimal number B#(0,0,0,0) B#(255,255,255,255)
Character type Data elements of this type correspond exactly to 1 character in the extended ASCII character set
CHAR ASCII character 8 ‘A’, ‘B’ ...
Printer characters:
$$ Dollar symbol
$L Line feed
$P Page break
$R Carriage return
$T Tabulator
$N New Line
Elementary data types II
ELEMENTARY DATA TYPES (continued)
Data-type Description bits Example
Numeric types For processing numeric values
INT Integer 16 -32768 32767

DINT Double integer 32 L#-2147483648 L#+2147483647

REAL Floating point 32 -3.402822e+38 to +1.175495e-38 to
-1.175495e-38 +3.402822e+38
Time types Data elements of this type represent various values in STEP7
S5TIME Time value in S5 format 16 S5T#0ms S5T#2h46m30s
TIME Time interval (duration) in 32 T#-24d20h31m23s647ms T# 24d20h31m23s647ms
IEC format
DATE Date in IEC format 16 D#1990-01-01 D#2168-12-31
TIME_OF_DAY Time of day 32 TOD#00:00:00 TOD#23:59:59.999
H7 Data Blocks
HMI panels

Data Blocks

SCADA station

Data exchange

PLC program
Data Blocks
• Data Blocks are mend to store data like setpoints and readings.

• The next elementary data can be stored:

– BIT DBX0.7 8 Bits (byte)

– BYTE DBB2 Databyte 0

» E.g. B#16#FF Databyte 1

– WORD DBW4 Databyte 2

» E.g. S5T#3S :

– DWORD DBD6 :
» E.g. 18.25 :

Databyte 8196
Structure of a Data Block
8 Bits (byte)

Databyte 0 7 6 5 4 3 2 1 0

Databyte 1 DBW0
Databyte 2 DBD0
Databyte 3 DBW2
Databyte 4

Databyte 5 DBW4
Databyte 6
DBD4
Databyte 7 DBW6
:

Databyte 8196 DBX7.5

Example of a Data Block
Address Name Data Type Initial Value Comment

0.0 STRUCT

DBW 0 +0.0 Setpoint INT 1350 -

DBW 2 +2.0 Alarm WORD W#16#AB36 -

DBW 4 +4.0 Delay_M1 S5TIME S5T#3S70MS -

DBX 6.0 +6.0 Valve_5 BOOL FALSE -

DBX 6.1 +6.1 Motor_1 BOOL TRUE -

DBB 7 +7.0 Constant_2 BYTE B#16#A4 -

DBX 8.0 +8.0 Pump_1 BOOL TRUE -

DBB 9 +9.0 Text CHAR ‘H’ -

=11.0 END_STRUCT
Opening a Data Block
FC7 FC20
______ ______
______
OPN DB 10 ______
______ DB10
______ OPN DB 11
______ DB10 ______
______ ______
______ ______ DB11
______
CALL FC 20 ______
______ ______
______ ______
______
DB10
______
______
______
______
H8 Data transfer functions:
• Data types <= 32 bits MOVE

– MOVE (L/T) EN OUT

• Standard function IN ENO

• Data types > 32 bits SFC20

RET_VAL

– BLKMOV EN OUT

• SFC20 (STEP7 Library) IN ENO

– FILL SFC21
• SFC21 (STEP7 Library) RET_VAL

EN BLK

BVAL ENO
MOVE function (Load/Transfer)
System memory Work memory I/O modules
Process images Timer (T) en Counter Data Periferal
inputs (PII) and (C) functions inputs
outputs (PIQ)

Memory (M) L-Stack Constants,

Pointers

LOAD (L)

MOVE
TRANSFER (T)

Process images
inputs (PII) and
outputs (PIQ)

Memory (M) L-Stack Data Periferal outputs

System memory Work memory I/O modules

MOVE-box - parameters
MOVE BOX - PARAMETERS
Function Parameter Data type Memory range Description

EN BOOL I, Q, M, D, L, T, C Enable input

MOVE IN ANY: All data types with a I, Q, M, D, L or constant Source value
length of 8, 16 or 32 bits
EN OUT
OUT ANY: All data types with a I, Q, M, D, L Target address
IN ENO
length of 8, 16 or 32 bits
ENO BOOL I, Q, M, D, L Enable output
ACCU Operation
INPUT

7 (n) 0 7 (n+1) 0 7 (n+2) 0 7 (n+3) 0 Double Words

↓ ↓ 7 (n) 0 7 (n+1) 0 Words

↓ ↓ ↓ 7 (n) 0 Byte n

↓ ↓ ↓ ↓

31 24 23 16 15 8 7 0 ACCU 1

↓ ↓ ↓ ↓

↓ ↓ ↓ 7 (n) 0 Byte n

↓ ↓ 7 (n) 0 7 (n+1) 0 Words

7 (n) 0 7 (n+1) 0 7 (n+2) 0 7 (n+3) 0 Double Words

OUTPUT
Extra appendix: Compare S5/S7

BOUWSTEENVERGELIJK S5/S7

S5 S7 Description Block Parameters

IN/OUT TEMP STAT

OB OB Organization Blocks - Yes -

PB FC Function Yes Yes -

FB/FX

x FB Function Block Yes Yes Yes

Special OB and SFC System Function Yes Yes Yes

FB (integrated) SFB System Function Block

DB/DX DB Global Data Block

x DB Instance Data Bouwsteen (coupled to a FB, IN/OUT parameters en de STAT variables are stored in this)

DX0/DB1 SDB System Data Blocks (Hardware Configuration)

Extra appendix: Compare S5/S7
FORMAT COMPARE S5/S7

S5 S7

L KB 5 L 5

L KF 1000 L 1000

L KG 1234567+02 L 12.34567 / L +1.234567e+001

L KH 8FFE L W#16#8FFE

L DH FFFF FFFF L DW#16#FFFF_FFFF

L KC 'OTTO' L 'OTTO'

L KT 320.2 L S5T#5M20S

L KZ 10 L C#10

L KM 10011100 L 2#10011100

L KY 100,12 L B#(100,12)
L B#(100,12,50,8)
Extra appendix: Compare S5/S7
ORGANIZATION BLOCK

Function S5 S7

Cyclic Block OB1 OB1

Time Interrupted Block OB10 tot OB18 OB30 tot OB38

QVZ (with direct peripheral approach) OB23 OB121

QVZ (with updating the process images) OB24 OB121

Programming errors Different blocks OB122

Manual restart (Neu Start) OB21 (115U) OB100 (WRST)

OB20 (from 135U)

Manual Hot restart (WiederAnlauf) OB21 (from 135U) OB101 (HRST)

Return of main power OB22 x

New x OB102 (CRST)