S7-300 Note

Siemens S7-300 and STEP 7 1
Siemens S7-300 and

STEP 7
Training program
for SAGT
Nikini Automation Systems (Pvt) Ltd.

Nikini Automation Technology Training Centre 247, High level Rd, Colombo 05. Tel: 2826894 / Fax: 2826252
SIEMENS S7-300 and STEP 7 2
Contents
1.0 Basics of Siemens PLC system
1.1 Introduction to PLC
1.1.1 How does a PLC drive a process?
1.1.2 From where does a PLC get information about the state of a process?
1.1.3 How does a PLC communicate with in/output signals?
1.1.4 How does the program work in a PLC?
1.1.5 Memory areas of S7 CPUs
1.1.6 Memory Addressing
1.2 Hardware Information
1.2.1 Assembly and operation of the Simatic S7-300.
1.2.2 Analog modules
1.2.3 Example of a S7-300 configuration
1.3 STEP 7
1.3.1 Program Interface Adjustment (PC- Adapter)
1.3.2 Configuring Hardware
1.3.3 The Project Structure in the SIMATIC Manager
1.3.4 Blocks in the User Program
1.3.5 Creating a Program in OB1
1.3.6 Downloading the Program
1.3.7 Uploading from the Programmable Controller to the PG/PC
1.4 Commonly used instructions
1.4.1. Bit logic instructions
1.4.2 Timer Instructions
1.4.3 Counter Instructions
1.4.4 Comparison Instructions
1.4.5 Move Instructions
1.4.6 Integer Math Instructions
1.4.7 Analog value processing
1.4.8 Conversion Instructions
1.4.9 Floating Point Math Instructions
Nikini Automation Technology Training Center 247, High level Rd, Colombo 05. Tel: 2826894 / Fax: 2826252
1.4.10 Word Logic Instructions
1.5 Introduction and overview of blocks
1.5.1 Function blocks
1.5.2 Data blocks
1.5.3 Functions
1.5.4 System Function Blocks (SFB)
1.5.5 System Functions (SFC)
1.6 Organization Blocks
1.6.1What Are Organization Blocks?
1.6.2 Which OBs Are Available?
1.6.3 Time-of-Day Interrupt Organization Blocks
1.6.4 Time-Delay Interrupt Organization Blocks
1.6.5 Cyclic Interrupt Organization Blocks (OB30 to OB38)
1.6.6 I/O Redundancy Error OB (OB70)
1.6.7 CPU Redundancy Error OB (OB72)
1.6.8 Communication Redundancy Error OB (OB73)
1.6.9 Time Error Organization Block (OB80)
1.6.10 Power Supply Error Organization Block (OB81)
1.7 Fault Finding
1.7.1 Testing the Program with Program Status
1.7.2 Testing with Variable Tables
1.7.3 Fault Finding
2.0 Introduction to Industrial communication

2.1 The Multipoint- Interface (MPI)
2.1.1 Technical Data For The MPI
2.1.2 Configuration Of A MPI Network
2.2 PROFIBUS
2.2.1 PROFIBUS-DP (Distributed I/O)
2.2.2 Technical data for the PROFIBUS-DP
2.2.3 Configuration of the Profibus-DP
2.2.3.1 DP master class 1 (DPM1)
2.2.3.2 DP-Slave
2.2.3.3 System configuration
2.2.4 Bus Access Process
2.3 Ethernet
2.3.1 Procedures of access to the Bus
2.3.2 Ethernet Cables
2.3.3 Repeater / Hub
2.3.4 Switch / Bridge
2.3.5 Router / Gateway
2.3.6 Fast Ethernet
2.3.7 Cabling and Connections
2.3.8 Industrial Ethernet
3.0 Other Topics

3.1 Variable Speed Drives (VSD)
3.2 Source File Management
3.2.1 Basic Information on Programming in STL Source Files
3.2.2 Exporting Source Files
3.2.3 Importing Source Files
3.2.4 Creating STL Source Files
3.2.5 Checking Consistency in STL Source Files
3.2.6Compiling STL Source Files
4.0 SAGT Plant Configuration

4.1 Hardware available in SAGT system
4.1.1CPU
4.1.2 Communication processors and systems
4.1.3 I/O modules
4.1.4 Accessories
4.2 Plant overview
1.0 Basics of Siemens PLC system
1.1 Introduction to PLC
The first Programmable Logic Controller (PLC) was developed by a group of engineers at General Motors in
1968, when the company were looking for an alternative to replace complex relay control systems.
The new control system had to meet the following requirements:
• Simple programming
• Program changes without system intervention (no internal rewiring)
• Smaller, cheaper and more reliable than corresponding relay control systems
• Simple, low cost maintenance
Subsequent development resulted in a system, which enabled the simple connection of binary signals. The
requirements as to how these signals were to be connected were specified in the control program. With the
new systems it became possible for the first time to plot signals on a screen and to file these in electronic
memories.
The original task of a PLC involved the interconnection of input signals according to a specified program and,
if "true", to switch the corresponding output. Boolean algebra forms the mathematical basis for this operation,
which recognizes precisely two defined statuses of one variable: "0" and "1. Accordingly, an output can only
assume these two statuses. For instance, a connected motor could therefore be either switched on or off, i.e.
controlled. This function has coined the name PLC: Programmable logic controller, i.e. the input/output
behavior is similar to that of an electromagnetic relay or pneumatic switching valve controller; the program is
stored in an electronic memory.
However, the tasks of a PLC have rapidly multiplied: Timer and counter functions, memory setting and
resetting, mathematical computing operations all represent functions, which can be executed by practically
any of today’s PLCs.
The networking of several PLCs as well as that of a PLC and master computer is affected via special
communication interfaces. To this effect, many of the more recent PLCs are compatible with open,
standardized bus systems, such as Profibus. Thanks to the enormously increased performance capacity of
advanced PLCs, these can even directly assume the function of a master computer.
Many PLCs can be expanded by means of additional input/output, analogue, positioning and communication
modules. Special PLCs are available for safety technology, shipping or mining tasks. Yet further PLCs are
able to process several programs simultaneously – (multitasking). Finally, PLCs are coupled with other
automation components, thus creating considerably wider areas of application.
1.1.1 How does a PLC drive a process?

The PLC controls the process; in which Actuators are wired as Outputs to designated connections of a PLC
with a control supply voltage of e.g. 24V. Motors can be switched on and off, valves extended or retracted, or
lamps switched on and off through this connection.
1.1.2 From where does a PLC get information about the state of a process?
A PLC receives information about the process from Signal generators, which are wired to the inputs of the
PLC. These signal generators can be e.g. sensors, which recognize whether a working part, switches or
buttons lie in a certain position. This position can be closed or opened. Please note the variation between NC
contacts, which are inactive when closed, and NO contacts, which are inactive when open.
1.1.3 How does a PLC communicate with in/output signals?

The designation of a certain input or output within the program is referred to as addressing. The inputs and
outputs of the PLCs are mostly defined in groups of eight on digital input and/or digital output devices. This
eight unit is called a byte. Every such group receives a number as a byte address. Each in/output byte is
divided into 8 individual bits, through which it can respond with. These bits are numbered from bit 0 to bit 7.
Thus one receives a bit address.
1.1.4 How does the program work in a PLC?

Program processing in a PLC happens cyclically with the following execution:
1. After the PLC is switched on, the processor (which represents the brain of the PLC) questions if the
individual inputs have been transmitted or not. This status of the input is stored in the process- image input
table (PII). Leading inputs become the information 1 or High when enabled, or the information 0 or Low
when not enabled.
2. This processor processes the program deposited into the program memory. This consists of a list of logic
functions and instructions, which are successively processed, so that the required input information will
already be accessed before the read in PII and the matching results are written into a process-image output
table (PIQ). Also other storage areas for counters, timers and memory bits will be accessed during program
processing by the processor if necessary.
3. In the third step after the processing of the user program, the status from the PIQ will transfer to the outputs
and then be switched on and/or off. Afterwards it continues to operate, as seen in point 1.
Note: The time that the processor requires for this execution is called a cycle time. This time is independent
from the number and types of commands.
1.1.5 Memory areas of S7 CPUs

Distribution of the Memory Areas
The memory of an S7 CPU can be divided into three areas (see figure below):
- The load memory is used for user programs without symbolic address assignments or comments (these
remain in the memory of the programming device). The load memory can be either RAM or EPROM.
- Blocks that are not marked as required for startup will be stored only in the load memory.
- The work memory (integrated RAM) contains the parts of the S7 program relevant for running your
program. The program is executed only in the work memory and system memory areas.
- The system memory (RAM) contains the memory elements provided by every CPU for the user
program, such as the process-image input and output tables, bit memory, timers, and counters. The
system memory also contains the block stack and interrupt stack.
- In addition to the areas above, the system memory of the CPU also provides temporary memory (local
data stack) that contains temporary data for a block when it is called. This data only remains valid as
long as the block is active.
Load Memory and Work Memory

When you download the user program from the programming device to the CPU, only the logic and data
blocks are loaded in the load and work memory of the CPU.
The symbolic address assignment (symbol table) and the block comments remain on the programming device.
1.1.6 Memory Addressing
Data in memory can be accessed as bit, byte, word or double word using the “byte. bit” or “byte-address”
format.
Bit Addressing
To access a bit in a memory area, the address specified should include the memory area identifier, the byte
address, and its bit number. An example is shown in Fig. 6.
I 1 . 5
bit number (bit 5)
separator (to separate byte address from bit number)
byte address (byte 1)
memory area identifier (I for input memory area)
Bit No 7 6 5 4 3 2 1 0
Byte 0
Byte 1
Byte 2
Bit Addressing
Byte, Word and Double Word Addressing

To access a byte, a word or a double word in a memory area, specify the memory area identifier, the
data types and then the byte address.
V B 100
byte address MSB LSB
access as byte VB100 7 VB100 0
memory area identifier
V W 100
byte address MSB LSB
access as word
memory area identifier VW100 7 VB100 0 7 VB101 0
V D 100
byte address
access as double word
memory area identifier
MSB LSB
7 VB100 0 7 VB101 0 7 VB102 0 7 VB103 0
VD100
Data Types In STEP 7
1.2 Hardware Information
1.2.1 Assembly and operation of the Simatic S7-300.
The SIMATIC S7-300 is a modular miniature control system and provides the following device spectrum:
CPU: e.g. 318 2 DP
CP:
PS: IM: SM: FM:
Power supply Interface modules Communication
Signal modules Function modules
processors
DI/DO Servo motor
ASI- Bus system
AI/AO PID Control
Profibus DP
e.g. PS 307 2A e.g. IM 365 e.g. SM 323 e.g. FM 365 C
e.g. FM 365 C
- Central processing units (CPUs) with different power ranges, partly integrated with In-/Outputs
o (e.g. CPU312IFM/CPU314IFM) or integrated with a PROFIBUS- Interface (e.g.
CPU318-2DP)
- Power supply devices (PS) with 2A, 5A or 10A.
o PS 307 5A
- Interface modules (IMs) for a more interconnecting design of the SIMATIC S7-300
o IM 365
- Signal modules (SMs) for digital and analog in and output.
o E.g. SM 321Digital Input 16x 24V DC
o SM 322 Digital Output 16x 24V DC, 0.5A
o SM 322 Digital Output 8x 230V AC Relay
o SM 331 Analog Input 2x 12 Bit
o SM 332 Analog Output 2x12 Bit
o SM DI/DO
o SM 334 AI 4/AO 2x 8 bit
- Function modules (FMs) for special functions (e.g. stepping motor control, closed loop control)
o FM
- Communication processors (CP) for network connection.
o CP 341-1 Ethernet
o CP 341 RS 485
1.2.2 Analog modules

Analog Inputs: Characteristics
Physical Measured Variable
o Voltage, Current, Resistance, Temperature
Encoder measurement range
o Volts (+/- 10V), Amperes (+/- 10mA), Ohms (up to 6kΩ), degree Celsius (-2000C to 8500C)
Diagnostics/ Interrupt capability
o Yes/ No
Operating error
o +/- 0.15% to +/- 3.5%
No. of channels
o 1, 2, 4 or 8
No. of groups
o 1, 2, 4 or 8
Resolution
o 8 bit to (max.)15 bit & sign
Conversion time per channel
o Min. 0.2 ms to min 85 ms
Analog Outputs: Characteristics

Physical Variable
o Voltage, Current
Encoder measurement range
o Volts (+/- 10V), Amperes (+/- 20mA)
Diagnostics/ Interrupt capability
o Yes/ No
Operating error
o +/- 0.12% to +/- 1%
No. of channels
o 2, 4
No. of groups
o 1, 2, 4
Resolution
o 12 bit to (max.)15 bit & sign
Conversion time per channel
o Min. 0.8 ms to min 85 ms
1.2.3 Example of a S7-300 configuration
Power supply Memory Card

CPU Signal Modules
Status indicator
Supply voltage
selector switch
On/ Off Switch
Battery MPI Interface

Network Connection
Profibus DP interface
Work Type Switch
MPI- Interface:
Each CPU possesses an MPI interface for the networking of program devices (e.g. PC adapter). This is found
behind a flap at the front of the CPU.
Work type switch/ Mode selector:
Each CPU possesses a code switch for the switching of the modes of operation. Certain programmed
functions are allowed depending upon the position of the code switch. The following modes of operation are
possible:
RUN-P: Program runs; All PG functions are allowed
RUN: Program runs; Only read PG functions are allowed
STOP: Program does not run: All PG functions are allowed
MRES: With this position, one can accomplish a reset
1.3 STEP 7
Using the STEP 7 software, you can create your S7 program within a project. The S7 programmable
controller consists of a power supply unit, a CPU, and input and output modules (I/O modules). The
programmable logic controller (PLC) monitors and controls your machine with the S7 program. The I/O
modules are addressed in the S7 program via the addresses.
With STEP 7, the following functions can be used for the automation construction:
- Configuring and parameterization of hardware
- Generation of a user program
- Debug, commissioning, and service
- Documentation, archiving
- Operation-/Diagnostic functions
1.3.1 Program Interface Adjustment (PC- Adapter)

In order to program a SIMATIC S7-300 from the PC or PG, an MPI-Connection is needed. MPI stands for
Multi Point Interface and is a communication interface that has connections for up to 32 devices (e.g.
PCs,HMI systems, etc.). It is used with HMI (Human Machine Interface) systems to program, serve and
observe data exchange between SIMATIC S7 CPUs.
Each SIMATIC S7-300 possesses an integrated interface.
There are many possible ways to attach a PC or laptop to an MPI:
- Integrated ISA- Communication processors for the PG
- ISA- Communication processors for the PC (e.g. MPI-ISA- Card)
- PCI- Communication processors for the PC (e.g. CP5611)
- PCMCIA- Communication processors for the laptop (e.g. CP5511)
- Adapter for the communication over the serial interface of a PC or laptop (e.g. PC-Adapter)
The following steps below describe the calibration and parameters of a PC-Adapter for a PC.
1. Call Set PG-PC-Interface. ( => Start => SIMATIC => STEP 7 => Set PG-PC-Interface)
2. The module Select is available as the MPI-interface. ( => Select )
3. Select the desired module e.g. choose PC-Adapter and Install (=> PC-Adapter =>Install).
4. Make sure the desired module is present (=> PC Adapter => Close ).
5. Choose Properties of PC-Adapter (MPI) ( => PC Adapter(MPI) => Properties).
6. Set the COM-Port and the Transmission Rate of the serial interface.
7. Set the MPI-Address, Timeout, Transmission Rate and Highest Node Address
8. Accept the configuration ( => OK => OK ).
9. After the values have been configured, double click on the SIMATIC Manager icon ( => SIMATIC
Manager).
10. The plug placed from the MPI interface of the PC will appear on the MPI interface of the CPU and
switch the voltage supply of the PLC on. The MPI interface is found behind the front flap of the CPU
in the form of a 9pin D Sub socket.
11. When the button Accessible Nodes is clicked and all parameters were correctly selected, the
screen will display the following picture with a folder for the reached MPI interface. The MPI-
Address of the CPU is also shown, which is calibrated with a 2 ( ).
1.3.2 Configuring Hardware

The term "configuring" refers to the arranging of racks, modules, distributed I/O (DP) racks, and interface sub
modules in a station window. Racks are represented by a configuration table that permits a specific number of
modules to be inserted, just like a real rack.
When Should You "Configure Hardware"?

The properties of the S7 programmable controllers and modules are preset with default values such that in
many cases you do not need to configure them.
Configuration is necessary in the following cases:
• If you want to change the default parameters of a module (for example, enable a hardware interrupt for a
module)
• If you want to configure communication connections
• For stations with a distributed I/O (PROFIBUS-DP)
• For S7-400 stations with a number of CPUs (multicomputing) or expansion racks
• For fault-tolerant (H) programmable control systems (optional package)
Basic Steps for Configuring a Station

Independent of which structure a station has - you always configure using the following steps:
1. Select a hardware component in the “Hardware Catalog” window.
2. Copy the selected component to the station window using drag & drop.
Configuration Table as a Representation of a Rack

For a local configuration you arrange the modules beside the CPU in a rack and continue into additional
expansion racks. The number of racks which can be configured depends on the CPU you used. Just as you do
in a real plant, you arrange your modules in racks with STEP 7. The difference is that in STEP 7 racks are
represented by ”configuration tables" that have as many rows as the rack has slots for modules. The following
figure shows an example of how a real structure is converted into a configuration table. The configuration
table corresponds to the rack used; STEP 7 automatically places the number of the rack in brackets in front of
the name.
Procedure for Configuring and Assigning
Configuring Central Racks

Rules for Arranging Modules (SIMATIC 300):
Basic Rule
Modules must be inserted in the rack without gaps.
Exception: For installations with one rack, one slot in the configuration table must remain free (reserved for
the interface module). With the S7-300, this is slot 3 and with M7-300, the slot after the module group (slot 3,
4, 5, or 6). In the actual configuration there is no gap because the back plane bus would be interrupted.
Slot Rules (S7-300)

Rack 0:
• Slot 1: Power supply only (for example, 6ES7 307-...) or empty
• Slot 2: CPU only (for example, 6ES7 314-...)
• Slot 3: Interface module (for example, 6ES7 360-.../361-...) or empty
• Slots 4 through 11: Signal or function modules, communications processors, or free.
Racks 1 to 3:
• Slot 1: Power supply module only (for example, 6ES7 307-...) or empty
• Slot 2: Free
• Slot 3: Interface module
• Slots 4 through 11: Signal or function modules, communications processors (dependent on the inserted
interface module), or free.
How to Configure Central Racks

Creating a Station
A station can only be created directly beneath a project.
1. Select the project in the left half of the project window.
2. Select the menu command Insert > Station > SIMATIC 300-Station or ... > SIMATIC 400-Station.
The station is created with a preset name. You can replace the name of the station with a more relevant name
of your own.
Starting the Application to Configure the Hardware
1. Select the "Station" object in the project window so that the "Hardware" object becomes visible in the
right half of the station window.
2. Double-click on the ”Hardware" object.
Arranging the Central Rack

1. Select a suitable central rack ("Rack") for your configuration from the ”Hardware Catalog” window;
in SIMATIC 300 the Rail, in SIMATIC 400 the Universal rack (UR1), for example.
2. Drag the rack to the station window. The rack appears in the form of a small configuration table in the
upper part of the station window. In the lower part of the window, the detailed view of the rack
appears with additional information such as the order number, MPI address, and I/O addresses.
Arranging Modules in a Rack
1. Select a module (for example, a CPU) from the ”Hardware Catalog" window. The slots available for
this module are highlighted in color.
2. Drag & drop the module into the appropriate row of the rack (configuration table). STEP 7 checks
whether any slot rules are violated (an S7-300 CPU must not, for example, be inserted in slot 2).
Symbol that appears when the slot rules are violated.

3. Repeat steps 1 and 2 until the rack has been fully equipped with the required modules.
Displaying the Version of the CPU Operating System in the 'Hardware Catalog' window
When a CPU has more than one operating system this CPU is shown as a folder with different order number
icons in the "Hardware Catalog" window. The different versions of the CPU operating system are arranged
under the order number icons. Please check the version of your CPU's operating system and select the correct
version in the "Hardware Catalog" window.
Assigning Properties to Modules/Interfaces

Properties of components such as modules or interfaces are addresses and parameters.
Every component (module, interface, or interface submodule) has default properties; for example, default
measurement types and measuring ranges for analog input modules.
If you want to change these settings, proceed as follows:
1. Double-click in the configuration table on the component (for example, module or interface
submodule) that is to have parameters assigned or select the row and select the Edit > Object
Properties menu command. Using the right-hand mouse button: Move the mouse pointer to the
component, press the right-hand mouse button, and select the Object Properties command from the
pop-up menu
2. Use the displayed tabbed dialog boxes to assign the component properties.
Assigning Addresses
There is a difference between assigning addresses to nodes and assigning input/output addresses (I/O
addresses).
Node addresses are addresses of programmable modules (MPI, PROFIBUS, Industrial Ethernet addresses);
they are required in order to be able to address the various nodes in a subnet, for example, in order to
download a user program to a CPU. You will find information on assigning node addresses in the subnet in
the chapter on networking stations.
Input/output (I/O) addresses are required in order to read inputs and set outputs in the user program.
Assigning I/O Addresses

STEP 7 assigns input and output addresses when modules are placed in the configuration table. This means
every module has a start address (address of the first channel); the addresses for the remaining channels are
based on this start address.
1. Double-click on the row of the rack containing the module whose start address you wish to set, or
select the module and select the Edit > Object Properties menu command.
2. Select the "Addresses" tab.
3. Change the default start address.
Displaying the Address Overview

You can display the input and output addresses already used and any address gaps as follows:
1. Open the station whose addresses you want to display.
2. Select the menu command View > Address Overview.
3. In the ”Address Overview" dialog box, select the module whose assigned inputs and outputs you want
to display (for example, CPU).
4. If required, you can filter the display by address type (for example, input addresses only).
The address areas ”Inputs" and ”Outputs" are displayed with locations for the modules (master system no.,
PROFIBUS address, rack, slot, interface submodule slot). Input addresses with the length 0 (for example,
addresses of interface modules) are marked with an asterisk (*).
Assigning Symbols to I/O Addresses

You can assign symbols to input/output addresses when you configure modules without having to go via the
symbol table.
You can only assign symbols to the inputs and outputs of digital or analog modules when configuring the
hardware. With integrated inputs/outputs (for example, CPU 312 IFM), in CPs, FMs, and S5 modules (for
example, configured via the adapter module) you must assign the symbols in the symbol table.
The assigned symbols are not downloaded to the station (menu command: PLC > Download). The
consequence of this is: when you upload a station configuration back into the programming device (menu
command: PLC > Upload), no symbols are displayed.
1. Select the digital/analog module to whose addresses you want to assign symbols.
2. Select the menu command Edit > Symbols or press the right mouse button and select the Symbols
command in the pop-up menu.
You can assign symbols in the dialog box that appears.
If you click the "Add Symbol" button in the dialog box, the name of the address is entered as the
symbol.
Saving a Configuration and Checking the Consistency

To save a configuration with all set parameters and addresses, select the menu command Station > Save or
Station > Save and Compile.
If you use the menu command Station > Save and Compile, the configuration is saved in the active project as
a "Station" object and if valid system data blocks (SDB) could be created, they are stored in the (offline)
"Blocks" folder for the associated modules ("SDB carrier," for example, CPU). The system data blocks are
represented by the "System Data" folder/symbol.
To be able to save incomplete configurations, select the menu command Station > Save. Using this command
no system data blocks are created when saving. The save procedure takes less time than if you save and
compile, but you should be aware that there may be inconsistencies between the configuration saved in the
"Station" object and the configuration saved in the system data. Before downloading, you should check your
station configuration for errors using the menu command Station > Consistency Check.
Downloading a Configuration to a Programmable Controller
Before downloading, use the Station > Check Consistency menu command to make sure there are no errors
in your station configuration. STEP 7 then checks to see whether downloadable system data can be created
from the present configuration. Any errors found during consistency checking are displayed in a window.
Requirements for Downloading
• The programming device (PG) is connected to the MPI interface of the CPU using an MPI cable.
• In a networked system (programming device is connected to a subnet): All modules in a subnet must have
different node addresses and the actual configuration must match the network configuration you created.
• The present configuration must match the actual station structure. A configuration can only be downloaded
to the station if it is consistent and free of errors. Only then can system data blocks (SDBs) be created which
can in turn be downloaded to the modules.
• If the station structure contains modules that were configured and assigned parameters using optional
software packages: The optional package must be authorized.
Procedure
• Select the menu command PLC > Download To Module. STEP 7 guides you by means of dialog boxes to
the result.
The configuration for the complete programmable controller is downloaded to the CPU. The CPU parameters
become active immediately. The parameters for the other modules are transferred to the modules during
startup.
Changing the CPU Operating Mode During Downloading
When you trigger the function PLC > Download, you can execute the following actions on the programming
device guided by the dialog boxes:
• Switch the CPU to STOP
(if the mode selector is set to RUN-P or the connection to the CPU is authorized by password)
• Compress the memory
(if not enough continuous free memory is available)
• Switch the CPU back to RUN
Uploading a Configuration from a Station

Requirement
You have used an MPI cable to connect the programming device (PG) to the MPI interface of the CPU.
Procedure
1. Select the menu command PLC > Upload.
2. The dialog box to open the configuration appears.
3. Select the project in which the configuration will be stored later and confirm with "OK."
4. In the dialog box which then appears, set the node address, rack number, and slot in the module from
which the configuration should be read (generally CPU). Confirm with "OK."
You can use the Station > Properties menu command to assign a station name to this configuration and then
store it in the default project (Station > Save menu command).
1.3.3 The Project Structure in the SIMATIC Manager

File management takes place in STEP 7 with the SIMATIC Manager. Here e.g. program blocks can be copied
or be called for further processing with other tools by clicking with the mouse. The operation corresponds to
the standards usually seen in WINDOWS 95/98/2000/ME/NT4.0. (e.g. With one right click from the mouse
button, one is able to receive the selection menu to each module).
In the folders SIMATIC 300 station and CPU, the structure of the hardware of a PLC is illustrated. Therefore
such a project can always be seen as hardware specific.
In STEP 7, each project is put into a firmly given structure. The programs are stored in the following
directories:
Absolute Addresses
Every input and output has an absolute address predefined by the hardware configuration. This address is
specified directly; that is, absolutely. The absolute address can be replaced by any symbolic name you choose.
- In the symbol table, you assign a symbolic name and the data type to all the absolute addresses
which you will address later on in your program; for example, for input I 0.1 the symbolic name
Key 1. These names apply to all parts of the program and are known as global variables.
- Using symbolic programming, you can considerably improve the legibility of the S7 program you
have created.
- Navigate in the project window "Getting Started" until you reach S7 Program (1) and double-click
to
- open the Symbols component.
- Your symbol table currently only consists of the predefined organization block OB1.
- Click Cycle Execution and overwrite it with "Main Program" for our example.
- Enter the symbol you want to use and "Q 4.0" in row 2. The data type is added automatically.
- Click in the comment column of row 1 or 2 to enter a comment on the symbol. You complete your
entries in a row by pressing Enter, which then adds a new row.
- Enter another symbol and "Q 4.1" in row 3 and press Enter to complete the entry.
- Save the entries or changes you have made in the symbol table and close the window.
The user must implement the following steps in order to provide a project in which the solution program can
be written.
1. The main tool in STEP 7 is the SIMATIC Manager, which can be opened with a double click on the icon (
=> SIMATIC Manager).
2. STEP 7- Programs are managed in projects. Each project can be newly created ( => File => New).
3. Give the project the Name startup. ( => startup => OK)
4. Insert a new S7-Program into startup. ( => startup => Insert => Program => S7-Program)
5. The program execution is written into blocks in STEP 7. According to standards, the organization block
OB1 is already present. This represents the interface for the operating system of the CPU, which will be
automatically called and cyclically worked on.
From this organization block, further blocks e.g. the function FC1 can be called for a program routine. This
serves as a process to divide a total task into sub-problems, which are then simpler to solve and simpler to test
for functionally.
1.3.4 Blocks in the User Program
The STEP 7 programming software allows you to structure your user program, in other words to break down
the program into individual, self-contained program sections. This has the following advantages:
• Extensive programs are easier to understand.

• Individual program sections can be standardized.
• Program organization is simplified.
• It is easier to make modifications to the program.
• Debugging is simplified since you can test separate sections.
• Commissioning your system is made much easier.
The example of an industrial blending process illustrated the advantages of breaking down an automation
process into individual tasks. The program sections of a structured user program correspond to these
individual tasks and are known as the blocks of a program.
Block Types
There are several different types of blocks you can use within an S7 user program:
Organization Blocks and Program Structure

Organization blocks (OBs) represent the interface between the operating system and the user program. Called
by the operating system, they control cyclic and interrupt-driven program execution, startup behavior of the
PLC and error handling.
You can program the organization blocks to determine CPU behavior.
Organization Block Priority
Organization blocks determine the sequence (start events) by which individual program sections are executed.
An OB call can interrupt the execution of another OB. Which OB is allowed to interrupt another OB depends
on its priority. Higher priority OBs can interrupt lower priority OBs. The background OB has the lowest
priority.
1.3.5 Creating a Program in OB1

With STEP 7, you create S7 programs in the standard languages Ladder Logic (LAD), Statement List (STL),
or Function Block Diagram (FBD).
Programming OB1 in Ladder Logic
In the following section, you will program a series circuit, a parallel circuit, and the set / reset memory
function in Ladder Logic (LAD).
Set LAD as the programming language in the View menu.
- Click in the title area of OB1 and enter

"Cyclically processed main program,"
for example.
- Select the current path for your firs
element.
- Click the button in the toolbar and
insert a normally open contact.
- In the same way, insert a second
normally open contact.
- Insert a coil at the right-hand end of
the current path.
- The addresses of the normally open
contacts and the coil are still missing in
the series circuit.
- Check whether symbolic
representation is activated.
1.3.6 Downloading the Program
You must have already established an online connection in order to download the program.
Resetting the CPU and Switching it to RUN.
- Turn the operating mode switch to the MRES position and hold it there for at least 3 seconds until
the red "STOP" LED starts flashing slowly.
- Release the switch and, after a maximum of 3 seconds, turn it to the MRES position again. When
the "STOP" LED flashes quickly, the CPU has been reset.
- If the "STOP" LED does not start flashing quickly, repeat the procedure.
Downloading the Program to the CPU

- Now turn the operating mode switch to "STOP" again to download the program.
- Select the Blocks folder in the offline window and then download the program to the CPU using
the menu command PLC > Download.
- Confirm the prompt with OK.
- The program blocks are displayed in the online window when you download them.
STOP Mode
Set the operating mode from RUN to STOP before you do the following:
- Download the complete user program or parts of it to the CPU
- Execute a memory reset on the CPU
- Compress the user memory\
Restart (Warm Restart (Transition to RUN Mode)

If you execute a restart (warm restart) in the "STOP" mode, the program is restarted and first processes the
startup program (in the block OB100) in STARTUP mode. If the startup is successful, the CPU changes to
RUN mode. A restart (warm restart) is required after the following:
- Resetting the CPU
- Downloading the user program in STOP mode
Switching on the CPU and Checking the Operating Mode

- Turn the operating mode switch to RUN-P. The green "RUN" LED lights up and the red "STOP"
LED goes out.
- The CPU is ready for operation.
- When the green LED lights up, you can start testing the program.
- If the red LED remains lit, an error has occurred. You would then have to evaluate the diagnostic
buffer in order to diagnose the error.
Downloading individual blocks

- In order to react to errors quickly in practice, blocks can be transferred individually to the CPU
using the drag and drop function.
- When you download blocks, the operating mode switch on the CPU must be in either "RUN-P" or
"STOP" mode. Blocks downloaded in "RUN-P" mode are activated immediately.
- You should therefore remember the following:
o If error-free blocks are overwritten with faulty blocks, this will lead to a plant failure. You can
avoid this by testing your blocks before you download them.
o If you do not observe the order in which blocks are to be downloaded – first the subordinate
blocks and then the higher-level blocks – the CPU will go into "STOP" mode. You can avoid
this by downloading the entire program to the CPU.
Programming online
In practice, you may need to change the blocks already downloaded to the CPU for test purposes. To do this,
double-click the required block in the online window to open the LAD/STL/FBD program window. Then
program the block as usual. Note that the programmed block immediately becomes active in your CPU.
Testing the Program with Program Status

Using the program status function, you can test the program in a block. The requirement for this is that you
have established an online connection to the CPU, the CPU is in RUN or RUN-P mode, and the program has
been downloaded.
1.3.7 Uploading from the Programmable Controller to the PG/PC

This function supports you when carrying out the following actions:
- Saving information from the programmable controller (for example, for servicing purposes)
- Fast configuring and editing of a station, if the hardware components are available before you start
configuring.
Saving Information from the Programmable Controller
This measure may be necessary if, for example, the offline project data of the version running on the CPU are
not, or only partially, available. In this case, you can at least retrieve the project data that are available online
and upload them to your programming device.
Fast Configuring
Entering the station configuration is easier if you upload the configuration data from the programmable
controller to your programming device after you have configured the hardware and restarted (warm restart)
the station. This provides you with the station configuration and the types of the individual modules. Then all
you have to do is specify these modules in more detail (order number) and assign them parameters.
Uploading a Station
Using the menu command PLC > Upload Station you can upload the current configuration and all blocks
from the programmable controller of your choice to the programming device.
To do this, STEP 7 creates a new station in the current project under which the configuration will be saved.
You can change the preset name of the new station (for example, "SIMATIC 300-Station(1)"). The inserted
station is displayed both in the online view and in the offline view.
The menu command can be selected when a project is open. Selecting an object in the project window or the
view (online or offline) has no effect on the menu command.
You can use this function to make configuring easier.
• For S7-300 programmable controllers, the configuration for the actual hardware configuration is uploaded
including the expansion racks, but without the distributed I/O (DP).
• For S7-400 programmable controllers, the rack configuration is uploaded without the expansion racks and
without the distributed I/O.
With S7-300 systems without distributed I/O, all you have to do is specify the modules in more detail (order
number) and assign them parameters.
1.4 Commonly used instructions
1.4.1. Bit logic instructions
Bit logic instructions work with two digits, 1 and 0. These two digits form the base of a number system called
the binary system. The two digits 1 and 0 are called binary digits or bits. In the world of contacts and coils, a
1 indicates activated or energized, and a 0 indicates not activated or not energized.
The bit logic instructions interpret signal states of 1 and 0 and combine them according to Boolean logic.
These combinations produce a result of 1 or 0 that is called the “result of logic operation” (RLO).
The logic operations that are triggered by the bit logic instructions perform a variety of functions.
1.4.2 Timer Instructions

The following timer instructions are available:
• S_PULSE Pulse S5 Timer
• S_PEXT Extended Pulse S5 Timer
• S_ODT On-Delay S5 Timer
• S_ODTS Retentive On-Delay S5 Timer
• S_OFFDT Off-Delay S5 Timer
• ---( SP ) Pulse Timer Coil
• ---( SE ) Extended Pulse Timer Coil
• ---( SD ) On-Delay Timer Coil
• ---( SS ) Retentive On-Delay Timer Coil
• ---( SA ) Off-Delay Timer Coil
Time Value
Bits 0 through 9 of the timer word contain the time value in binary code. The time value specifies a number of
units. Time updating decrements the time value by one unit at an interval designated by the time base.
Decrementing continues until the time value is equal to zero. You can load a time value into the low word of
accumulator 1 in binary, hexadecimal, or binary coded decimal (BCD) format.
You can pre-load a time value using either of the following formats:
• W#16#wxyz
- Where w = the time base (that is, the time interval or resolution)
- Where xyz = the time value in binary coded decimal format
• S5T#aH_bM_cS_dMS
- Where H = hours, M = minutes, S = seconds, and MS = milliseconds; a, b, c, d are defined by the user.
- The time base is selected automatically, and the value is rounded to the next lower number with that time
base.
The maximum time value that you can enter is 9,990 seconds, or 2H_46M_30S.
S5TIME#4S = 4 seconds
s5t#2h_15m = 2 hours and 15 minutes
S5T#1H_12M_18S = 1 hour, 12 minutes, and 18 seconds.
Time Base
Bits 12 and 13 of the timer word contain the time base in binary code. The time base defines the interval at
which the time value is decremented by one unit. The smallest time base is 10 ms; the largest is 10 s.
Values that exceed 2h46m30s are not accepted. A value whose resolution is too high for the range limits (for
example, 2h10ms) is truncated down to a valid resolution. The general format for S5TIME has limits to range
and resolution as shown below:
1.4.3 Counter Instructions
Counters have an area reserved for them in the memory of your CPU. This memory area reserves one 16-bit
word for each counter address. The ladder logic instruction set supports 256 counters.
The counter instructions are the only functions that have access to the counter memory area.
Count Value
Bits 0 through 9 of the counter word contain the count value in binary code. The count value is moved to the
counter word when a counter is set. The range of the count value is 0 to 999.
You can vary the count value within this range by using the following counter instructions:
• S_CUD Up-Down Counter
• S_CD Down Counter
• S_CU Up Counter
• ---( SC ) Set Counter Coil
• ---( CU ) Up Counter Coil
• ---( CD ) Down Counter Coil
1.4.4 Comparison Instructions
IN1 and IN2 are compared according to the type of comparison you choose:
= = IN1 is equal to IN2
<> IN1 is not equal to IN2
> IN1 is greater than IN2
< IN1 is less than IN2
>= IN1 is greater than or equal to IN2
<= IN1 is less than or equal to IN2
If the comparison is true, the RLO of the function is "1". It is linked to the RLO of a rung network by AND if
the compare element is used in series, or by OR if the box is used in parallel.
The following comparison instructions are available:
• CMP ? I Compare Integer
• CMP ? D Compare Double Integer
• CMP ? R Compare Real
CMP ? I Compare Integer Symbols
1.4.5 Move Instructions
MOVE (Assign a Value) is activated by the Enable EN Input. The value specified at the IN input is copied to
the address specified at the OUT output. ENO has the same logic state as EN. MOVE can copy only BYTE,
WORD, or DWORD data objects. User-defined data types like arrays or structures have to be copied with
the system function "BLKMOVE" (SFC 20).
Example
The instruction is executed if I0.0 is "1". The content of MW10 is copied to data word 12 of the currently
open DB.
Q4.0 is "1" if the instruction is executed.
1.4.6 Integer Math Instructions
Using integer math, you can carry out the following operations with two integer numbers (16 and 32 bits):
• ADD_I Add Integer
• SUB_I Subtract Integer
• MUL_I Multiply Integer
• DIV_I Divide Integer
• ADD_DI Add Double Integer
• SUB_DI Subtract Double Integer
• MUL_DI Multiply Double Integer
• DIV_DI Divide Double Integer
• MOD_DI Return Fraction Double Integer
1.4.7 Analog value processing

Contrary to a binary signal, which can only accept two signal statuses ‘Voltage available +24V‘ and ‘Voltage
not available 0V‘, analog signals can also take as many values as desired within a certain range. A typical
example of an analog transmitter is a potentiometer. Depending upon the position of the rotary button any
resistance can be stopped here up to the maximum value.
Examples for analog measurements in control systems technology:
Temperature -50 ... +150°C
Flow 0 ... 200l/min
Revolutions 500 ... 1500 R/min
These sizes are converted into electrical voltages, currents, or resistances with the help of a measuring
transducer. E.g. if a number of revolutions is to be collected, the speed range can be converted from 500...
1500 R/min over a measuring transducer into a voltage range from 0... +10V. At a measured number of
revolutions of 865 R/min, the measuring transducer would emit a voltage level of + 3.65 V.
If similar measurements with a PLC are processed, then the inputted voltage, current or resistance value must
be converted into digital information. One indicates this conversion as analog--digital conversion (A/D
conversion). This means, that e.g. the voltage value of 3.65V is deposited as information into a row of
equivalent binary digits. The more equivalent binary digits are used for the digital representation, thus the
resolution becomes finer. If one would have used 1 bit e.g. for the voltage range 0... +10V, only one statement
could be met, if the measured voltage in the range 0...+5V or in the range +5V...+10V. With 2 bits, the range
can be partitioned into 4 single areas, 0... 2.5/2.5... 5/5... 7.5/7.5... 10V. Usually A/D conversion in control
systems engineering changes with 8 or 11 bit. You have 256 single areas with 8 bits and with 11 bit a
resolution of 2048 single areas.
For analog value processing, Data types INT and REAL play a big role, because inputted analog values exist
as real numbers in the format INT. Due rounding errors by INT, only real numbers REAL come into question
for an accurate further processing.
Inputting/Outputting Analog Values

Analog values are inputted as word information in the PLC. Respectively, the access of this word is
performed with the instructions:
L PIW x for ‘Load analog input word’
T PQW x for ‘Transfer analog output word’
Each analog value (“Channel“) allocates a peripheral input-output word. The format is an integer INT.
The addressing of the in and/or output words depends on the module start address. If the analog module is
placed in slot 4, then it has the default start address 256. The start address of each further analog module
increases by 16 for each slot. This default start address can be checked in the hardware configuration table
under a detailed view.
The address of the first analog input would be on slot 6 PIW 288 with an analog input. Those of the second
analog input on PIW 290, those of the first analog output on PQW 288 etc. .
The analog value transformation to the further processing in the PLC (digitized) is equal to analog input and
output.
These digitized values must often be normalized through corresponding further processing in the PLC.
Input And Normalize Analog Value
If an analog value is presented as a digitized value, it must still be normalized before it can be processed in
the PLC.
Likewise, the analog output from the peripheral output value follows after the normalization of the output
value. In a STEP 7- Program, normalizing is caught in the math operation.
For this reason, the math operation can take place as accurately as possible. The values to be normalized must
be converted into the data type REAL so that the rounding errors are at a minimum.
Normalize And Output Analog Value
If a standardized value is present and is to be used on an analog output module, then it must be normalized.
In a STEP 7- Program, normalizing is caught in the math operation. This occurs in the data type REAL so that
the rounding errors are at a minimum. This value is only then rounded to an integer value. The places behind
the decimal point are however lost.
1.4.8 Conversion Instructions

The conversion instructions read the contents of the parameters IN and convert these or change the sign. The
result can be queried at the parameter OUT.
• BCD_I BCD to Integer
• I_BCD Integer to BCD
• BCD_DI BCD to Double Integer
• I_DINT Integer to Double Integer
• DI_BCD Double Integer to BCD
• DI_REAL Double Integer to Floating-Point
• INV_I Ones Complement Integer
• INV_DI Ones Complement Double Integer
• NEG_I Twos Complement Integer
• NEG_DI Twos Complement Double Integer
• NEG_R Negate Floating-Point Number
• ROUND Round to Double Integer
• TRUNC Truncate Double Integer Part
• CEIL Ceiling
• FLOOR Floor
1.4.9 Floating Point Math Instructions
The IEEE 32-bit floating-point numbers belong to the data type called REAL. You can use the floating-point
math instructions to perform the following math instructions using two 32-bit IEEE floating-point numbers:
• ADD_R Add Real
• SUB_R Subtract Real
• MUL_R Multiply Real
• DIV_R Divide Real
Using floating-point math, you can carry out the following operations with one 32-bit IEEE floating-point
number:
• Establish the Absolute Value (ABS)
• Establish the Square (SQR) and the Square Root (SQRT)
• Establish the Natural Logarithm (LN)
• Establish the Exponential Value (EXP) to base e (= 2.71828)
• Establish the following trigonometrical functions of an angle represented as a 32-bit IEEE floating-point
number
- Sine (SIN) and Arc Sine (ASIN)
- Cosine (COS) and Arc Cosine (ACOS)
- Tangent (TAN) and Arc Tangent (ATAN)
1.4.10 Word Logic Instructions

Word logic instructions compare pairs of words (16 bits) and double words (32 bits) bit by bit, according to
Boolean logic.
If the result at output OUT does not equal 0, bit CC 1 of the status word is set to "1".
If the result at output OUT does equal 0, bit CC 1 of the status word is set to "0".
• WAND_W (Word) AND Word

• WOR_W (Word) OR Word
• WXOR_W (Word) Exclusive OR Word
• WAND_DW (Word) AND Double Word
• WOR_DW (Word) OR Double Word
• WXOR_DW (Word) Exclusive OR Double Word
1.5 Introduction and overview of blocks
1.5.1 Function blocks
Creating and Opening Function Blocks (FB)
The function block (FB) is below the organization block in the program hierarchy. It contains a part of the
program which can be called many times in OB1. All the formal parameters and static data of the function
block are saved in a separate data block (DB), which is assigned to the function block.
Function blocks (FBs) belong to the blocks that you program yourself. A function block is a block ”with
memory." It is assigned a data block as its memory (instance data block). The parameters that are transferred
to the FB and the static variables are saved in the instance DB. Temporary variables are saved in the local
data stack.
Data saved in the instance DB are not lost when execution of the FB is complete. Data saved in the local data
stack are, however, lost when execution of the FB is completed.
Applications
An FB contains a program that is always executed when the FB is called by a different logic block. Function
blocks make it much easier to program frequently occurring, complex functions.
1.5.2 Data blocks

In order for you to be able to program the call for the function block in OB1 later on, you must generate the
corresponding data block. An instance data block (DB) is always assigned to a function block.
An instance data block is assigned to every function block call that transfers parameters. The actual
parameters and the static data of the FB are saved in the instance DB. The variables declared in the FB
determine the structure of the instance data block. Instance means a function block call. If, for example, a
function block is called five times in the S7 user program, there are five instances of this block.
Creating an Instance DB
Before you create an instance data block, the corresponding FB must already exist. You specify the number
of the FB when you create the instance data block.
One Instance DB for Each Separate Instance

If you assign several instance data blocks to a function block (FB) that controls a motor, you can use this FB
to control different motors.
The data for each specific engine are saved in different data blocks. The DB associated with the FB when it is
called determines which engine is controlled. With this technique, only one function block is necessary for
several engines.
Programming a Block Call

All the work you have done programming a function block is of no use unless you call this block in OB1. A
data block is used for each function block call, and in this way, you can control both engines.
1.5.3 Functions
Programming a Function
Functions, like function blocks, are below the organization block in the program hierarchy. In order for a
function to be processed by the CPU, it must also be called in the block above it in the hierarchy. In contrast
to the function block, however, no data block is necessary.
With functions, the parameters are also listed in the variable declaration table, but static local data are not
permitted. You can program a function in the same way as a function block using the LAD/STL/FBD
program window.
Functions (FCs) belong to the blocks that you program yourself. A function is a logic block ”without
memory." Temporary variables belonging to the FC are saved in the local data stack. This data is then lost
when the FC has been executed. To save data permanently, functions can also use shared data blocks.
Since an FC does not have any memory of its own, you must always specify actual parameters for it. You
cannot assign initial values for the local data of an FC.
Application
An FC contains a program section that is always executed when the FC is called by a different logic
block. You can use functions for the following purposes:
• To return a function value to the calling block (example: math functions)
• To execute a technological function (example: single control function with a bit logic operation).
Assigning Actual Parameters to the Formal Parameters

A formal parameter is a dummy for the "actual" parameter. Actual parameters replace the formal
parameters when the function is called. You must always assign actual parameters to the formal
parameters of an FC (for example, an actual parameter "I 3.6" to the formal parameter "Start"). The input,
output and in/out parameters used by the FC are saved as pointers to the actual parameters of the logic
block that called the FC.
Calling the Function in OB1

The call for the function FC1 is carried out in a similar way to the call for the function block in OB1. All
the parameters of the function are supplied in OB1 with the corresponding addresses of the petrol or
diesel engine.
Programming a Shared Data Block

If there are not enough internal memory bits in a CPU to save all the data, you can store specific data in a
shared data block.
The data in a shared data block are available to every other block. An instance data block, on the other
hand, is assigned to one specific function block, and its data are only available locally in this function
block.
Call Hierarchy in the User Program

For the user program to function, the blocks that make up the user program must be called. This is done
using special STEP 7 instructions, the block calls, that can only be programmed and started in logic
blocks.
Order and Nesting Depth

The order and nesting of the block calls is known as the call hierarchy. The number of blocks that can be
nested (the nesting depth) depends on the particular CPU.
The following figure illustrates the order and nesting depth of the block calls within a scan cycle.
1.5.4 System Function Blocks (SFB)

Preprogrammed Blocks
You do not need to program every function yourself. S7 CPUs provide you with preprogrammed blocks
that you can call in your user program.
Further information can be found in the reference help on system blocks and system functions (Jumps to
Language Descriptions and Help on Blocks and System Attributes).
System Function Blocks
A system function block (SFB) is a function block integrated on the S7 CPU. SFBs are part of the
operating system and are not loaded as part of the program. Like FBs, SFBs are blocks ”with memory."
You must also create instance data blocks for SFBs and download them to the CPU as part of the
program.
S7 CPUs provide the following SFBs:
• For communication via configured connections
• For integrated special functions (for example, SFB29 ”HS_COUNT" on the CPU 312 IFM and the CPU
314 IFM).
1.5.5 System Functions (SFC)

A system function is a preprogrammed function that is integrated on the S7 CPU. You can call the SFC in
your program. SFCs are part of the operating system and are not loaded as part of the program. Like FCs,
SFCs are blocks ”without memory."
S7 CPUs provide SFCs for the following functions:

• Copying and block functions
• Checking the program
• Handling the clock and run-time meters
• Transferring data sets
• Transferring events from a CPU to all other CPUs in multicomputing mode
• Handling time-of-day and time-delay interrupts
• Handling synchronous errors, interrupts, and asynchronous errors
• Information on static and dynamic system data, for example, diagnostics
• Process image updating and bit field processing
• Addressing modules
• Distributed I/O
• Global data communication
• Communication via non-configured connections
• Generating block-related messages
1.6 Organization Blocks
1.6.1What Are Organization Blocks?
Organization Blocks (OBs) are the interface between the operating system of the CPU and the user
program. OBs are used to execute specific program sections:
• At the startup of the CPU
• In a cyclic or clocked execution
• Whenever errors occur
• Whenever hardware interrupts occur.
Organization blocks are executed according to the priority they are allocated.
1.6.2 Which OBs Are Available?

Not all CPUs can process all of the OBs available in STEP 7. Refer to Operations lists /72/ and /102/ to
determine which OBs are included with your CPU.
1.6.3 Time-of-Day Interrupt Organization Blocks

(OB10 to OB17)
STEP 7 provides up to eight OBs (OB10 to OB17) which can be run once or
periodically. You can assign parameters for CPU using SFCs or STEP 7 so that
these OBs are processed at the following intervals:
• Once
• Every minute
• Hourly
• Daily
• Weekly
• Monthly
• At the end of each month
1.6.4 Time-Delay Interrupt Organization Blocks
(OB20 to OB23)
S7 provides up to four OBs (OB20 to OB23) which are executed after a specified delay. Every time-delay
OB is started by calling SFC32 (SRT_DINT). The delay time is an input parameter of the SFC.
When your program calls SFC32 (SRT_DINT), you provide the OB number, the delay time, and a user-
specific identifier. After the specified delay, the OB starts.
You can also cancel the execution of a time-delay interrupt that has not yet started.
1.6.5 Cyclic Interrupt Organization Blocks (OB30 to OB38)
S7 provides up to nine cyclic interrupt OBs (OB30 to OB38) which interrupt your program at fixed
intervals. The following table shows the default intervals and priority classes for the cyclic interrupt OBs.
1.6.6 I/O Redundancy Error OB (OB70)

Note: The I/O redundancy error OB (OB70) can only be used with H CPUs.
The operating system of the H CPU calls OB70 when there is a loss of redundancy on PROFIBUS DP
(for example, a bus failure for the active DP master or when an error occurs in the interface module of the
DP slave) or when the active DP master of DP slaves with connected I/Os changes.
The CPU does not change to the STOP mode if a start event occurs and OB70 is not programmed. If
OB70 is loaded and if the H system is in the redundant mode, OB70 is executed on both CPUs. The H
system remains in the redundant mode.
1.6.7 CPU Redundancy Error OB (OB72)

Note: The CPU redundancy error OB (OB72) exists only with H CPUs.
The operating system of the H CPU calls OB72 when one of the following events occurs:
• Loss of CPU redundancy
• Reserve-master switchover
• Synchronization error
• Error in a SYNC module
• Updating aborted
• Comparison error (for example, RAM, PIQ)
OB72 is executed by all CPUs that are in the RUN or STARTUP mode following a suitable start event.
1.6.8 Communication Redundancy Error OB (OB73)

Note: The communications redundancy error OB (OB73is only available in firmware
version V2.0.x for the CPU 417-4H.
The operating system of the H CPU calls OB73 when the first loss of redundancy occurs in a fault-
tolerant S7 connection (Fault-tolerant S7 connections only exist for S7 communication. For more
information, see "S7-400 H Programmable Controller, Fault-Tolerant Systems."). If a loss of redundancy
occurs for additional fault tolerant S7 connections, there are no more OB73 starts.
Another OB73 start will not occur until you have restored redundancy for all S7 connections that were
fault tolerant.
The CPU does not change to the STOP mode if a start event occurs and the OB73 is not programmed.
1.6.9 Time Error Organization Block (OB80)

The operating system of the S7-300 CPU calls OB80 whenever an error occurs while executing an OB.
Such errors include: exceeding the cycle time, an acknowledgement error when executing an OB, moving
the time forward so that the start time for the OB is skipped, resume RUN mode after CiR. If, for
example, a start event for a cyclic interrupt OB occurs while the same OB is still being executed
following a previous call, the operating system calls OB80.
If OB80 has not been programmed, the CPU changes to the STOP mode.
You can disable or delay and re-enable the time error OB using SFCs 39 to 42.
Note: If OB80 is called twice during the same scan cycle due to the scan time being exceeded, the CPU
changes to the STOP mode. You can prevent this by calling SFC43 "RE_TRIGR" at a suitable point in
the program.
1.6.10 Power Supply Error Organization Block (OB81)
The operating system of the S7-300 CPU calls OB81 whenever an event occurs that is triggered by an
error or fault related to the power supply (only on an S7-400) or the back-up battery (when entering and
when outgoing event).
In S7-400, OB81 is only called in the event of a battery fault if the battery test function has been activated
with the BATT.INDIC switch. The CPU does not change to the STOP mode if OB81 is not programmed.
You can disable or delay and re-enable the power supply error OB using SFCs 39 to 42.
1.7 Fault finding
1.7.1 Testing the Program with Program Status

Using the program status function, you can test the program in a block. The requirement for this is that you
have established an online connection to the CPU, the CPU is in RUN or RUN-P mode, and the program has
been downloaded.
You can test your program by displaying the program status (RLO, status bit) or the contents of the
corresponding registers for every instruction. You can define the scope of the information displayed in the
"LAD/FBD" tab in the "Customize" dialog box. You open this dialog box using the menu command Options
> Customize in the "LAD/STL/FBD: Programming Blocks" window.
Requirements
To display the program status, the following requirements must be fulfilled:
- You must have saved the block without errors and then downloaded it to the CPU.
- The CPU must be in operation and the user program running. Basic Procedure for Monitoring the
Program Status
It is strongly recommended that you do not call the whole program and debug it, but call the blocks one by
one and debug them individually. You should start with the blocks in the last nesting level of the call
hierarchy, for example, by calling them in OB1 and creating the environment to be tested for the block by
monitoring and modifying variables.
1.7.2 Testing with Variable Tables

Variable tables offer the advantage of being able to store various test environments. Thus, tests and
monitoring can be effortlessly reproduced during operation or for the purpose of service and maintenance.
There is no limit to the number of variable tables that can be stored.
When testing using variable tables, the following functions are available:
• Monitoring Variables
This function enables you to display on the programming device/PC the current values of individual variables
in a user program or a CPU.
• Modifying Variables
You can use this function to assign fixed values to individual variables of a user program or a CPU.
Modifying values once and immediately is also possible when testing using program status.
• Enable Peripheral Output and Activate Modify Values
These two functions allow you to assign fixed values to individual I/O outputs of a CPU in STOP mode.
• Forcing Variables
You can use this function to assign individual variables of a user program or a CPU with a fixed value that
cannot be overwritten by the user program.
You can assign or display the values for the following variables:
• Inputs, outputs, bit memory, timers, and counters
• Contents of data blocks
• I/O (periphery)
You enter the variables you want to display or modify in variable tables.
You can determine when and how often the variables are monitored or assigned new values by defining a
trigger point and trigger frequency.
Creating and Opening a Variable Table

Before you can monitor or modify variables, you must create a variable table (VAT) and enter the required
variables. To create a variable table, you can choose from one of the following methods:
In the SIMATIC Manager:

- Select the "Blocks" folder and the menu command Insert > S7 Block > Variable Table. In the
dialog box, you can give the table a name ("Symbolic Name" text box). You can open the variable
table by double-clicking the object.
- Select a connection or, in the online view, an S7 or M7 program from the list of accessible nodes.
You create an unnamed variable table using the menu command PLC > Monitor/Modify
Variables.
In "Monitor/Modify Variables":
- You can use the menu command Table > New to create a new variable table which is not yet
assigned to any S7 or M7 program. You can open existing tables with Table > Open. You can use
the corresponding symbols in the toolbar to create or open variable tables.
- Once you have created a variable table, you can save it, print it out, and use it again and again for
monitoring and modifying.
1.7.3 Fault Finding

Diagnosing Hardware and Troubleshooting
You can see whether diagnostic information is available for a module by the presence of diagnostics symbols.
Diagnostics symbols show the status of the corresponding module and, for CPUs, the operating mode as well.
Diagnostics symbols are displayed in the project window in the online view as well as in the quick view
(default setting) or the diagnostic view when you call the function "Diagnose Hardware." Detailed diagnostic
information is displayed in the "Module Information" application, which you can start by double-clicking a
diagnostics symbol in the quick view or the diagnostic view.
How to Locate Faults

1. Open the online window for the project with the menu command View > Online.
2. Open all the stations so that the programmable modules configured in them are visible.
3. Check to see which CPU is displaying a diagnostics symbol indicating an error or fault. You can open the
help page with an explanation of the diagnostics symbols using the F1 key.
4. Select the station that you want to examine.
5. Select the menu command PLC > Diagnostics/Settings > Module Information to display the module
information for the CPU in this station.
6. Select the menu command PLC > Diagnostics/Settings > Diagnose Hardware to display the "quick view"
with the CPU and the failed modules in this station. The display of the quick view is set as default (menu
command Option > Customize, "View" tab).
7. Select a faulty module in the quick view.
8. Click the "Module Information" button to obtain the information on this module.
9. Click the "Open Station Online" button in the quick view to display the diagnostic view. The diagnostic
view contains all the modules in the station in their slot order.
10. Double-click a module in the diagnostic view in order to display its module information. In this way, you
can also obtain information for those modules that are not faulty and therefore not displayed in the quick
view. You do not necessarily have to carry out all of the steps; you can stop as soon as you have obtained the
diagnostic information you require.
Diagnosing Hardware
Quick View:
The quick view offers you a quick way of using "Diagnosing Hardware" with less information than the more
detailed displays in the diagnostic view of HW Configuration. The quick view is displayed as default when
the "Diagnose Hardware" function is called.
Displaying the Quick View

You call this function from the SIMATIC Manager using the menu command PLC > Diagnostics/Settings >
Diagnose Hardware.
You can use the menu command as follows:
• In the online window of the project if a module or an S7/M7 program is selected.
• If a node ("MPI=...") is selected in the "Accessible Nodes" window and this entry belongs to a CPU.
From the configuration tables displayed, you can select modules whose module information you want to
display.
Calling the Diagnostic View
Using this method you can open the "Module Information" dialog box for all modules in the rack. The
diagnostic view (configuration table) shows the actual structure of a station at the level of the racks and DP
stations with their modules.
Information Functions in the Diagnostic View

In contrast to the quick view, the diagnostic view displays the entire station configuration available online.
This consists of:
• Rack configurations
• Diagnostics symbols for all configured modules
From these, you can read the status of each module and, with CPU modules, the operating mode.
• Module type, order number and address details, comments on the configuration.
Additional Diagnostic Options in the Diagnostic View:

By double-clicking a module, you can display the operating mode of this module.
Module Information
You can display the "Module Information" dialog box from different starting points. The following
procedures are examples of frequently used methods of calling module information:
• In the SIMATIC Manager from a window with the project view "online" or "offline."
• In the SIMATIC Manager from an "Accessible Nodes" window
• In the diagnostic view of HW Config.
In order to display the status of a module with its own node address, you require an online connection to the
programmable controller. You establish this connection via the online view of a project or via the "Accessible
Nodes" window.
Diagnosing in STOP Mode

To determine why the CPU has gone into "STOP" mode, proceed as follows:
1. Select the CPU that has gone into STOP.
2. Select the menu command PLC > Diagnostics/Settings > Module Information.
3. Select the "Diagnostic Buffer" tab.
4. You can determine the cause of the STOP from the last entries in the diagnostic buffer.
If a programming error occurs:
1. The entry "STOP because programming error OB not loaded" means, for example, that the CPU has
detected a program error and then attempted to start the (non-existent) OB to handle the programming error.
The previous entry points to the actual programming error.
2. Select the message relating to the programming error.
3. Click the "Open Block" button.
4. Select the "Stacks" tab.
Stack Contents in STOP Mode

By evaluating the diagnostic buffer and the stack contents you can determine the cause of the fault in the
processing of the user program.
If, for example, the CPU has gone into STOP as a result of a programming error or the STOP command, the
"Stacks" tab in the module information displays the block stack. You can display the contents of the other
stacks using the ”I Stack", ”L Stack", and ”Nesting Stack" buttons. The stack contents give you information
on which instruction in which block led to the CPU going into STOP.
Checking Scan Cycle Times to Avoid Time Errors

The "Scan Cycle Time" tab in the module information gives information about the scan cycle times of the
user program.
If the duration of the longest cycle time is close to the configured maximum scan cycle time, there is a danger
that fluctuations in the cycle time might cause a time error. This can be avoided if you extend the maximum
cycle time (watchdog time) of the user program.
If the cycle length is less than the configured minimum scan time, the cycle is automatically extended by the
CPU/FM to the configured minimum cycle time. In the case of a CPU, the background OB (OB90) is
processed during this extended time (if it has been downloaded).
Setting the Scan Cycle Time
You can set the maximum and minimum cycle times when you configure the hardware. To do this, double-
click in the offline view of the configuration table on the CPU/FM to define its properties. You can enter the
appropriate values in the ”Cycle/Clock Memory" tab.
Evaluating the Diagnostic Buffer

You can read out the diagnostic entries using SFC51 RDSYSST in the user program or display the diagnostic
messages in plain language with STEP 7.
They provide information about the following:
• Where and when the error occurred
• The type of diagnostic event to which the entry belongs (user-defined diagnostic event,
synchronous/asynchronous error, operating mode change).
If, in an extreme case, the CPU goes into STOP while processing an S7 program, or if you cannot switch the
CPU to RUN after you have downloaded the program, you can determine the cause of the error from the
events listed in the diagnostic buffer.
The requirement for this is that you have established an online connection to the CPU and the CPU is in
STOP mode.
- First turn the operating mode switch on the CPU to STOP.
- The starting point is the SIMATIC Manager again with the open project window "Getting Started
Offline."
- Select the Blocks folder.
- If there are several CPUs in your project, first determine which CPU has gone into STOP.
- All the accessible CPUs are listed in the "Diagnosing Hardware" dialog box.
- The CPU with the STOP operating mode is highlighted.
- The "Getting Started" project only has one CPU, which is displayed.
- Click Module Information to evaluate the diagnostic buffer of this CPU.
- The "Module Information" window provides you with information on the properties and
parameters of your CPU. Now select the "Diagnostic Buffer" tab to determine the cause of the
STOP state.
- The latest event (number 1) is at the top of the list. The cause of the STOP state displayed. Close
all windows except for the SIMATIC Manager.
- If a programming error caused the CPU to go into STOP mode, select the event and click the
"Open Block" button.
- The block is then opened in the familiar LAD/STL/FBD program window and the faulty network
is highlighted.
Program Measures for Handling Errors

When it detects errors in program processing (synchronous errors) and errors in the programmable controller
(asynchronous errors), the CPU calls the appropriate organization block (OB) for the error:
If the appropriate OB is not available, the CPU goes into STOP mode. Otherwise, it is possible to store
instructions in the OB as to how it should react to this error situation. This means the effects of an error can be
reduced or eradicated.
2.0 Introduction to Industrial communication
By complex systems with a large number of in-/output signals, it is no longer practical to realize the
automation task with a signal, central controller.
Then one has skipped the control tasks in order to distribute more smaller automation devices. These
devices are coordinated from higher order controllers or mainframes, which are integrated over a bus
system in the whole process.
The in- and outputs are no longer connected to the central signal modules directly on the controller, but
are distributed in a process from location by I/O modules that are connected over a field bus with a signal
controller.
This distribution of the automation task with the connection of the peripherals from location has the
following advantages:
- Simpler programming through smaller programs,
- Minimization of the cabling cost, (Cabling errors are reduced),
- Breaking down system structures,
- Simple expansion resp. modification,
- Short positions by critical signals e.g. analog values or counter frequencies, digitalized into
- I/O range,
- Flexibility from automation systems is increased by the assignment of the peripherals
- Higher system availability by faults through self-sustaining controllers,
- Comprehensive self monitoring and error diagnostic of the transmission system,
- Installation and maintenance is simplified,
In the following pages, the different field bus systems should be visualized for realization of each solution
in order to then be responsive to the bus systems of the SIMATIC S7-300.
Hierarchy Level In Automations Technology
PROFIBUS-FMS
Integrated Bus Systems For The Simatic S7-300

Different bus systems as an integral component are included in the SIMATIC S7-300.
a) The Multipoint- Interface (MPI)

This bus system was chiefly developed as a programming interface. MPI serves likewise for the
communication with components that work for the ‘man/machine interface’ and for homogenous
communication between automation devices.
b) The PROFIBUS
PROFIBUS is a bus system that is used in the field range as well as for cell networks with a small amount
of nodes.
There are three protocol profiles for the PROFIBUS that can be operated together on a circuit (RS 485
fiber-optic cable).
- PROFIBUS-FMS (Fieldbus Message Specification) is suited for the communication of
automation devices in small cell nets under one another and for the communication with field
devices with a FMS interface.
- PROFIBUS-DP (Distributed Peripheral) is the protocol profile for the connection of
distributed I/Os in the field area e.g. ET 200 modules with very fast reaction time.
- PROFIBUS-PA (Process Automation) is the communication compatible addition from the
PROFIBUS-DP about a transmission technology that allows the users into the EX-area. The
transmission technology of the PROFIBUS-PA corresponds to the international Standard IEC
1158-2.
c) Ethernet
2.1 The Multipoint- Interface (MPI)

This bus system was developed as a program interface for the SIMATIC S7. The MPI serves likewise for
the communication with components that are used for the ‘man/machine interface’ and for the
homogenous communication between automation devices.
The operation area from the MPI and PROFIBUS is divided into many areas, where MPI is considerably
cost effective. This interface is already available in all SIMATIC S7 products.
The considerable advantage over the PROFIBUS is that the transmission protocol displays an abstract
“SIEMENS-Standard“ so that no product from “outside manufacturers“ can be integrated into each bus
system.
2.1.1 Technical Data For The MPI

The MPI (Multipoint Interface) is one of the many integrated communication interface devices of the
SIMATIC S7 that is simultaneously connected with more program devices/PCs with STEP 7, HMI
systems (Operator panel/operator station), S7-300, M7-300, S7-400 and M7-400.
It can be used for simple linking in networks and enables the following forms of communication:
- With the service global communications, the networked CPUs can cyclically exchange data
under one another. A S7-300 CPU can therefore exchange a maximal of 4 packets with at least
22 bytes, where with STEP 7 V4.x a max. of 15 CPUs can participate on the data exchange.
- Programming- and diagnostic functions can be executed with MPI from other programmed
devices/PCs to all networked PLCs. There the MPI interface of the CPU is directly connected
with the internal communications bus (K-BUS) of the S7-300. The function modules (FM) and
communications modules (CP) are switched directly over the MPI with the K-Bus connection
from the PG.
- The connection from operator panels/operator stations to the SIMATIC S7 PLCs is simply
realistic with the MPI. There the communication services default can be supported and
standard FBs are no longer necessary by the SIMATIC S5.
The following performance data from the company SIEMENS is entered for the MPI:
- Max. of 32 MPI nodes
- Each CPU has a possibility of a max. of 8 dynamic communication connections for the basic
communication to SIMATIC S7/M7-300/-400.
- Each CPU can operate a max. of 4 statistic communication connections for the additional
communication to the PG/PC, SIMATIC HMI-Systems and SIMATIC S7/M7-300/400.
- Data transmission speed 187,5 kbit/s or 12Mbit/s
- Flexible configuration possibilities in the bus or tree structure (with repeaters)
- Max. wire length 10km
- Interface: RS485
2.1.2 Configuration Of A MPI Network
Up to 32 nodes can be connected with one another. Each is monitored. It should be taken into account
that communication processors (CPs) and function modules that are in the SIMATIC S7-300 must also
have MPI addresses and be counted towards the number of nodes.
The addresses of several nodes can be assigned between 0 and 31 (standard setting).
It makes sense, however, not to assign the address 0 (standard setting for program devices) in a closed
network configuration in order to carry though a diagnosis by the MPI with additional program devices,
without needing to adjust the MPI addresses of the program devices.
For an eventually available operator panel, the address 1 (standard setting for an operation panel) should
be assigned.
To avoid cable reflections, make sure the first and last nodes of the MPI network are hooked up to the
slots‘ integrated terminator.
The MPI network is compiled with a shielded and a stranded filter 2 wire cable and can be used up to a
length of 50 m. These 50 m are measured from the first node to the last node of the MPI network.
Should this large distance be used, then the PS 485 repeaters must be used. A cable length can be up to
1000 m in length between 2 RS 485 repeaters when no other node is found between the 2 repeaters. One
can place up to 10 repeaters in a row.
The components that come by the configuration of the MPI configuration for operation, are the same bus
cables like the bus connectors and RS 485 repeaters that are used by the electrical net of the PROFIBUS.
Therefore the electrical net can be configured as either cables or a tree structure with the help of the
repeater.
2.2 PROFIBUS
A field bus standard was made with the PROFIBUS which is open and company neutral. Devices of
different manufacturers are equipped with a proper interface.
Due to it’s comprehension and also differentiated functionality, the PROFIBUS masks large areas of
sensors/actors next to the field and cell levels and guarantees a good uniformity for the higher level bus
systems of the process control level.
The characteristics of the PROFIBUS are thoroughly described in the following sections.
- PROFIBUS- FMS
- PROFIBUS- PA
- PROFIBUS- DP
These 3 compatible variants of the PROFIBUS co-ordinate properties and user ranges. They make a
transparent communication from sensor/actor to the systems in the process control level possible.
Planning, installation and maintenance are therefore economic and technically simple to implement.
2.2.1 PROFIBUS-DP (Distributed I/O)

The PROFIBUS-DP is positioned in the DIN E 19245 Part 3 and integrated into the European field bus
norm EN 50170. It is tailored on the requirements for faster, more efficient data exchange between the
automation devices and the distributed devices like binary or analog in-/output modules and actuators.
This shift of the peripherals in the field level enables the incoming supply by the cables. For this reason
the user field of the PROFIBUS is added underneath thereafter. The PROFIBUS-DP uses the approved
properties of the PROFIBUS transmission technology and of the bus access protocol (DIN 19245 Part 1).
It adds this to the functions with which the high requirements are fulfilled for the system reaction time in
the range of the distributed I/O. Therefore it is possible for the PROFIBUS-FMS and PROFIBUS-DP to
simultaneously execute on a single cable.
2.2.2 Technical data for the PROFIBUS-DP

The following Parameter are specified for the PROFIBUS-DP in the Norm 50170.
- The bus allocation occurs by the PROFIBUS-DP after the processing of ‘’Token passing with
supported master-slave’.
- Typical cycle time is given with 5 -10 ms.
- A maximum of 127 nodes with a frame length of 0-246 bytes user data can be connected.
- Standard-transmission rates are defined as 9,6 KBaud / 19,2 KBaud / 93,75 KBaud / 187,5
KBaud / 500 KBaud / 1,5 MBaud / 3 MBaud / 6 MBaud / 12 MBaud.
- The bus configuration is modular expandable where as the peripherals and field devices are
connected and unconnected during the operation.
- The data transmission occurs either over a 2 wire cable with a RS-485 interface or over a
fiber-optic cable. We restrain ourselves here to the 2 wire cable data transmission possibility.
- The unprotected and twisted 2 wire cable (Twisted Pair) has a minimum cross section of 0.22
mm² and must be connected at the end with the shaft resistor.
- An area-wide network occurs by the PROFIBUS-DP through the compartmentalization of the
bus system in the bus segments that can be connected over repeaters.
- The topology of the single bus segment is the line structure (up to 1200 m) with short drop
cables (<0.3m). With the help of repeaters, a tree structure can also be constructed as shown:
- The maximum number of nodes per bus segment amounts to 32. More lines can connected
under one another through performance enhancements (repeaters) where by it is noted that
each repeater counts as a node. In total a maximum of 128 nodes are connectable (over all bus
segments).
- By 1,5 MBaud repeaters 10 bus segments can be operated in a row (9 repeaters), by 12
MBaud-repeaters only 4 bus segments (3 repeaters).
- Transmission distances to 12 km are possible by electrical configuration and to 23.8 km with
optical configuration. The distances are dependent on the transmission rate, like shown here
(electrical configuration).
2.2.3 Configuration of the Profibus-DP
2.2.3.1 DP master class 1 (DPM1)

Here the PROFIBUS concerns a central controller, which exchanges information with the distributed
stations (DP slaves) in a specified message cycle. The following master-slave user functions are
concretely supported:
- Collection of diagnostic information of the DP slaves.
- Cyclic user data operation
- Parameterizing and configuration of the DP slaves
- Controlling of DP slaves with control commands
These functions are independently handled from the user interface of the DP master (class 1). The
interface between the user and the user interface is calibrated as a data service interface. Typical devices
are programmable logic controllers (PLC), computerized numerical control (CNC) or robot control (RC).
DP master class 2 (DPM2)
Devices of this type are programming, configuring or diagnostic devices. They are set by commissioning
in order to specify the configuration of the DP system that stands from the number of DP devices, of
allocation between node addresses by the bus and of I/O addresses such as indication over data
consistency, diagnostic format and bus parameters.
Between the DP slave and the DP master (class 2), the following additional functions are possible next to
the master-slave functions of the DP master (class 1):
- Reading of the DP slave configuration
- Reading of the in- and output values
- Address allocation by DP slaves
Between the DP master (class 2) and the DP master (class 1), the following functions are available (most
of these functions execute acyclically):
- Entry of the available diagnostic information of the assigned DP slaves in the DP master (class
1)
- Upload and download of data records
- Activation of the bus parameter records
- Activation and deactivation of the DP slaves
- Adjustment of the operation type of the DP master (class 1)
2.2.3.2 DP-Slave
A peripheral device (sensor/actuator) is identified as a DP slave when the input data is read in and the
output data is given to the peripherals. It is also possible for the devices to provide only input or output
information. Typical DP slaves are devices with binary in-/outputs for 24 or 200 V, analog inputs, analog
outputs, counters, and also:
- Pneumatic valve islands
- Code reading devices
- Proximity switches
- Measurement value sensors
- Drive controllers
Most of the input and output data is device dependent and is allowed to contain a maximum of 246 bytes
for inputs and 246 bytes for outputs. From cost and implementation technological principles, many of the
available devices have a maximal user data length of 32 bytes.
2.2.3.3 System configuration

The PROFIBUS DP lets mono or multi systems be implemented. Through this stands a high degree in
flexibility by the system configuration. A maximum of 126 devices can be connected to a Profibus. The
bus structure offers the possibility to couple and uncouple a single node reaction-free in order for the
system to be taken stepwise into operation. Further enhancements have no influence on the configuration
ready installed devices. By the mono master system, only a master is active on the bus in the operation
phase of the bus system. The PLC is the central control component in which the DP slaves are coupled
over the transmission medium to the PLC. It presents a clean master-slave access process. With this
system configuration, the smallest bus cycle is accomplished.
PROFIBUS-DP-Mono-Master-System
You find more masters on the bus in a multi master operation. You can either construct independent sub
systems existing from each master and the additional slaves or function these systems as additional
configuration and diagnostic devices. The input and output images of the slaves can be read by all
masters. The description of the outputs is only possible for a master (class 1). Naturally, the masters can
also exchange data frames with one another over the AGAG-Connection. Multi master systems obtain an
average bus cycle.
PROFIBUS-DP-Multi-Master –System
2.2.4 Bus Access Process
The bus access process is naturally in tight connection with the topology of the PROFIBUS system.
Basically the communication network is differentiated from the star, ring, and bus network. With a star
configuration, all attached nodes communicate over a central computer that appoints the whole
performance capability and function security. The nodes of a ring network build a closed ring
configuration. The advantage is that a node always knows from where it’s information comes. The
disadvantages are described below:
a) When a node is filled in, the whole system fills as a result of the ring interruption.
b) The cable cost is relatively high because the first node must be connected with the last node.
The PROFIBUS therefore uses the bus (resp. the line network). By these systems all nodes are
attached over a small drop cable on a whole cable. From this principle each message from each
node is recognized.
The sending capability must be governed through the bus access process. Two processes come to
the PROFIBUS for use. Token passing and Master/Slave processes. Therefore the PROFIBUS
access process is also referred to as “hybrid”. The master occupies the right of the bus access by
the master/slave process. The passive slaves only answer to the instruction of the master. The
other method is by the token passing process. Here the access right over the “Token” is allocated
and assigned to the active nodes one after the other. Only the master that occupies the tokens can
communicate with the other active and passive nodes on the bus access.
Representation of the hybrid access process

So two important factors of the bus are implemented:
- Automation devices receive enough time with appropriate intelligence in order to follow through
with your communication tasks (through token passing process).
- The data exchange between the automation devices is implemented with the simple process
peripherals (I/O level) under real-time conditions (through master/slave process).
2.3 Ethernet
The Ethernet is a worldwide spread and manufacturer-neutral technology for the transmission of data in a
LAN (Local Area Network) at a rate of 10, 100 or 1000 millon bit per second (MBps). LANs are
specified in IEEE 802 and are differing from other types of networks by:
- The total length of cabling or rather the extension of network (10-1000 m)
- The technology of transmission (coaxial cable, twisted pair and fibre-optic cable systems)
- The network topology (bus-, ring-, star- and tree structure)
Ethernet is a part of this specification and is defined in IEEE 802.3 resp. IEEE 802.3u for Fast Ethernet.
2.3.1 Procedures of access to the Bus

On the Ethernet network, there is no division into Master- resp. Slave stations. Any participant has the
right to access the Bus. In order to coordinate the access, the CSMA/CD-protocol is employed (Carrier
Sense Multiple Access with Collision Detection). This protocol describes, when data are being put on the
net by the network interface and how to treat data collisions in it. If a participant, who is connected to the
LAN, wishes to send something, he first has to wait until it is “quiet” on the connecting medium, which
means, that no data are transferred (carrier sense).
On realizing, that no more data transfer exists, the participant himself starts sending his data. By using
this procedure, it could occur that several participants are waiting on a break during the data transfer and
afterwards start together for transmitting (Multiple Access).
If this occurs, it is a so-called collision. The Ethernet communication is designed to recognize such
collisions.
If the CSMA/CD protocol of the network is recognizing a collision, the transfer is being interrupted and
the data packages are deleted. After a randomized period the network is starting the transmission cycle
again.
2.3.2 Ethernet Cables:

For the Ethernet network various types of cables and plugs are included.
Frequently used types of cables are:
- Coaxial cable
- Twisted Pair cable
- Optical Fibre cable
Earlier, the coaxial cable was applied mainly, but today most times the twisted pair cable is in use. This
cable consists of two pairs of copper core; both are twisted with each other. Both pairs are additionally
covered by screening weave and cable sheath.
Optical Fibre cables are mainly applied for long transmissions or higher transmission speed. Suitable for
the different types of cables, there are different variations of plugs. For example the RJ45-plug of the
twisted pair cable:
In general, twisted-pair cables with connection of cores in a ratio of 1:1 are used. This means, each sender
cores (TD) and each receiver cores (RD) are connected. These cables are used to connect network
participants like PCs or Ethernet-CPs with respective network devices.
However, if two of these network participants should be connected directly, for example a PC directly to
an Ethernet-CP, a special network cable is necessary. Such cable, known as crossover cable, has each
connected sender- (TD) and receiver cores (RD). See these cable crossings in the following diagram.
2.3.3 Repeater / Hub:

A repeater is used for the coupling of network segments and has therefore ability to influence the
extension and topology of a network. A hub provides the same functionality like a repeater, but it has
installations for several connections (“ports”), therefore it is also called a multiport repeater.
Repeaters or hubs are forwarding the received data transparently. Logically they are acting like a piece of
network cable, which means a collision domain is extending to several network segments, which are
separated by repeaters or hubs.
Therefore, repeaters are applied to connect different types of cables (for ex. coaxial- and twisted-pair
cables). Hubs normally are serving to connect several network participants by logic.
2.3.4 Switch / Bridge:

In contrast to the repeater, a bridge is not only forwarding the Ethernet packages, but also makes it
dependent on the respective Ethernet package. Here the bridge separates a network in two single collision
domains. A switch is working like a bridge, but with more than two collision domains. Therefore, each
connection (port) of the switch is assigned its own collision domain. Either bridges or switches are
interpreting the address fields (MAC addresses) of the Ethernet packages and forward them selectively
from sender to the respective receiver. This effects a filtered data communication in a way, that the
Ethernet packages are only transmitted within the network segments of the sender and the receiver. If the
sender as well as the receiver is located in the same network segment, data are not forwarded at all.
Bridges and switches can connect Ethernet segments of different transmission rates (for ex. 10 Mbit/s
100Mbit/s) without downgrading the entire network to the lower transmission rate.
2.3.5 Router / Gateway:
Another step ahead of the bridge or the switch is a router and its functionality. A router is not only
interpreting the various Ethernet packages, but also their contents, which means the data area of the
Ethernet package. The data area comprises also addressing information, which are analysed by the router
and the data packages are specificly forwarded. Normally, routers are applied to enable connections
between independent networks.
A router example is the Ethernet-ISDN router (in short: ISDN router). This one is coupling an Ethernet
network to an ISDN telephone network.
2.3.6 Fast Ethernet

One important reason for the wide acceptance of Fast Ethernet is its considerable similarity to the well-
known Ethernet. The Fast Ethernet standard is based essentially on the classic Ethernet standard for
twisted pair cable (10 Base T) with a transmission speed increased by a factor of 10 to 100 Mbps.
The advantage for the user is obvious; existing technology know-how can be further used. It is not
necessary that a completely new technology be learned anew by beginners. The new fast technology can
be immediately and efficiently deployed.
Common factors of the Ethernet and Fast Ethernet:

The data format:
- Shortest packet: 64 bytes
- Longest packet: 1518 bytes
- Address field length: 48 bytes
- Access procedure CSMA / CD
- The same cables (with the exception of coaxial cables)
- Use of repeaters for network setup.
Differences:
The reason for the difference of the two networks lies in the increased speed of Fast Ethernet:
SIMATIC NET components conform to the following specifications:

• 100BaseTX for industrial twisted pair links
• 100Base FX for fiber optic links
Ethernet Fast Ethernet
IEEE Standard 802.3 802.3u
Data rate 10 Mbps 100 Mbps
Time duration of a bit 100 ns 10 ns
Access procedure CSMA / CD CSMA / CD
Largest data packet 1518 byte 1518 byte
Smallest data packet 64 byte 64 byte
Address field legth 48 byte 48 byte
Topology Bus, star, tree Bus, tree
Supported media Twisted pair, Twisted pair,
fiber optic, coax fiber optic
Max. network extension 1) 4520 m 412 m
Max. TP cable length 100 m 100 m
Max. FO cable length HDX 2000 m 412 m (point-to-point)
Max. FO cable length FDX 2000 m 2000 m
The maximum network extension depends on the signal transit time. It is reduced in accordance with the
number and type of active network components used.
2.3.7 Cabling and Connections
In the 100BaseTX specification transmission of 100 Mbps on 2 twisted pair cables of category 5 is
described. Category 5 cables are suitable for data transmission up to 100 MHz. The connection
components used (plugs, connection outlets, patch panels, patch cords) must also correspond to category
5. The RJ45 connector familiar to 10BaseT as well as the sub-D9 connector for STP cables are specified.
A cabling system meets the requirements of a link class if a complete link from the active component to
the terminal (patch cord, patch panel, installation line, connection outlet, connection lead) is within the
specified limits. If components of different manufacturers are used, this is not always the case. Link class
D describes the link specified for data transmission of up to 100 MHz. SIMATIC NET industrial twisted
pair cables and connection components exceed category 5 requirements by far.
The 100BaseT4 specification describes transmission of 100 Mbps on 4 twisted conductor pairs of
categories 3, 4 and 5. The 3 conductor pairs are used for data transmission. The 4th Twisted pair is used
for transmission of collisions.
Category 3 cables were specified for transmission up to10 MHz in 10BaseT networks. Compared with
cables of category 5, category 3 cables are somewhat less expensive but have not been successful in
Europe due to its restrictions. Category 4 cables are familiar from token ring networks and are specified
for transmission of data up to 20 MHz. By far the largest proportion of twisted pair based Fast Ethernet
networks is designed in accordance with
100Base TX. One reason for this is that no full duplex mode is possible in 100Base T4 networks.
The 100BaseFX specification defines 100 Mbps transmission on two 62.5/125 mm fiber optic cables. The
MIC, ST, and SC connector types familiar from 10BaseFL or FDDI are used. Fiber optic technology is
suitable to cover large distances. In half duplex mode the maximum fiber-optic cable length is 412 meters
(point–to-point coupling of two network nodes). Of particular interest for connection of switches or
routers is the distance of up to 2000 meters with full duplex operation.
2.3.8 Industrial Ethernet

Communications requirements in an industrial environment differ significantly from those for a
conventional office environment. This is the case for almost all partial aspects of communications such as
active and passive network components, connected terminals, network designs and topologies,
availability, data emergence, and environmental conditions – to mention only a few.
Likewise network protocols are available which are especially optimized for industrial communications,
even though TCP/IP - a classical protocol from the office sector – has been used in the production and
process control field for a fairly long time. The basic idea of Industrial Ethernet is to exploit existing
standards and to extend them by necessary and useful details for industrial communication purposes.
Thus products are emerging for the special conditions of production or process environments: Industrial
Ethernet – Designed for Industry.
3.0 Other Topics
3.1 Variable Speed Drives (VSD)

The power required by the machines for its working is generally provided by electric motors. The electric
motors take electrical energy input and convert it into rotational mechanical energy output. This
mechanical energy drives the machine. The electrical power made available by State Electricity Boards,
at times for certain applications need to be modified and controlled in a specific manner before giving it
to the motor to get the desired performance from the motor.
Drive is nothing but the product that takes the available electrical power, converts it into the required
form and then gives it to the motor and in addition, provides required protection to the motor and the
system. Variable Speed Drives gives variable frequency, variable voltage to the motor in order to vary
speed of the motor.
Fixed V, fixed f Variable f,

AC supply variable V,
(C. E. B. Supply) Drive AC Supply
Various VSDs are available to control speed of motors. E.g. Siemens MICROMASTER, SIMOVERT
Parameters to the VSD can be given by a PLC and communicated using Bus systems such as Profibus.
3.2 Source File Management
A source file folder contains source programs in text format.
Position in the Project View
3.2.1 Basic Information on Programming in STL Source Files
You can enter your program or parts of it as an STL source file and then compile it into blocks in one
step. The source file can contain the code for a number of blocks, which are then compiled as blocks in
one compilation run.
Creating programs using a source file has the following advantages:
- You can create and edit the source file with any ASCII editor, then import it and compile it into
blocks using this application. The compilation process creates the individual blocks and stores them
in the S7 user program.
- You can program a number of blocks in one source file.
- You can save a source file even if it contains syntax errors. This is not possible if you create logic
blocks using an incremental syntax check. However, the syntax errors are only reported once you
compile the source file.
The source file is created in the syntax of the programming language representation Statement List (STL).
The source file is given its structure of blocks, variable declaration, and networks using keywords.
3.2.2 Exporting Source Files

To export a source file from a project to any destination directory:
1. Select the source file in the source file folder.
2. Select the menu command Edit > Export Source File in the SIMATIC Manager.
3. Enter the destination directory and file name in the dialog box displayed.
4. Click the "Save" button.
If the object name does not have a file extension, a file extension derived from the file type is added to the
file name. For example, the STL source file "prog" is exported to the file "prog.awl." If the object name
already has a valid file extension, this is retained and not changed. For example, the STL source file
"prog.awl" is exported to the file "prog.awl." If an object name has an invalid file extension (meaning a
period is contained in the name), no file extension is added. You will find a list of valid file extensions in
the "Export Source File" dialog box under "File type."
3.2.3 Importing Source Files

To import a source file from any directory into a project:
1. In the SIMATIC Manager, select the source file folder into which you want to import the source
file.
2. Select the menu command Insert > External Source File.
3. In the dialog box displayed, select the destination directory and the source file to be imported.
4. Click the "Open" button.
3.2.4 Creating STL Source Files

The source file must be created in the source file folder beneath the S7 program. You can create source
files in the SIMATIC Manager or the editor window.
Creating Source Files in the SIMATIC Manager
1. Open the appropriate "Source Files" folder by double-clicking on it.
2. To insert an STL source file select the menu command Insert > S7 Software > STL Source File.
Creating Source Files in the Editor Window
1. Select the menu command File > New.
2. In the dialog box, select the source file folder of the same S7 program that contains the user
program with the blocks.
3. Enter a name for the new source file.
4. Confirm with "OK".
The source file is created under the name you entered and is displayed in a window for editing.
3.2.5 Checking Consistency in STL Source Files

Using the menu command File > Consistency Check you can display any syntax errors in the STL source
file. In contrast to compiling, no blocks are generated.
When the consistency check is completed, a dialog box is displayed showing you the total number of
errors found.
Any errors that are found are listed individually in the lower part of the window with a line reference.
Correct these errors before compiling the source file so that all the blocks can be created.
3.2.6 Compiling STL Source Files

In order to be able to compile the program you created in a source file into blocks, the following
requirements must be fulfilled:
- Only source files which are stored in the "Source Files" folder beneath an S7 program can be
compiled.
- As well as the "Source Files" folder, a "Blocks" folder must also lie beneath the S7 program in
which the blocks created during compilation can be stored. The blocks programmed in the source
file are only created if the source file was compiled without error. If there are a number of blocks
programmed in a source file, only those which contain no errors are created. You can then open
these blocks, edit them, download them to the CPU, and debug them individually.
Procedure in the Editor
1. Open the source file you want to compile. The source file must be in the source file folder of the
S7 program in whose S7 user program the compiled blocks are to be stored.
2. Select the menu command File > Compile.
3. The "Compiler Report" dialog box is displayed showing the number of lines compiled and syntax
errors found.
The blocks specified for the file are only created once the source file has been compiled without errors. If
there are a number of blocks programmed in a source file, only those which contain no errors are created.
Warnings of errors do not prevent blocks being created.
Any syntax errors detected during compilation are shown in the lower part of the working window and
must be corrected before the respective blocks can be created.
Procedure in the SIMATIC Manager
1. Open the appropriate "Source Files" folder by double-clicking on it.
2. Select one or more source files that you want to compile. You cannot start a compilation run for a
closed source file folder to compile all the source files in it.
3. Select the menu command File > Compile to start compilation. The correct compiler is called for
the source file you selected. The successfully compiled blocks are then stored in the block folder beneath
the S7 program.
Any syntax errors detected during compilation are displayed in a dialog box and must be corrected so that
the blocks where the errors were found can be created as well.
4.0 SAGT Plant Configuration
4.1 Hardware available in SAGT system

4.1.1 CPU
- CPU 318-2: Work memory 256KB; 0.1ms/1000 instructions; combined MPI/DP connection
(MPI or DP master or DP slave); multiline structure up to 32 modules; send and
receive capability for direct data exchange; constant bus cycle time; routing; S7
communication (loadable FBs/FCs); firmware V3.0
- Back-up Battery Memory back-up battery
- Memory Card (256KB) EEPROM memory pf the CPU
4.1.2 Communication processors and Systems
- CP 341-RS422/485: Communication processor with connection
- CP 343-1: Communication processor for Industrial Ethernet TCP/IP with SEND/RECEIVE
and FETCH/WRITE interface, PROFINET IO controller, PROFINET CbA, long
data, UDP, TCP, ISO, S7 communication, routing, module replacement without
PG, 10/100 Mbps, fixed MAC address, initialization over LAN, IP multicast,
NTP, DHCP, IP configuration using DHCP/ FB, firmware V1.0
- IM 153-1: Bus interface module for S7-300 SMs, FM 350 to FM 352, FM 355, CP 340 to CP
342-2, module exchange in operation, publisher capability for lateral
communication
- Bus Connectors
- Profibus cables and connectors
- Ethernet cables
- RS 485/ 232 cables
4.1.3 I/O modules

- S7-300 DI Module 16 x 24V DC Digital Inputs24V DC - 16 No.
- S7-300 DI Module 16 x 120/230V AC Digital Inputs 230V AC- 16 No.
- S7-300 DO Module 16 x Relay Digital Outputs Relay- 16 No.
- S7-300 AI Module 2AI Analog Input module- 2 No.
- Front Connector 20pin Connectors for Input/ Output modules
- Bus Connector Connectors for RS 485 Connection
4.1.4 Accessories
- Din Rail L=482mm Rail for mounting
- PS 307 5A: Load supply voltage 120 / 230 VAC:24 VDC / 5 A
- PC adapter Connect PG (Computer) and PLC via MPI port for programming
- STEP 7- Professional software Programming, debugging and fault finding.
Other Items
- Ethernet Access points (computer and printer, antenna to transmit data to Maintenance office)
- Simovert Inverters (VSD) controlled via Profibus-DP
- Transponder reader via RS 422
- Cabin Terminal at Operator’s Cabin communicated via RS 232C
- Faulty Display unit at Operator’s Cabin communicated via RS 232C

S7-300 Note

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

S7-300 Note

Uploaded by

Copyright:

Available Formats

Siemens S7-300 and STEP 7 1

Siemens S7-300 and

Nikini Automation Systems (Pvt) Ltd.

2.0 Introduction to Industrial communication

3.0 Other Topics

4.0 SAGT Plant Configuration

1.1.1 How does a PLC drive a process?

1.1.3 How does a PLC communicate with in/output signals?

1.1.4 How does the program work in a PLC?

1.1.5 Memory areas of S7 CPUs

Load Memory and Work Memory

Byte, Word and Double Word Addressing

CPU: e.g. 318 2 DP

1.2.2 Analog modules

Analog Outputs: Characteristics

1.2.3 Example of a S7-300 configuration

Power supply Memory Card

On/ Off Switch

Battery MPI Interface

RUN-P: Program runs; All PG functions are allowed

RUN: Program runs; Only read PG functions are allowed

STOP: Program does not run: All PG functions are allowed

MRES: With this position, one can accomplish a reset

1.3.1 Program Interface Adjustment (PC- Adapter)

Address of the CPU is also shown, which is calibrated with a 2 ( ).

1.3.2 Configuring Hardware

When Should You "Configure Hardware"?

Basic Steps for Configuring a Station

Configuration Table as a Representation of a Rack

Configuring Central Racks

Slot Rules (S7-300)

How to Configure Central Racks

Arranging the Central Rack

Symbol that appears when the slot rules are violated.

Assigning Properties to Modules/Interfaces

Assigning I/O Addresses

Displaying the Address Overview

Assigning Symbols to I/O Addresses

Saving a Configuration and Checking the Consistency

Downloading a Configuration to a Programmable Controller

Uploading a Configuration from a Station

1.3.3 The Project Structure in the SIMATIC Manager

• Extensive programs are easier to understand.

Organization Blocks and Program Structure

1.3.5 Creating a Program in OB1

- Click in the title area of OB1 and enter

1.3.6 Downloading the Program

Downloading the Program to the CPU

Restart (Warm Restart (Transition to RUN Mode)

Switching on the CPU and Checking the Operating Mode

Downloading individual blocks

Testing the Program with Program Status

1.3.7 Uploading from the Programmable Controller to the PG/PC

1.4.2 Timer Instructions

1.4.3 Counter Instructions

1.4.4 Comparison Instructions

1.4.5 Move Instructions

1.4.7 Analog value processing

Inputting/Outputting Analog Values

1.4.8 Conversion Instructions

1.4.10 Word Logic Instructions

• WAND_W (Word) AND Word

1.5.2 Data blocks