TaRR - PCT - ILT12451 Siemens Step 7 Programming Essentials Course Notes

Siemens Step 7
Programming essentials for the Siemens S7 300 / 400 Series

Welcome to the Process
Control Training Centre.
Our training packages have

been designed to meet the
requirements of working in
the field.
Please ask any questions

that relate to this subject.
2 watercorporation.com.au
I would like to acknowledge the Traditional Owners of the land on which we meet today, the
Acknowledgement of traditional owners
Whadjuk Nyoongar people, and pay my respects to Elders past, present and emerging.
3 Acknowledgement of Country
Training Areas
• Data Types
• Logic Operations
• Simple Inputs and Outputs
• Input Transition using Edge Detection
• Digital Logic Inversion
• Midpoint and Latching Outputs
• Timers
• Counters
• Scaling
• Data Type Conversions
4 Process Control Training Centre Maximum Performance Delivered Through Field Focused Training
Safety
Site Safety
• Siemens PLCs are used to both monitor and control many of the Water Corporation’s assets. Therefore care must be
taken when carrying out any maintenance procedures that may cause undesired effects on the control of these assets.
• PLC cubicles contain a variety of voltages and communications devices with varying signals.
• Equipment mounting locations provide restricted or abnormal positioning of the persons body to access individual
components.
• The cabinets can be in remote locations where snakes, spiders and ticks may be present.
• Read and follow instructions contained in the latest Safe Work Instruction.
Process Control Training Centre Safety

• The Process Control Training Centre contains a number of live PLCs and instruments.
• Be aware of 24VDC, 240VDC voltages as well as equipment protruding from the panels.
• Communications cables used during practical activities may create a trip hazard where mitigation against such a risk is not
possible.
• If an evacuation is required from this training centre, please follow all directions given to you by your trainer or site warden.
Data Types
Step 7 programming can request data from several areas for each type of instruction.
Recognising the data type can assist with fault finding and making changes to existing logic.
Physical References
• I Process Image Input Table: This data type is the result of a digital input being applied to a digital input module.
• Q Process Image Output Table: This data type will result in a physical digital output being changed.
• PI Direct peripheral input area (I): This data type is the result of an analog input being applied to an analog input module.
• PQ Direct peripheral output area (Q): This data type will result in a physical analog output being changed.
Internal References
• M A memory area in the system memory of a SIMATIC S7 CPU. This area can be accessed using write or read access (bit, byte, word, and double
word). The bit memory area can be used by the user to store interim results.
• T Timers are an area in the system memory of the CPU. The contents of these timers is updated by the operating system asynchronously to the user
program.
• C Counters are an area in the system memory of the CPU. The contents of these counters can be changed using STEP 7 instructions (for example,
up counter, down counter).
• D Data blocks are areas in the user program which contain user data. These are available in two types. Shared data blocks are available to be
accessed by all logic and are a storage container for any type of data. Instance data blocks are the storage space for a Function Block (FB) and
their internal structure is based on the definition created in the Function Block. Although other logic can access this datablock directly, this is bad
practice as the access cannot be found in the cross-reference table.
• L Local data of a block is the temporarily assigned locations that are only available during the execution of the block. There are two ways to use local
data: Directly defining it in logic, ie. L#0.0, LW#4, or defining it in the TEMP section of the declarations block. Local data areas should be initialized
before use as previous operations may have conflicting data values remaining.
Data Types
Clock Memory
• The clock memory is a memory byte that changes its binary
state periodically at a pulse-pause ratio of 1:1.
• You select which memory byte is used on the CPU when you
assign parameters for the CPU using the STEP 7 Hardware
Configuration package.
Procedure
1 second pulse example:
• Open the STEP 7 Hardware Configuration package. 0.5 seconds ON and 0.5 seconds OFF
• Double click on the CPU slot to show the properties window.
• Select the Cycle/Clock Memory tab.
• Tick the Clock Memory check box at the bottom of the page.
• Enter a free memory location for the Clock Memory to occupy.
• Close all windows, save the new hardware configuration, and
download it to the PLC.
Data Types
Available times
• Each bit of the clock memory byte is assigned a frequency. The following table shows the assignment:
Clock memory bytes are not synchronous with the CPU cycle, in other words, in long cycles, the state of the clock memory byte may change several times.
Usage
• Insert a normally open contact into the network and assign the memory byte.bit reference to utilise the clock pulse.
Data Types
Function block data type usage
D
M An Instance Data Block defined with the
An internal memory area used for requirements of the Function Block (FB).
storing digital and numerical data
from the result of logical or
mathematical operations
I
Process Image Input Table:
This reads the value of a Digital
Input
PI
Direct peripheral input area (I):
This reads the integer value of an Q
Analog Input card Process Image Output Table:
This drives a Digital Output
PQ
Direct peripheral output area (Q):
This is an integer value that drives an
Analog Output
Data Types
Defined Local Data
Static Data is stored in the instance data

block attached to the function block until
it is next processed. This type of data is
required to keep track of items such as
timer values.
Temporary Data is used to store values only while the block is

being processed. A common use of this type of data is when
mathematical calculations are done. The result of one calculation is
needed to feed the next calculation. This value is then no longer
needed and can be discarded.
Logic Operations
HOW DO THE LOGIC OPERATIONS IN A PLC PROGRAM APPEAR?
OR- OPERATION Circuit Diagram:
S1 ( I 0.0 )
The lamp lights when one or both H1 24V
switches are active. S2 ( I 0.2 )
When the switch S1 OR S2 is 24V
active, lamp H1 will light up.
H1
M
S1 ( I 0.0 )
24V
H1 S2 ( I 0.2 )
24V
H1
M
Logic Operations
HOW DO THE LOGIC OPERATIONS IN A PLC PROGRAM APPEAR?
AND- OPERATION Circuit diagram:
S1 ( I 0.0 ) S2 ( I 0.1 )
The lamp lights when both
switches are active. 24V
H1
When the switch S1 AND S2 are H1
active, the lamp H1 will light up. M
S1 ( I 0.0 ) S2 ( I 0.1 )
24V
H1
H1
M
Result of Logic Operation (RLO)

The result of logic operation (RLO) is the current result of a series of logic operations in the processor which is then
used to further process signals digitally. Certain instructions are either executed or not, depending on the last RLO. In
this example, the RLO of I0.0 and I0.1 is 1 because both contacts are closed in the field. The RLO equaling 1
activates the output.
Simple Inputs and Outputs
---| |--- Normally Open Contact
Parameter Data Type Memory Area Description

<address> BOOL I, Q, M, L, D, T, C Checked bit
---| |--- (Normally Open Contact) is closed when the bit value stored at the specified <address> is equal to "1". When the contact is closed, ladder rail
power flows across the contact and the result of logic operation (RLO) = "1".
Otherwise, if the signal state at the specified <address> is "0", the contact is open. When the contact is open, power does not flow across the contact and the
result of logic operation (RLO) = "0".
When used in series, ---| |--- is linked to the RLO bit by AND logic. When used in parallel, it is linked to the RLO by OR logic.
RLO=1
RLO=0
Example
Power flows if one of the following conditions exists:
The signal state is "1" at inputs I0.0 and I0.1
Or the signal state is "1" at input I0.2

RLO=1
---| / |--- Normally Closed Contact

<address> BOOL I, Q, M, L, D, T, C Checked bit
---| / |--- (Normally Closed Contact) is closed when the bit value stored at the specified <address> is equal to "0". When the contact is closed, ladder
rail power flows across the contact and the result of logic operation (RLO) = "1".
Otherwise, if the signal state at the specified <address> is "1", the contact is opened. When the contact is opened, power does not flow across the contact and
the result of logic operation (RLO) = "0".
When used in series, ---| / |--- is linked to the RLO bit by AND logic. When used in parallel, it is linked to the RLO by OR logic.
RLO=1
Example
Power flows if one of the following conditions exists: RLO=0
The bit value is "1" at inputs I0.0 and I0.1
Or the bit value is “0" at input I0.2
RLO=1
---( ) Output Coil

<address> BOOL I, Q, M, L, D Assigned bit
---( ) (Output Coil) works like a coil in a relay logic diagram. If there is power flow to the coil (RLO = 1), the bit at location <address> is set to "1". If there is no
power flow to the coil (RLO = 0), the bit at location <address> is set to "0". An output coil can only be placed at the right end of a ladder rung. Multiple output
elements (max. 16) are possible (see example). A negated output can be created by using the ---|NOT|--- (invert power flow) element.
Example RLO=1
The signal state of output Q4.0 is "1" if one of the following conditions exists:
Or the signal state is "0" at input I0.2.
The signal state of output Q4.1 is "1" if one of the following conditions exists:
Or the signal state is "0" at input I0.2 and "1" at input I0.3
RLO=0
Activity 1
Input Transition using Edge Detection
---( P )--- Positive RLO Edge Detection

<address> BOOL I, Q, M, L, D Edge memory bit, storing the previous signal state of RLO
---( P )--- (Positive RLO Edge Detection) detects a signal change in the address from "0" to "1" and displays it as RLO = "1" after the instruction. The current signal
state in the RLO is compared with the signal state of the address, the edge memory bit. If the signal state of the address is "0" and the RLO was "1" before the
instruction, the RLO will be "1" (pulse) after this instruction, and "0" in all other cases. The RLO prior to the instruction is stored in the address.
Example
The edge memory bit M0.0 saves the old RLO state. When there
is a signal change at the RLO from "0" to "1", the program jumps
to label CAS1.
---( N )--- Negative RLO Edge Detection

<address> BOOL I, Q, M, L, D Edge memory bit, storing the previous signal state of RLO
---( N )--- (Negative RLO Edge Detection) detects a signal change in the address from "1" to "0" and displays it as RLO = "1" after the instruction. The
current signal state in the RLO is compared with the signal state of the address, the edge memory bit. If the signal state of the address is "1" and the RLO
was "0" before the instruction, the RLO will be "1" (pulse) after this instruction, and "0" in all other cases. The RLO prior to the instruction is stored in the
address.
Example
The edge memory bit M0.0 saves the old RLO state. When there
is a signal change at the RLO from "1" to "0", the program jumps
to label CAS1.
NEG Address Negative Edge Detection

<address1> BOOL I, Q, M, L, D Scanned signal
<address2> BOOL I, Q, M, L, D M_BIT edge memory bit, storing the previous signal state of <address 1>
Q BOOL I, Q, M, L, D One shot output
NEG (Address Negative Edge Detection) compares the signal state of <address1> with the signal state from the
previous scan, which is stored in <address2>. If the current RLO state is "1" and the previous state was "0" (detection of
rising edge), the RLO bit will be "1" after this instruction.
Example
The signal state at output Q4.0 is "1" if the following conditions exist:
The signal state is "1" at inputs I0.0 and I0.1 and I0.2
And there is a negative edge at input I0.3
And the signal state is "1" at input I0.4
POS Address Positive Edge Detection

<address1> BOOL I, Q, M, L, D Scanned signal
<address2> BOOL I, Q, M, L, D M_BIT edge memory bit, storing the previous signal state of <address 1>
Q BOOL I, Q, M, L, D One shot output
POS (Address Positive Edge Detection) compares the signal state of <address1> with the signal state from the previous
scan, which is stored in <address2>. If the current RLO state is "1" and the previous state was "0" (detection of rising
edge), the RLO bit will be "1" after this instruction.
Example
The signal state at output Q4.0 is "1" if the following conditions exist:
The signal state is "1" at inputs I0.0 and I0.1 and I0.2
And there is a positive edge at input I0.3
And the signal state is "1" at input I0.4
Activity 2
Digital Logic Inversion
--|NOT|-- Invert Power Flow
---|NOT|--- (Invert Power Flow) negates the RLO bit.
Example
The signal state of output Q4.0 is "0" if one of the following

conditions exists:
RLO=1 RLO=0
The signal state is "1" at input I0.0
Or the signal state is "1" at inputs I0.1 and I0.2.
Midline Outputs
---( # )--- Midline Output

<address> BOOL I, Q, M, *L, D Assigned bit
* An L area address can only be used if it is declared TEMP in the variable declaration table of a logic block (FC, FB, OB).
---( # )--- (Midline Output) is an intermediate assigning element which saves the RLO bit (power flow status) to a specified <address>. The midline output
element saves the logical result of the preceding branch elements. In series with other contacts, ---( # )--- is inserted like a contact. A ---( # )--- element may
never be connected to the power rail or directly after a branch connection or at the end of a branch. A negated ---( # )--- can be created by using the ---|NOT|---
(invert power flow) element.
Example
Latching Outputs - Set
---( S ) Set Coil

<address> BOOL I, Q, M, L, D Set bit
---( S ) (Set Coil) is executed only if the RLO of the preceding instructions is "1" (power flows to the coil). If the RLO is
"1" the specified <address> of the element is set to "1".
An RLO = 0 has no effect and the current state of the element's specified address remains unchanged.
Example
The signal state of output Q4.0 is "1" if one of the following

conditions exists:

If the RLO is "0", the signal state of output Q4.0 remains
unchanged.
Latching Outputs - Set
---( S ) Set Coil
Q4.0 will turn on if the following conditions exists:
Q4.0 will remain on even though the signal state at

inputs I0.0 and I0.1 change back to “0”.
Q4.0 will only turn off when a RESET Coil is used.
Latching Outputs - Reset
---( R ) Reset Coil

<address> BOOL I, Q, M, L, D, T, C Reset bit
---( R ) (Reset Coil) is executed only if the RLO of the preceding instructions is "1" (power flows to the coil). If power
flows to the coil (RLO is "1"), the specified <address> of the element is reset to "0". A RLO of "0" (no power flow to the
coil) has no effect and the state of the element's specified address remains unchanged. The <address> may also be a
timer (T no.) whose timer value is reset to "0" or a counter (C no.) whose counter value is reset to "0".
Example
The signal state of output Q4.0 is reset to "0" if one of the
following conditions exists:

If the RLO is "0", the signal state of output Q4.0 remains
unchanged.
Latching Outputs - Reset
---( R ) Reset Coil
Q4.0 will turn off if the following conditions exists:
Q4.0 will remain off until the set relay is initiated.
The signal state of timer T1 is only reset if:

the signal state is "1" at input I0.3.
The signal state of counter C1 is only reset if:

the signal state is "1" at input I0.4.
Activity 3
Timers
S_ODT On-Delay S5 Timer

T no. TIMER T Timer identification number; range depends on CPU
S BOOL I, Q, M, L, D Start input
TV S5TIME I, Q, M, L, D Preset time value
R BOOL I, Q, M, L, D Reset input
BI WORD I, Q, M, L, D Remaining time value, integer format
BCD WORD I, Q, M, L, D Remaining time value, BCD format
Q BOOL I, Q, M, L, D Status of the timer
S_ODT (On-Delay S5 Timer) starts the specified timer if there is a positive edge at the start (S) input. A signal change is
always necessary in order to enable a timer. The timer runs for the time interval specified at input TV as long as the signal
state at input S is positive. The signal state at output Q is "1" when the timer has elapsed without error and the signal
state at the S input is still "1". When the signal state at input S changes from "1" to "0" while the timer is running, the timer
is stopped. In this case the signal state of output Q is "0".
The timer is reset if the reset (R) input changes from "0" to "1" while the timer is running. The current time and the time
base are set to zero. The signal state at output Q is then "0". The timer is also reset if there is a logic "1" at the R input
while the timer is not running and the RLO at input S is "1".
The current time value can be scanned at the outputs BI and BCD. The time value at BI is binary coded, at BCD is BCD
coded. The current time value is the initial TV value minus the time elapsed since the timer was started.
Timers
SFB 4 On-Delay IEC Timer
SFB 4 "TON" delays a rising signal edge by the time PT. The timer runs only in the STARTUP and RUN modes.
• A rising edge at the IN input causes a rising edge at output Q after the time PT has expired. Q then remains set until the IN input
changes to 0 again. If the IN input changes to 0 before the time PT has expired, output Q remains set to 0.
• The ET output provides the time that has passed since the last rising edge at the IN input. Its maximum value is the value of the PT
input. ET is reset when the IN input changes to 0.
• SFB 4 "TON" complies with the IEC 1131-3 standard.
• The operating system resets the instances of SFB 4 "TON" during a cold restart. If you want instances of this SFB to be initialized
following a warm restart, you must call SFB 4 with PT = 0 ms in OB100. If instances of this SFB are located within another block, you
can reset these instances, for example, by initializing the higher-level block.
Parameter Declaration Data Type Memory Area Description
IN INPUT BOOL I, Q, M, D, L, constant Start input

PT INPUT TIME I, Q, M, D, L, constant Time by which the rising edge at the IN input is delayed. PT must be positive. (Note: the range
of values is fixed by the TIME data type – t#10s)
Q OUTPUT BOOL I, Q, M, D, L Status of the time
ET OUTPUT TIME I, Q, M, D, L Expired time
Timers
S_OFFDT Off-Delay S5 Timer Siemens Help Information

T no. TIMER T Timer identification number; range depends on CPU
S BOOL I, Q, M, L, D Start input
TV S5TIME I, Q, M, L, D Preset time value
BI WORD I, Q, M, L, D Remaining time value, integer format
BCD WORD I, Q, M, L, D Remaining time value, BCD format
Q BOOL I, Q, M, L, D Status of the timer
S_OFFDT (Off-Delay S5 Timer) starts the specified timer if there is a negative edge at the start (S) input. A signal
change is always necessary in order to enable a timer. The signal state at output Q is "1" if the signal state at the S input
is "1" or while the timer is running. The timer is reset when the signal state at input S goes from "0" to "1" while the timer
is running. The timer is not restarted until the signal state at input S changes again from "1" to "0".
The timer is reset when the reset (R) input changes from "0" to "1" while the timer is running.
The current time value can be scanned at the outputs BI and BCD. The time value at BI is binary coded, at BCD it is
BCD coded. The current time value is the initial TV value minus the time elapsed since the timer was started.
Timers
SFB 5 Off-Delay IEC Timer
SFB 5 "TOF" delays a falling edge by the time PT. The timer runs only in the STARTUP and RUN modes.
• A rising edge at the IN input causes a rising edge at output Q. A falling edge at the IN input causes a falling edge at output Q
delayed by the time PT. If the IN input changes back to 1 before the time PT has expired, output Q remains set to 1. The ET output
provides the time that has elapsed since the last falling edge at the IN input. Its maximum value is, however the value of the PT
input. ET is reset when the IN input changes to 1.
• SFB 5 "TOF" complies with the IEC 1131-3 standard.
• The operating system resets the instances of SFB 5 "TOF" during a cold restart. If you want instances of this SFB to be initialized
following a warm restart, you must call SFB 5 with PT = 0 ms in OB100. If instances of this SFB are located within another block,
you can reset these instances, for example, by initializing the higher-level block.
IN INPUT BOOL I, Q, M, D, L, constant Start input

PT INPUT TIME I, Q, M, D, L, constant Time by which the falling edge at the IN input is delayed. PT must be positive.
(Note: the range of values is fixed by the TIME data type – t#10s)
Q OUTPUT BOOL I, Q, M, D, L Status of the time
ET OUTPUT TIME I, Q, M, D, L Expired time
Timers
Delay On Timer Delay Off Timer
When the input (IN) signal state goes from “0” to “1”, When the input (IN) signal state goes from “1” to “0”,
the timer starts counting up to the preset time period the timer starts counting up to the preset time period
(PT). The output (Q) signal state is “0”. (PT). The output (Q) signal state is “1”.
After the preset time period has expired and the input After the preset time period has expired and the
(IN) signal state remains a “1”, output (Q) changes input (IN) signal state remains a “0”, output (Q)
state from “0” to “1”. changes state from “1” to “0”.
If at any point during the timing count the input (IN) If at any point during the timing count the input (IN)
signal state changes from a “1” to a “0”, the elapsed signal state changes from a “0” to a “1”, the elapsed
time is reset to zero. Counting will restart when the time is reset to zero. Counting will restart when the
input (IN) signal state changes from “0” to “1” again. input (IN) signal state changes from “1” to “0” again.
Activity 4
Counters
S_CU Up Counter

C no. COUNTER C Counter identification number; range depends of CPU
CU BOOL I, Q, M, L, D Count up input
S BOOL I, Q, M, L, D Set input for presetting counter
PV WORD I, Q, M, L, D Enter counter value as C#<value>
or constant in the range from 0 to 999
PV WORD I, Q, M, L, D Value for presetting counter
CV WORD I, Q, M, L, D Current counter value, hexadecimal number
CV_BCD WORD I, Q, M, L, D Current counter value, BCD coded
Q BOOL I, Q, M, L, D Status of the counter
• S_CU (Up Counter) is preset with the value at input PV if there is a positive edge at input S.
• The counter is reset if there is a "1" at input R and the count value is then set to zero.
• The counter is incremented by one if the signal state at input CU changes from "0" to "1" and the value of the
counter is less than "999".
• If the counter is set and if RLO = 1 at the inputs CU, the counter will count accordingly in the next scan cycle, even if
there was no change from a positive to a negative edge or vice versa.
• The signal state at output Q is "1" if the count is greater than zero and "0" if the count is equal to zero.
Counters
S_CU Up Counter
Step 7 counters change their output from Off to On as soon as the current counter value is greater than zero. Triggering an output, a preset number
requires another rung with comparison logic to compare the preset value with the current counter value. The reset input will zero the current counter
value and set the output to Off.
Example
If I0.2 changes from "0" to "1", the counter is preset with the value of MW10.
If the signal state of I0.0 changes from "0" to "1", the value of counter C10 will be
incremented by one - unless the value of C10 is equal to "999".
Q4.0 is "1" if C10 is not equal to zero.
Counters
SFB 0 IEC Counter - UP
• You can count up with IEC SFB 0 "CTU." The counter is incremented by 1 by a rising edge at the CU input (compared with the last SFB
call). If the counted value reaches the upper limit of 32767, it is no longer incremented. Each subsequent rising edge at the CU input no
longer has an effect.
• Signal level 1 at the R input resets the counter to the value 0 regardless of the value currently at the CU input.
• The Q output indicates whether the current counted value is greater or equal to the preset value PV.
• SFB 0 "CTU" complies with the IEC 1131-3 standard.
• The operating system resets the instances of SFB 0 "CTU" during a cold restart. If you want instances of this SFB to be initialized
following a warm restart, you must call SFB 0 with R = 1 in OB100. If instances of this SFB are located within another block, you can
reset these instances, for example, by initializing the higher-level block.
CU INPUT BOOL I, Q, M, D, L, constant Counter input

R INPUT BOOL I, Q, M, D, L, constant Reset input R is dominant over CU.
PV INPUT INT I, Q, M, D, L, constant Preset value. Refer to parameter Q for the effect of PV.
Q OUTPUT BOOL I, Q, M, D, L Status of the counter: Q has the following value
1, if CV > PV ; 0 otherwise
CV OUTPUT INT I, Q, M, D, L Current count value
(possible value: 0 to 32 767)
Counters
SFB 0 IEC Counter - UP
IEC counters change their output from Off to On as soon as the current counter value is equal to the preset value. Triggering an output at a preset
number requires no extra rungs of logic. The reset input will zero the current counter value and set the output to Off.
Counters
S_CD Down Counter

C no. COUNTER C Counter identification number; range depends of CPU
CD BOOL I, Q, M, L, D Count down input
PV WORD I, Q, M, L, D Enter counter value as C#<value>
or constant in the range from 0 to 999
Q BOOL I, Q, M, L, D Status counter
• S_CD (Down Counter) is set with the value at input PV if there is a positive edge at input S.
• The counter is reset if there is a 1 at input R and the count value is then set to zero.
• The counter is decremented by one if the signal state at input CD changes from "0" to "1" and the value of the
counter is greater than zero.
• If the counter is set and if RLO = 1 at the inputs CD, the counter will count accordingly in the next scan cycle, even
if there was no change from a positive to a negative edge or vice versa.
Counters
S_CD Down Counter
Step 7 counters change their output from Off to On as soon as the current counter value is greater than zero. Triggering an output at a preset number requires
another rung with comparison logic to compare the preset value with the current counter value. The reset input will zero the current counter value and set the
output to Off. The set input will change the current counter value to the preset value. This will also change the output from Off to On as the current counter
value no longer equals zero.
Example
If I0.2 changes from "0" to "1", the counter is preset with the value of MW10. If the
signal state of I0.0 changes from "0" to "1", the value of counter C10 will be
decremented by one - unless the value of C10 is equal to "0". Q4.0 is "1" if C10 is
not equal to zero.
Counters
SFB 1 IEC Counter - DOWN
• You can count down with IEC SFB 1 "CTD." The counter decrements at a rising edge on the CD input (compared with the last SFB call).
If the count value reaches the lower limit of -32768, it no longer decrements. Any further rising edge at the CD input then has no further
effect.
• Signal level 1 at the LOAD input sets the counter to the preset value PV regardless of the value at the CD input.
• The Q output indicates whether the current counted value is less than or equal to 0.
• SFB 1 "CTD" complies with the IEC 1131-3 standard.
• The operating system resets instances of SFB 1 "CTD" during a cold restart. If you want instances of this SFB to be initialized following
a warm restart, you must call SFB 1 with LOAD = 1 and PV = required initial value for CV in OB100. If instances of this SFB are located
within another block, you can reset these instances, for example, by initializing the higher-level block.
CD INPUT BOOL I, Q, M, D, L, constant Count input

LOAD INPUT BOOL I, Q, M, D, L, constant Load input LOAD is dominant over CD.
PV INPUT INT I, Q, M, D, L, constant Preset value. The counter is preset to PV when the signal level at the LOAD input is 1.
Q OUTPUT BOOL I, Q, M, D, L Status of the counter: Q has the following value , if CV =< PV ; 0 otherwise
OUTPUT INT I, Q, M, D, L Current count value (possible value: -32768 to 32767)
Counters
SFB 1 IEC Counter - DOWN
IEC step down counters change their output from Off to On as soon as the current counter value is equal to zero. Triggering an output at a preset number
requires another rung with comparison logic to compare the preset value with the current counter value. The load input will change the current counter value to
the preset value. This will also change the output from On to Off as the current counter value no longer equals zero.
Counters
S_CUD Up-Down Counter

C no. COUNTER C Counter identification number;
range depends on CPU
CU BOOL I, Q, M, L, D Count up input
CD BOOL I, Q, M, L, D Count down input
PV WORD I, Q, M, L, D Enter counter value as C#<value> in the range or constant from 0 to 999
Q BOOL I, Q, M, L, D Status of the counter
• S_CUD (Up-Down Counter) is preset with the value at input PV if there is a positive edge at input S. If there is a 1 at
input R, the counter is reset and the count is set to zero. The counter is incremented by one if the signal state at
input CU changes from "0" to "1" and the value of the counter is less than "999". The counter is decremented by one
if there is a positive edge at input CD and the value of the counter is greater than "0".
• If there is a positive edge at both count inputs, both instructions are executed and the count value remains
unchanged.
• If the counter is set and if RLO = 1 at the inputs CU/CD, the counter will count accordingly in the next scan cycle,
even if there was no change from a positive to a negative edge or vice versa.
Counters
S_CUD Up-Down Counter
Step 7 Step Up / Step Down counters change their output from Off to On as soon as the current counter value is greater than zero. The current counter value is
increased or decreased dependant on which input is used, count up (CU) or count down (CD). Triggering an output at a preset number requires another rung
with comparison logic to compare the preset value with the current counter value. The reset input will zero the current counter value and set the output to Off.
The set input will change the current counter value to the preset value. This will also change the output from Off to On as the current counter value no longer
equals zero.
Example
If I0.2 changes from "0" to "1", the counter is preset with the value of MW10. If the
signal state of I0.0 changes from "0" to "1", the value of counter C10 will be
incremented by one - except when the value of C10 is equal than "999". If I0.1
changes from "0" to "1", C10 is decremented by one - except when the value of C10
is equal to "0". Q4.0 is "1" if C10 is not equal to zero.
Counters
SFB 2 IEC Counter – UP / DOWN
You can count up and down with SFB 2 "CTUD." The count value is changed by a rising edge, compared with the last SFB call as follows:
· At input CU it is incremented by 1
· At input CD it decrements by 1.
If the count value reaches the limits, the counter reacts as follows:
· The lower limit of -32768, it is no longer decrements
· The upper limit of 32767, it is no longer incremented.
If there is a rising edge at both input CU and input CD in one cycle, the counter retains its current value.
This reaction does not comply with the standard IEC 1131-3. In the standard, the CU input is dominant if both signals are active at the same
time. This change has been proposed to the IEC.
A signal level 1 at the LOAD input presets the counter to the value PV regardless of the values at the CU and CD inputs.
The signal level 1 at the R input resets the counter to the value 0 regardless of the values at the CU, CD and LOAD inputs.
The QU output indicates whether the current count value is greater than or equal to the preset value PV; the QD output indicates whether the
value is less than or equal to 0.
The operating system resets SFB 2 "CTUD" during a cold restart. If you want SFB 2 "CTUD" to be initialized following a warm restart, you must
call SFB 2 in OB100 as follows:
· With R = 1 when using the block to count up
· With R = 0 and LOAD = 1 and PV = required initial value for CV when using the block to count down
If instances of this SFB are located within another block, you can reset these instances, for example, by initializing the higher-level block.
Counters
SFB 2 IEC Counter – UP / DOWN
CU INPUT BOOL I, Q, M, D, L, constant Count up input.

CD INPUT BOOL I, Q, M, D, L, constant Count down input
R INPUT BOOL I, Q, M, D, L, constant Reset input. R is dominant over LOAD.
LOAD INPUT BOOL I, Q, M, D, L, constant Load input. LOAD is dominant over CU and CD.
PV INPUT INT I, Q, M, D, L, constant Preset value. The counter is set to the preset value PV when the signal level at the LOAD
input is 1.
QU OUTPUT BOOL I, Q, M, D, L Status of the up counter:QU has the following value 1, if CV >PV ; 0 otherwise
QD OUTPUT BOOL I, Q, M, D, L Status of the down counter:QD has the following value 1, if CV < 0 ; 0 otherwise
CV OUTPUT INT I, Q, M, D, L Current count value (possible values: -32 768 to 32 767)
The IEC Step Up / Down counter works the same as the

individual IEC Counters. The main difference is that this
counter has two outputs, one for the count up function and
one for the count down function.
Activity 5
Scaling
Scaling Values: FC105
All analog inputs start as an integer with the range of 0 to 27648. To enable engineering calculations to be performed, the integer is converted to a real
number and scaled between two set values.
Parameter Declaration Data type Memory area Description

EN Input BOOL I,Q,M,D,L Enable input with signal state of 1 activates the box.
ENO Output BOOL I,Q,M,D,L Enable output has a signal state of 1 if the function is executed without error.
IN Input INT I,Q,M,D,L,P, The input value to be scaled to a real value in engineering units.
Constant
HI_LIM Input REAL I,Q,M,D,L,P, Upper limit in engineering units.
Constant
LO_LIM Input REAL I,Q,M,D,L,P, Lower limit in engineering units.
Constant
BIPOLAR Input BOOL I,Q,M,D,L A signal state of 1 indicates that the input value is bipolar. A signal state of 0 indicates
that the input value is unipolar.
OUT Output REAL I,Q,M,D,L,P Result of the scale conversion.
RET_VAL Output WORD I,Q,M,D,L,P Returns a value of W#16#0000 if the instruction executes without error.
See Error Information for values other than W#16#0000.
Scaling
The SCALE function takes an integer value (IN) and converts it to a real value in engineering units scaled between a low and a high limit (LO_LIM and
HI_LIM). The result is written in OUT. The SCALE function uses the equation:
OUT = [ ((FLOAT (IN) – K1)/(K2–K1)) * (HI_LIM–LO_LIM)] + LO_LIM
The constants K1 and K2 are set based upon whether the input value is BIPOLAR or UNIPOLAR.
BIPOLAR: The input integer value is assumed to be between –27648 and 27648, therefore, K1 = –27648.0 and K2 = +27648.0
UNIPOLAR: The input integer value is assumed to be between 0 and 27648, therefore, K1 = 0.0 and K2 = +27648.0
If the input integer value is greater than K2, the output (OUT) is clamped to HI_LIM, and an error is returned. If the input integer value is less than K1, the
output is clamped to LO_LIM, and an error is returned.
Reverse scaling can be obtained by programming LO_LIM > HI_LIM. With reverse scaling, the value of the output decreases as the value of the input
increases.
Scaling
Example
If the signal state of input I0.0 is 1 (activated), the SCALE function is
executed. In this example, the integer value 22 will be converted to a real
value scaled between 0.0 and 100.0 and written to OUT. The input value
is BIPOLAR, as indicated by the signal state of I2.0.
If the function is executed without error, the signal states of ENO and
Q0.0 are set to 1 and RET_VAL is set equal to W#16#0000.
Calculation
OUT = [ ((FLOAT (22) - -27648)/(27648- -27648))* (100.0 – 0.0)] + 0.0
OUT = [ (27670 ) / (55296) * (100.0) + 0.0
OUT = 50.03978588
Error Information
If the input integer value is greater than K2, the output (OUT) is clamped to HI_LIM, and an error is
returned. If the input integer value is less than K1, the output is clamped to LO_LIM, and an error is
returned. The signal state of ENO is set to 0 and RET_VAL is equal to W#16#0008.
Scaling
Example
If a 4-20mA signal from a field device is scaled from 0 to 100%,

and the input is at 13.92mA, the following calculation is
performed by the Scale block.
Convert 13.92 mA to the value produced by the analog input card.

((13.92 – 4) / 16) * 27648 = 17141
Calculation
OUT = [ ((FLOAT (17141) - 0)/(27648- 0))* (100.0 – 0.0)] + 0.0
OUT = [ (17141 ) / (27648) * (100.0) + 0.0
OUT = 61.997251157407407407407407407407
Unscaling
Unscaling Values: FC106
All analog outputs require an integer value within the range of 0 to 27648. To enable engineering values to drive an
analog output, the Real Number is converted to an integer.
Parameter Declaration Data type Memory area Description

EN Input BOOL I,Q,M,D,L Enable input with signal state of 1 activates the box.
ENO Output BOOL I,Q,M,D,L Enable output has a signal state of 1 if the function is executed without error.
IN Input REAL I,Q,M,D,L,P, The input value to be unscaled to an integer value.
Constant
HI_LIM Input REAL I,Q,M,D,L,P, Upper limit in engineering units.
Constant
LO_LIM Input REAL I,Q,M,D,L,P, Lower limit in engineering units.
Constant
BIPOLAR Input BOOL I,Q,M,D,L A signal state of 1 indicates that the input value is bipolar. A signal state of 0 indicates that
the input value is unipolar.
OUT Output INT I,Q,M,D,L,P Result of the unscale conversion.
RET_VAL Output WORD I,Q,M,D,L,P Returns a value of W#16#0000 if the instruction executes without error.
See Error Information for values other than W#16#0000.
Unscaling
The UNSCALE function takes a real input value (IN) in engineering units scaled between a low and a high limit (LO_LIM and HI_LIM) and converts it to an
integer value. The result is written to OUT. The UNSCALE function uses the equation:
OUT = [ ((IN–LO_LIM)/(HI_LIM–LO_LIM)) * (K2–K1) ] + K1
The constants K1 and K2 are set based upon whether the input value is BIPOLAR or UNIPOLAR.
BIPOLAR: The output integer value is assumed to be between –27648 and 27648, therefore, K1 = –27648.0 and K2 = +27648.0
UNIPOLAR: The output integer value is assumed to be between 0 and 27648, therefore, K1 = 0.0 and K2 = +27648.0
If the input value is outside the LO_LIM and HI_LIM range, the output (OUT) is clamped to the nearer of either the low limit or the high limit of the specified
range for its type (BIPOLAR or UNIPOLAR) and an error is returned.
Unscaling
Example
If the signal state of input I0.0 is 1 (activated), the UNSCALE function is executed. In
this example, the real value 50.03978588, scaled between 0.0 and 100.0, will be
converted to an integer value and written to OUT. The input value is BIPOLAR, as
indicated by the signal state of I2.0.
If the function is executed without error, the signal states of ENO and Q0.0 are set to
1 and RET_VAL is set equal to W#16#0000.
Calculation
OUT = [ ((50.03978588 – 0.0)/(100.0 – 0.0)) * (27648 - -27648)] + -27648
OUT = [ (50.03978588 / 100.0) * 55296 ] + -27648
OUT = 22
Error Information
If the input value is outside the LO_LIM and HI_LIM range, the output (OUT) is
clamped to the nearer of either the low limit or the high limit of the specified range
for its type (BIPOLAR or UNIPOLAR) and an error is returned. The signal state of
ENO is set to 0 and RET_VAL is set equal to W#16#0008.
Unscaling
Example
If a 4-20mA signal to a field device is unscaled from 0 to 100%, and the input is at 61.997251157%,
the following calculation is performed by the Unscale block.
Calculation
OUT = [ ((61.997251157 – 0.0)/(100.0 – 0.0)) * (27648 - 0)] + 0
OUT = [ (61.997251157 / 100.0) * 27648 ] + 0
OUT = 17141
Convert 17141 to the value produced by the analog output card.

((17141/27648)*16)+4 = 13.92mA
Activity 6
Conversions
When processing variables in mathematical or logic comparison equations, the types of variables must be the same. Step 7 will not allow different variable
types to be used together and will show the variable in Red text if the type is wrong for the current function.
BCD_DI (Convert BCD to Double Integer) reads the content of the IN parameter as a seven-digit, BCD coded number (+/- 9999999)
and converts it to a double integer value (32-bit). The double integer result is output by the parameter OUT. ENO always has the
same signal state as EN.
BCD_I (Convert BCD to Integer) reads the contents of the IN parameter as a three-digit, BCD coded number (+/- 999) and converts
it to an integer value (16-bit). The integer result is output by the parameter OUT. ENO always has the same signal state as EN.
DI_REAL (Convert Double Integer to Floating-Point) reads the content of the IN parameter as a double integer and converts it to a
floating-point number. The result is output by the parameter OUT. ENO always has the same signal state as EN.
I_DINT (Convert Integer to Double Integer) reads the content of the IN parameter as an integer (16-bit) and converts it to a double
integer (32-bit). The result is output by the parameter OUT. ENO always has the same signal state as EN.
Conversions
BCD – Binary Coded Decimal
The binary-coded decimal (BCD) format represents a decimal number by using groups of binary digits (bits). One group of 4 bits represents one digit of a signed
decimal number or the sign of the decimal number. The groups of 4 bits are combined to form a word (16 bits) or double word (32 bits). The four most significant
bits indicate the sign of the number (1111 indicates minus and 0000 indicates plus). Commands with BCD coded addresses only evaluate the highest value bit (15
in word, 31 in double word format). The following table shows the format and range for the two types of BCD numbers.
Format Range
Word (16 bits, three digit BCD number with sign) -999 to +999
Double word (32 bits, seven digit BCD number with sign) -9 999 999 to +9 999 999
Conversions
Integer
An integer has a sign that indicates whether it is a positive or negative integer. The space that an integer (16 bits) occupies in the memory is one word. The
following table shows the range of an integer (16 bits).
The following figure shows the integer +44 as a binary number.
Format Range Integer (16 bits) -32 768 to +32 767
Double Integer
An integer has a sign that indicates whether it is a positive or negative integer. The space that a double integer occupies in the memory is two words. The
following table shows the range of a double integer. The following figure shows the integer -500 000 as a binary number. In the binary system, the negative
form of an integer is represented as the twos complement of the positive integer. You obtain the twos complement of an integer by reversing the signal states
of all bits and then adding +1 to the result.
Format Range Integer (32 bits) -2 147 483 648 to +2 147 483 647
Activity 7
Comparison of Values
IN1 and IN2 are compared according to the type of

comparison you choose:
== IN1 is equal to IN2

<> IN1 is not equal to IN2
> IN1 is greater than IN2
< IN1 is less than IN2
>= IN1 is greater than or equal to IN2
<= IN1 is less than or equal to IN2

IN1 REAL I, Q, M, L, D or constant First value to compare
IN2 REAL I, Q, M, L, D or constant Second value to compare
These are displayed for the Real type of data.

They also exist for Integers and Double Integers in the element browser.
Activity 8
Mathematical Functions
Overview of Floating-Point Math Instruction
ADD_R adds two real numbers together.

IN1 + IN2
SUB_R Subtracts one real number from another.

IN1 - IN2
MUL_R multiplies two real numbers together.

IN1 x IN2
DIV_R divides one real number from another.

IN1 ÷ IN2
ABS establishes the absolute value of a floating-point number.
SQRT establishes the square root of a floating-point number.

This instruction issues a positive result when the address is
greater than "0". Sole exception: the square root of -0 is -0.
SIN establishes the sine value of a floating-point number. The

floating-point number represents an angle in a radian measure
here.
COS establishes the cosine value of a floating-point number. The

floating-point number represents an angle in a radian measure
here.
TAN establishes the tangent value of a floating-point number.

The floating-point number represents an angle in a radian
measure here.
Mathematical functions are available to be selected from the program element

catalog in the ladder editor. As with the comparison logic functions,
Mathematical functions are only possible with the same data types.
The catalog clearly shows that there is a set of functions for integers and double
integers, and a much greater set of functions for Floating Point Real numbers.
Step 7 will not allow different variable types to be used together and will show
the variable in Red text if the type is wrong for the current function.
Activity 9
Thankyou for attending this training
session.
Please fill out the course evaluation sheets

and return them to your trainer.
Suggestions for improvements to the

course or additional content are welcome.
58 watercorporation.com.au

TaRR - PCT - ILT12451 Siemens Step 7 Programming Essentials Course Notes

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

TaRR - PCT - ILT12451 Siemens Step 7 Programming Essentials Course Notes

Uploaded by

Copyright:

Available Formats

Siemens Step 7

Programming essentials for the Siemens S7 300 / 400 Series

Our training packages have

Please ask any questions

Process Control Training Centre Safety

Function block data type usage

Defined Local Data

Static Data is stored in the instance data

Temporary Data is used to store values only while the block is

OR- OPERATION Circuit Diagram:

AND- OPERATION Circuit diagram:

Result of Logic Operation (RLO)

---| |--- Normally Open Contact

Parameter Data Type Memory Area Description

Power flows if one of the following conditions exists:

The signal state is "1" at inputs I0.0 and I0.1

Or the signal state is "1" at input I0.2

---| / |--- Normally Closed Contact

Parameter Data Type Memory Area Description

Power flows if one of the following conditions exists: RLO=0

The bit value is "1" at inputs I0.0 and I0.1

Or the bit value is “0" at input I0.2

---( ) Output Coil

Parameter Data Type Memory Area Description

---( P )--- Positive RLO Edge Detection

Parameter Data Type Memory Area Description

---( N )--- Negative RLO Edge Detection

Parameter Data Type Memory Area Description

NEG Address Negative Edge Detection

Parameter Data Type Memory Area Description

POS Address Positive Edge Detection

Parameter Data Type Memory Area Description

--|NOT|-- Invert Power Flow

---|NOT|--- (Invert Power Flow) negates the RLO bit.

The signal state of output Q4.0 is "0" if one of the following

---( # )--- Midline Output

Parameter Data Type Memory Area Description

---( S ) Set Coil

Parameter Data Type Memory Area Description

The signal state of output Q4.0 is "1" if one of the following

The signal state is "1" at inputs I0.0 and I0.1

---( S ) Set Coil

Q4.0 will turn on if the following conditions exists:

The signal state is "1" at inputs I0.0 and I0.1

Q4.0 will remain on even though the signal state at

Q4.0 will only turn off when a RESET Coil is used.

---( R ) Reset Coil

Parameter Data Type Memory Area Description

The signal state is "1" at inputs I0.0 and I0.1

---( R ) Reset Coil

Q4.0 will turn off if the following conditions exists:

The signal state is "1" at inputs I0.0 and I0.1

Q4.0 will remain off until the set relay is initiated.

The signal state of timer T1 is only reset if:

The signal state of counter C1 is only reset if:

S_ODT On-Delay S5 Timer

Parameter Data Type Memory Area Description

SFB 4 On-Delay IEC Timer

Parameter Declaration Data Type Memory Area Description

IN INPUT BOOL I, Q, M, D, L, constant Start input

S_OFFDT Off-Delay S5 Timer Siemens Help Information

Parameter Data Type Memory Area Description

SFB 5 Off-Delay IEC Timer