Step 7 Fundamentals Handbook

The Case of the Missing SIMATIC Step 7 Documentation
The Case of the Missing SIMATIC Step 7

Documentation
We had documentation at one time.
Sound familiar? Have you suddenly found changes that have been made in the PLC but not in
the offline program? Nobody knows what happened.
Unfortunately this is an all too common phenomena with the Siemens SIMATIC Step 7
software. The problems stem from the flexibility of the software both for downloading and
editing the online program. If the person is not familiar with the software its very easy to get
confused if the changes are being made on the computer or in the controller.
How to solve this problem? Lets first of all review some basic terminology. After that is a step
by step best practice when editing programs. Finally, well highlight the pitfalls and the
indicators that tell you whether you are offline or online. This procedure applies to SIMATIC
Step 7 version 5.4.
Terminology
Offline program The program that is stored on the hard disk of the computer. This will
contain the documentation. Its very important to keep a pristine copy of the offline program
as the associated documentation is not stored in the PLC.
Online program This is the program resident in the PLC.
Download The act of taking the offline program on the computer and downloading it into
the PLC.
Upload Taking the program in the PLC and bringing it up to the computer. Doing this
without having the associated offline program open will cause a loss of documentation.
http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.]
Save Stores the open block onto the hard drive. Its important to realize that an edited block
can be downloaded to the PLC without saving it offline. Note that this only saves the opened
block and not any others that are concurrently open.
These may seem like simple terms but its important to understand how theyre used in the
Siemens environment.
Here are some other terms that may come up.
PG/PC This is Siemens way of referring to a PC or laptop running the SIMATIC software.
Nodes Refers to any programmable device (in our case a PLC) in the network which will
have its own unique address.
Best Practice
The best practice is to make sure you are working from an offline file. There really isnt any
reason to be working on the program inside the PLC. Of course, this assumes that you have a
good working copy to begin with. The golden copy of the program should live somewhere on
a network server or have a dedicated place on one computer or laptop. Ive even heard of
some companies using USB memory sticks to store the latest and greatest which is great but an
original copy should still live on a computer that is backed up.
1. Open the offline file from the File pull down menu and select Open or use the
Open Project icon
on the toolbar. In the dialog box select the project
under the User Project tab. Click OK. You may have to select Browse to find it in the
directory structure. Note if the Manager was closed with a project open then it will open
back up to that project automatically.
2. Expand the project tree down to the program files and select the Blocks
folder. Good practice dictates that all blocks should be opened from here.
3. Once changes have been made:
1. Save the block to the hard disk by clicking the Save icon
(or menu item
File | Save)
2. Download the block by clicking the Download icon
(or menu item PLC |
Download). If the block all ready exists in the PLC then it will confirm that you want
to overwrite it 1 . Click Yes.
3. Note that downloading from here only sends that one block to the PLC. It does not
download the entire program.
4. To monitor the block make sure to open it using steps 1 through 3 and then
press the Monitor icon
(or menu item Debug | Monitor). The windows title bar will
highlight a lovely shade of blue to indicate a connection to the CPU. Its important to
note here that you are still working with the program on the computer and not the PLC.
If the procedure in step 3 has not been followed then discrepancies can occur between
what you are monitoring in the PLC and what is displayed in the SIMATIC software.
Thats it. Following these simple steps will save a lot of headaches.
The Pitfalls and Warning Signs

So where do some people get lost? Here are some common mistakes and their warning signs.
If you get any of these dialog boxes then you should really back out and start over because
youre on the road to losing your documentation.
These dialog boxes are telling you that it cannot find the documentation for the local
parameters and symbols. More then likely it will also not show any network comments or titles.
The result of opening the block looks like this
This is an example void of documentation. Notice the local parameters all say TEMP. There
are no comments or titles. There are no symbols so its all in direct addressing. The properly
documented copy looks like this...
Pitfall #1 Using Accessible Nodes to Open Blocks

The Display Accessible Nodes
selection under the PLC menu is a handy way to see what is
connected to the network but it should never be used to open blocks. Opening blocks from
here uploads it straight from the PLC and produces the warnings dialog boxes shown above.
Pitfall #2 Viewing Online from SIMATIC manager

Once a project is open and a connection to a PLC is established then selecting the Online
button
(menu View | Online) brings up a similar project tree showing the contents inside
the PLC. The window title bar is highlighted in blue to indicate its online status. Working from
this window presents less of a danger for losing documentation but it is confusing and could
lead to problems. For instance if a block is renamed offline and then the old one is opened
online then it will have no associated documentation.
The proper way to view a block online is to open the block and select the Establish Connection
to Configured CPU icon
. Just make sure what you are viewing has been downloaded to the
PLC.
Pitfall #3 Opening the Online Partner

If an offline block is open then selecting the Open Offline/Online Partner icon
(menu item
File | Open Online) will switch it to the online version of the block for editing. Essentially this
puts you in the same place as pitfall #2.
Conclusion
Programming with SIMATIC Step 7 is different enough from other types of PLCs to throw off
the casual user. Always working from the offline copy will make it less likely to screw up.
Opening up a block from the accessible nodes window is always a no-no. Likewise, opening a
block from a window that has a highlighted blue title bar will also cause potential problems. Be
sure and read all dialog boxes especially the ones weve shown in the article. Avoid the pitfalls
and keep that documentation. Mystery solved.
Footnote:
(1) Siemens dialog boxes have an option that says, Do not display this message again. This
is handy for some annoying pop ups but it is really not a good idea to turn off important ones
like warnings for overwriting blocks. These warnings are especially crucial if you are working
on real machinery. If more then one person is using the software then you can reset these
messages to display again by going to the SIMATIC Manager and select the menu Options |
Customize. Click the General tab and press the Activate button. If its grayed out then all
messages are set to display.
S7 Library Functions
I couldn't find a complete listing of all the function blocks in the standard Siemens S7 Libraries
so I made one myself. It helps me get a better overview of what is available. The complete
listing is also available as an Excel spreadsheet so you can sort or adjust to your needs.
System Function Blocks

Number Name
Family
Description
SFB 0
CTU
IEC_TC
Count Up
SFB 1
CTD
IEC_TC
Count Down
SFB 2
CTUD
IEC_TC
Count Up/Down
SFB 3
TP
IEC_TC
Generate a Pulse
SFB 4
TON
IEC_TC
Generate an On Delay
SFB 5
TOF
IEC_TC
Generate an Off Delay
SFB 8
USEND
COM_FUNC Uncoordinated Sending of Data
SFB 9
URCV
COM_FUNC Uncoordinated Receiving of Data
SFB 12
BSEND
COM_FUNC Sending Segmented Data
SFB 13
BRCV
COM_FUNC Receiving Segmented Data
SFB 14
GET
COM_FUNC Read Data from a Remote CPU
SFB 15
PUT
COM_FUNC Write Data to a Remote CPU
SFB 16
PRINT
COM_FUNC Send Data to Printer
SFB 19
START
COM_FUNC Initiate a Warm or Cold Restart on a Remote Device
SFB 20
STOP
COM_FUNC Changing a Remote Device to the STOP State
SFB 21
RESUME
COM_FUNC Initiate a Hot Restart on a Remote Device
SFB 22
STATUS
COM_FUNC Query the Status of a Remote Partner
SFB 23
USTATUS
COM_FUNC Receive the Status of a Remote Device
SFB 29
HS_COUNT COUNTERS Counter (high-speed counter, integrated function) (only

exist on the CPU 312 IFM and CPU 314 IFM)
SFB 30
FREQ_MES COUNTERS Frequency Meter (frequency meter, integrated function

(only exist on the CPU 312 IFM and CPU 314 IFM)
SFB 31
NOTIFY_8P COM_FUNC Generating block related messages without

acknowledgement indication
SFB 32
DRUM
TIMERS
SFB 33
ALARM
COM_FUNC Generate Block-Related Messages with Acknowledgment

Display
SFB 34
ALARM_8
COM_FUNC Generate Block-Related Messages without Values for 8
Implement a Sequencer
Signals
SFB 35
ALARM_8P
COM_FUNC Generate Block-Related Messages with Values for 8

Signals
SFB 36
NOTIFY
COM_FUNC Generate Block-Related Messages without

Acknowledgment Display
SFB 37
AR_SEND
COM_FUNC Send Archive Data
SFB 38
HSC_A_B
COUNTERS Counter A/B (integrated function) (only exist on the CPU

314 IFM)
SFB 39
POS
ICONT
Position (integrated function) (only exist on the CPU 314

IFM)
SFB 41
CONT_C
ICONT
Continuous Control (only exist on the CPU 314 IFM)
SFB 42
CONT_S
ICONT
Step Control (only exist on the CPU 314 IFM)
SFB 43
PULSEGEN
ICONT
Pulse Generation (only exist on the CPU 314 IFM)
SFB 44
ANALOG
TEC_FUNC
Positioning with Analog Output (only exist on the S7300C CPUs)
SFB 46
DIGITAL
TEC_FUNC
Positioning with Digital Output (only exist on the S7-300C

CPUs)
SFB 47
COUNT
TEC_FUNC
Controlling the Counter (only exist on the S7-300C CPUs)
SFB 48
FREQUENC TEC_FUNC
Controlling the Frequency Measurement (only exist on

the S7-300C CPUs)
SFB 49
PULSE
TEC_FUNC
Controlling Pulse Width Modulation (only exist on the S7300C CPUs)
SFB 52
RDREC
DP
Reading a Data Record
SFB 53
WRREC
DP
Writing a Data Record
SFB 54
RALRM
DP
Receiving an Interrupt
SFB 60
SEND_PTP
TEC_FUNC
Sending Data (ASCII, 3964(R)) (only exist on the S7300C CPUs)
SFB 61
RECV_PTP
TEC_FUNC
Receiving Data (ASCII, 3964(R)) (only exist on the S7300C CPUs)
SFB 62
RES_RECV
TEC_FUNC
Deleting the Receive Buffer (ASCII, 3964(R)) (only exist

on the S7-300C CPUs)
SFB 63
SEND_RK
TEC_FUNC
Sending Data (RK 512) (only exist on the S7-300C CPUs)
SFB 64
FETCH_RK
TEC_FUNC
Fetching Data (RK 512) (only exist on the S7-300C CPUs)
SFB 65
SERVE_RK
TEC_FUNC
Receiving and Providing Data (RK 512) (only exist on the

S7-300C CPUs)
SFB 75
SALRM
DP
Send interrupt to DP master
SFB 81
RD_DPAR
IO_FUNCT
Read Predefined Parameter
System Function Calls
Number Name
Family
Description
SFC 0
SET_CLK
CLK_FUNC
Set System Clock
SFC 1
READ_CLK
CLK_FUNC
Read System Clock
SFC 2
SET_RTM
CLK_FUNC
Set Run-time Meter
SFC 3
CTRL_RTM
CLK_FUNC
Start/Stop Run-time Meter
SFC 4
READ_RTM
CLK_FUNC
Read Run-time Meter
SFC 5
GADR_LGC
IO_FUNCT
Query Logical Address of a Channel
SFC 6
RD_SINFO
DB_FUNCT Read OB Start Information
SFC 7
DP_PRAL
DP
SFC 9
EN_MSG
COM_FUNC Enable Block-Related, Symbol-Related and Group Status

Messages
SFC 10
DIS_MSG
COM_FUNC Disable Block-Related, Symbol-Related and Group Status

Messages
SFC 11
DPSYC_FR
DP
Synchronize Groups of DP Slaves
SFC 12
D_ACT_DP
DP
Deactivation and activation of DP slaves
SFC 13
DPNRM_DG DIAGNSTC
Read Diagnostic Data of a DP Slave (Slave Diagnostics)
SFC 14
DPRD_DAT
DP
Read Consistent Data of a Standard DP Slave
SFC 15
DPWR_DAT DP
Write Consistent Data to a DP Standard Slave
SFC 17
ALARM_SQ
PMC_FUNC Generate Acknowledgeable Block-Related Messages
SFC 18
ALARM_S
PMC_FUNC Generate Permanently Acknowledged Block-Related

Messages
SFC 19
ALARM_SC
PMC_FUNC Query the Acknowledgment Status of the last ALARM_SQ

Entering State Message
SFC 20
BLKMOV
MOVE
Copy Variables
SFC 21
FILL
MOVE
Initialize a Memory Area
SFC 22
CREAT_DB
DB_FUNCT Create Data Block
SFC 23
DEL_DB
DB_FUNCT Delete Data Block
SFC 24
TEST_DB
DB_FUNCT Test Data Block
SFC 25
COMPRESS
DB_FUNCT Compress the User Memory
SFC 26
UPDAT_PI
IO_FUNCT
Update the Process Image Update Table
SFC 27
UPDAT_PO
IO_FUNCT
Update the Process Image Output Table
SFC 28
SET_TINT
PGM_CNTL Set Time-of-Day Interrupt
SFC 29
CAN_TINT
PGM_CNTL Cancel Time-of-Day Interrupt
SFC 30
ACT_TINT
PGM_CNTL Activate Time-of-Day Interrupt
SFC 31
QRY_TINT
PGM_CNTL Query Time-of-Day Interrupt
SFC 32
SRT_DINT
PGM_CNTL Start Time-Delay Interrupt
Trigger a Hardware Interrupt on the DP Master
SFC 33
CAN_DINT
PGM_CNTL Cancel Time-Delay Interrupt
SFC 34
QRY_DINT
PGM_CNTL Query Time-Delay Interrupt
SFC 35
MP_ALM
PGM_CNTL Trigger Multicomputing Interrupt
SFC 36
MSK_FLT
DIAGNSTC
Mask Synchronous Errors
SFC 37
DMSK_FLT
DIAGNSTC
Unmask Synchronous Errors
SFC 38
READ_ERR
DIAGNSTC
Read Error Register
SFC 39
DIS_IRT
IRT_FUNC
Disable New Interrupts and Asynchronous Errors
SFC 40
EN_IRT
IRT_FUNC
Enable New Interrupts and Asynchronous Errors
SFC 41
DIS_AIRT
IRT_FUNC
Delay Higher Priority Interrupts and Asynchronous Errors
SFC 42
EN_AIRT
IRT_FUNC
Enable Higher Priority Interrupts and Asynchronous

Errors
SFC 43
RE_TRIGR
PGM_CNTL Re-trigger Cycle Time Monitoring
SFC 44
REPL_VAL
DIAGNSTC
SFC 46
STP
PGM_CNTL Change the CPU to STOP
SFC 47
WAIT
PGM_CNTL Delay Execution of the User Program
SFC 48
SNC_RTCB
CLK_FUNC
Synchronize Slave Clocks
SFC 49
LGC_GADR
IO_FUNCT
Query the Module Slot Belonging to a Logical Address
SFC 50
RD_LGADR
IO_FUNCT
Query all Logical Addresses of a Module
SFC 51
RDSYSST
DIAGNSTC
Read a System Status List or Partial List
SFC 52
WR_USMSG DIAGNSTC
Write a User-Defined Diagnostic Event to the Diagnostic

Buffer
SFC 54
RD_PARM
IO_FUNCT
Read Defined Parameters
SFC 55
WR_PARM
IO_FUNCT
Write Dynamic Parameters
SFC 56
WR_DPARM IO_FUNCT
Write Default Parameters
SFC 57
PARM_MOD IO_FUNCT
Assign Parameters to a Module
SFC 58
WR_REC
IO_FUNCT
Write a Data Record
SFC 59
RD_REC
IO_FUNCT
Read a Data Record
SFC 60
GD_SND
COM_FUNC Send a GD Packet
SFC 61
GD_RCV
COM_FUNC Fetch a Received GD Packet
SFC 62
CONTROL
COM_FUNC Query the Status of a Connection Belonging to a

Communication SFB Instance
SFC 63
AB_CALL
PLASTICS
Assembly Code Block (only exists for CPU 614)
SFC 64
TIME_TCK
CLK_FUNC
Read the System Time
SFC 65
X_SEND
COM_FUNC Send Data to a Communication Partner outside the Local

S7 Station
SFC 66
X_RCV
COM_FUNC Receive Data from a Communication Partner outside the
Transfer Substitute Value to Accumulator 1
Local S7 Station
SFC 67
X_GET
COM_FUNC Read Data from a Communication Partner outside the

Local S7 Station
SFC 68
X_PUT
COM_FUNC Write Data to a Communication Partner outside the Local

S7 Station
SFC 69
X_ABORT
COM_FUNC Abort an Existing Connection to a Communication

Partner outside the Local S7 Station
SFC 70
GEO_LOG
IO_FUNCT
Determine Start Address of a Module
SFC 71
LOG_GEO
IO_FUNCT
Determine the Slot Belonging to a Logical Address
SFC 72
I_GET
COM_FUNC Read Data from a Communication Partner within the

Local S7 Station
SFC 73
I_PUT
COM_FUNC Write Data to a Communication Partner within the Local

S7 Station
SFC 74
I_ABORT
COM_FUNC Abort an Existing Connection to a Communication

Partner within the Local S7 Station
SFC 78
OB_RT
DIAGNSTC
Determine OB program runtime
SFC 79
SET
BIT_LOGC
Set a Range of Outputs
SFC 80
RSET
BIT_LOGC
Reset a Range of Outputs
SFC 81
UBLKMOV
MOVE
Uninterruptible Block Move
SFC 82
CREA_DBL
DB_CTRL
Create a Data Block in the Load Memory
SFC 83
READ_DBL
DB_CTRL
Read from a Data Block in Load Memory
SFC 84
WRIT_DBL
DB_CTRL
Write from a Data Block in Load Memory
SFC 85
CREA_DB
DB_FUNCT Create a Data Block
SFC 87
C_DIAG
COM_FUNC Diagnosis of the Actual Connection Status
SFC 90
H_CTRL
HF_FUNCT
Control Operation in H Systems
SFC 100
SET_CLKS
CLK_FUNC
Setting the Time-of-Day and the TOD Status
SFC 101
RTM
CLK_FUNC
Handling runtime meters
SFC 102
RD_DPARA
IO_FUNCT
Redefined Parameters
SFC 103
DP_TOPOL
DP
Identifying the bus topology in a DP master system
SFC 104
CIR
PGM_CNTL Controlling CiR
SFC 105
READ_SI
PMC_FUNC Reading Dynamic System Resources
SFC 106
DEL_SI
PMC_FUNC Deleting Dynamic System Resources
SFC 107
ALARM_DQ PMC_FUNC Generating Always Acknowledgeable and Block-Related

Messages
SFC 108
ALARM_D
PMC_FUNC Generating Always Acknowledgeable and Block-Related

Messages
SFC 112
PN_IN
PROFIne2
Update inputs in the user program interface of PROFInet

components
SFC 113
PN_OUT
PROFIne2
Update outputs in the user program interface of

PROFInet components
SFC 114
PN_DP
PROFIne2
Update DP interconnections
SFC 126
SYNC_PI
IO_FUNCT
Update process image partition input table in

synchronous cycle
SFC 127
SYNC_PO
IO_FUNCT
Update process image partition output table in

synchronous cycle
S5-S7 Converting Blocks

Number Name
Family
Description
FC 61
GP_FPGP
S5_CNVRT Change fixed point number to floating point number
FC 62
GP_GPFP
S5_CNVRT Change floating point number to fixed point number
FC 63
GP_ADD
S5_CNVRT Add floating point numbers
FC 64
GP_SUB
S5_CNVRT Subtract floating point numbers
FC 65
GP_MUL
S5_CNVRT Multiply floating point number
FC 66
GP_DIV
S5_CNVRT Divide floating point numbers
FC 67
GP_VGL
S5_CNVRT Compare floating point numbers
FC 68
RAD_GP
S5_CNVRT Extract root of floating point numbers
FC 69
MLD_TG
S5_CNVRT Clock generator
FC 70
MLD_TGZ
S5_CNVRT Clock generator (timing element)
FC 71
MLD_EZW
S5_CNVRT Message of first value with single flashing light,

wordwise, A
FC 72
MLD_EDW
S5_CNVRT Message of first value with double flashing light,

wordwise, A
FC 73
MLD_SAMW S5_CNVRT Collected message, wordwise (sound alert)
FC 74
MLD_SAM
S5_CNVRT Collected message, bitwise
FC 75
MLD_EZ
S5_CNVRT Message of first value with single flashing light, bitwise, A
FC 78
MLD_EDWK S5_CNVRT Message of first value with double flashing light,

wordwise, A+M
FC 79
MLD_EZK
S5_CNVRT Message of first value with single flashing light, bitwise,

A+M
FC 80
MLD_EDK
S5_CNVRT Message
of first value with double flashing light, bitwise, A+M
FC 81
COD_B4
S5_CNVRT Change BCD number to 16 bit dual number
FC 82
COD_16
S5_CNVRT Change 16 bit dual number to BCD number
FC 83
MUL_16
S5_CNVRT Multiply 16 bit dual numbers
FC 84
DIV_16
S5_CNVRT Divide 16 bit dual numbers
FC 85
ADD_32
S5_CNVRT Add 32 bit dual numbers
FC 86
SUB_32
S5_CNVRT Subtract 32 bit dual numbers
FC 87
MUL_32
S5_CNVRT Multiply 32 bit dual numbers
FC 88
DIV_32
S5_CNVRT Divide 32 bit dual numbers
FC 89
RAD_16
S5_CNVRT Extract roots of 16 bit dual numbers
FC 90
REG_SCHB
S5_CNVRT Bi-directional shift register, bitwise
FC 91
REG_SCHW S5_CNVRT Bi-directional shift register, wordwise
FC 92
REG_FIFO
S5_CNVRT Buffer memory (FIFO)
FC 93
REG_LIFO
S5_CNVRT Stack register (LIFO)
FC 94
DB_COPY1
S5_CNVRT Copy data block, direct assignment of parameters
FC 95
DB_COPY2
S5_CNVRT Copy data block, indirect assignment of parameterization
FC 96
RETTEN
S5_CNVRT Save scratchpad memory
FC 97
LADEN
S5_CNVRT Load scratchpad memory
FC 98
COD_B8
S5_CNVRT Change BCD number to 32 bit dual number
FC 99
COD_32
S5_CNVRT Change 32 bit dual number to BCD number
FC 100
AE_460_1
S5_CNVRT Read analog value
FC 101
AE_460_2
FC 102
AE_463_1
FC 103
AE_463_2
FC 104
AE_464_1
FC 105
AE_464_2
FC 106
AE_466_1
FC 107
AE_466_2
FC 108
RLG_AA1
S5_CNVRT Output analog value
FC 109
RLG_AA2
S5_CNVRT Output analog value
FC 110
PER_ET1
S5_CNVRT Read and Write for extended periphery (direct

assignment of parameters)
FC 111
PER_ET2
S5_CNVRT Read and Write for extended periphery (indirect

assignment of parameters)
FC 112
SINUS
S5_CNVRT Sine (x)
FC 113
COSINUS
S5_CNVRT Cosine (x)
FC 114
TANGENS
S5_CNVRT Tangent (x)
FC 115
COTANG
S5_CNVRT Cotangent (x)
FC 116
ARCSIN
S5_CNVRT Arc sine (x)
FC 117
ARCCOS
S5_CNVRT Arc cosine (x)
FC 118
ARCTAN
S5_CNVRT Arc tangent (x)
FC 119
ARCCOT
S5_CNVRT Arc cotangens (x)
FC 120
LN_X
S5_CNVRT Natural logarithm ln (x)
FC 121
LG_X
S5_CNVRT Decade logarithm Iog (x)
FC 122
B_LOG_X
S5_CNVRT General logarithm log (x) to basis b
FC 123
E_H_N
S5_CNVRT e to the power of n
FC 124
ZEHN_H_N
S5_CNVRT 10 to the power of n
FC 125
A2_H_A1
S5_CNVRT AKKU 2 to the power of AKKU 1
IEC Function Blocks

Number Name
Family Description
FC 1
AD_DT_TM IEC
Point Math Add duration to a time
FC 2
CONCAT
Combine two STRING variables
FC 3
D_TOD_DT IEC
Combine DATE and TIME_OF_DAY to DT
FC 4
DELETE
IEC
Delete in a STRING variable
FC 5
DI_STRNG
IEC
Data type conversion DINT to STRING
FC 6
DT_DATE
IEC
Extract the DATE from DT
FC 7
DT_DAY
IEC
Extract the day of the week from DT
FC 8
DT_TOD
IEC
Extract the TIME_OF_DAY from DT
FC 9
EQ_DT
IEC
Compare DT for equal
FC 10
EQ_STRNG IEC
Compare STRING for equal
FC 11
FIND
IEC
Find in a STRING variable
FC 12
GE_DT
IEC
Compare DT for greater than or equal
FC 13
GE_STRNG IEC
Compare STRING for greater than or equal
FC 14
GT_DT
Compare DT for greater than
FC 15
GT_STRNG IEC
Compare STRING for greater than
FC 16
I_STRNG
IEC
Data type conversion INT to STRING
FC 17
INSERT
IEC
Insert in a STRING variable
FC 18
LE_DT
IEC
Compare DT for smaller than or equal
FC 19
LE_STRNG
IEC
Compare STRING for smaller than or equal
FC 20
LEFT
IEC
Left part of a STRING variable
FC 21
LEN
IEC
Length of a STRING variable
FC 22
LIMIT
IEC
Point Math Limit
FC 23
LT_DT
IEC
Compare DT for smaller than
IEC
IEC
FC 24
LT_STRNG
IEC
Compare STRING for smaller than
FC 25
MAX
IEC
Point Math Select maximum
FC 26
MID
IEC
Middle part of a STRING variable
FC 27
MIN
IEC
Point Math Select minimum
FC 28
NE_DT
IEC
Compare DT for unequal
FC 29
NE_STRNG IEC
Compare STRING for unequal
FC 30
R_STRNG
IEC
Data type conversion REAL to STRING
FC 31
REPLACE
IEC
Replace in a STRING variable
FC 32
RIGHT
IEC
Right part of a STRING variable
FC 33
S5TI_TIM
IEC
Data type conversion S5TIME to TIME
FC 34
SB_DT_DT IEC
Point Math Subtract two time values
FC 35
SB_DT_TM IEC
Point Math Subtract duration from a time
FC 36
SEL
IEC
Point Math Binary selection
FC 37
STRNG_DI
IEC
Data type conversion STRING to DINT
FC 38
STRNG_I
IEC
Data type conversion STRING to INT
FC 39
STRNG_R
IEC
Data type conversion STRING to REAL
FC 40
TIM_S5TI
IEC
Data type conversion TIME to S5TIME
PID Control Blocks

Number Name
Family
Description
FB 41
CONT_C
ICONT
Continuous Control
FB 42
CONT_S
ICONT
Step Control
FB 43
PULSEGEN ICONT
FB 58
TCONT_CP CONTROL Temperature Continuous Controller
FB 59
TCONT_S
Pulse Generation
CONTROL Temperature Step Controller
Communication Blocks
Number Name
Family
Description
FB 2
IDENTIFY
CP_300
For checking device

properties
FB 3
READ
CP_300
Reads data from a data area of the communication

partner specified by a name or index depending on the
assignment of parameters for the job.
FB 4
REPORT
CP_300
Allows unconfirmed transmission of variables by an

FMS server.
FB 5
STATUS
CP_300
allows status information to be requested from the
communications partner on the specified FMS

connection.
FB 6
WRITE
CP_300
Transfers data from a specified local data area to a

data area on the communication partner.
FB 8
USEND
CP_300
Uncoordinated Sending of Data
FB 9
URCV
CP_300
Uncoordinated Receiving of Data
FB 12
BSEND
CP_300
Sending Segmented Data
FB 13
BRCV
CP_300
Receiving Segmented Data
FB 14
GET
CP_300
Read Data from a Remote CPU
FB 15
PUT
CP_300
Write Data to a Remote CPU
FB 20
GETIO
IO_FUNCT Read All Inputs of a DP Standard Slave/PROFINET IO

Device
FB 21
SETIO
IO_FUNCT Write All Outputs of a DP Standard Slave/PROFINET IO

Device
FB 22
GETIO_PART
IO_FUNCT Read a Part of the Inputs of a DP Standard

Slave/PROFINET IO Device
FB 23
SETIO_PART
IO_FUNCT Write a Part of the Outputs of a DP Standard

Slave/PROFINET IO Device
FB 55
IP_CONFIG
CP_300
Transfers a configuration data block (CONF_DB)

containing connection data for an Ethernet CP.
FB 63
TSEND
COMM
Sending Data via TCP native and ISO on TCP
FB 64
TRCV
COMM
Receiving Data via TCP native and ISO on TCP
FB 65
TCON
COMM
Establishing a Connection using TCP native and ISO on

TCP
FB 66
TDISCON
COMM
Terminating a Connection using TCP native and ISO on

TCP
FB 67
TUSEND
COMM
Sending Data via UDP
FB 68
TURCV
COMM
Receiving Data via UDP
FC 1
DP_SEND
CP_300
transfers data to the PROFIBUS CP
FC 2
DP_RECV
CP_300
receives data on PROFIBUS
FC 3
DP_DIAG
CP_300
used to request diagnostic information
FC 4
DP_CTRL
CP_300
transfers control jobs to the PROFIBUS CP
FC 5
AG_SEND
CP_300
data by means of a configured connection to the

communication partner (<= 240 bytes).
FC 6
AG_RECV
CP_300
data by means of a configured connection from the

communication partner (<= 240 bytes, not email).
FC 7
AG_LOCK
CP_300
the external data access by means of FETCH/WRITE

(not for UDP, email).
FC 8
AG_UNLOCK
CP_300
the external data access by means of FETCH/WRITE
(not for UDP, email).

FC 10
AG_CNTRL
CP_300
allows you to diagnose connections. When necessary,

you can reinitialize connection establishment using the
FC.
FC 11
PNIO_SEND
CP_300
used for data transfer in

the CP modes PROFINET IO controller or PROFINET
IO device.
FC 12
PNIO_RECV
CP_300
used to receive data in the CP modes PROFINET IO

controller or PROFINET IO device.
FC 40
FTP_CONNECT CP_300
Establish an FTP connection
FC 41
FTP_STORE
Store a file on the FTP server
FC 42
FTP_RETRIEVE CP_300
Retrieve a file from the FTP server
FC 43
FTP_DELETE
CP_300
Delete a file on the FTP server
FC 44
FTP_QUIT
CP_300
Enable an FTP connection
FC 50
AG_LSEND
CP_300
data by means of a configured connection to the

communication partner.
FC 60
AG_LRECV
CP_300
data by means of a configured connection from the

communication partner (not email).
FC 62
C_CNTRL
CP_300
Query a connection status for S7-300
CP_300
TI-S7 Converting Blocks

Number Name
Family
Description
FB 80
LEAD_LAG CONVERT Lead/Lag Algorithm
FB 81
DCAT
TIMERS
Discrete Control Alarm Timer
FB 82
MCAT
TIMERS
Motor Control Alarm Timer
FB 83
IMC
COMPARE Index Matrix Compare
FB 84
SMC
COMPARE Scan Matrix Compare
FB 85
DRUM
TIMERS
Event Maskable Drum
FB 86
PACK
MOVE
Pack Data
FC 80
TONR
TIMERS
Software Timer On DelayRetentive
FC 81
IBLKMOV
MOVE
Indirect Block Move
FC 82
RSET
BIT_LOGC Reset Range of Outputs
FC 83
SET
BIT_LOGC Set Range of Outputs
FC 84
ATT
TABLE
Add to Table
FC 85
FIFO
TABLE
First In/First Out Unload Table
FC 86
TBL_FIND TABLE
Table Find
FC 87
LIFO
Last In/First Out Unload Table
TABLE
FC 88
TBL
TABLE
FC 89
TBL_WRD TABLE
Move Table to Word
FC 90
WSR
Word Shift Register
FC 91
WRD_TBL TABLE
Word to Table
FC 92
SHRB
SHIFT
Bit Shift Register
FC 93
SEG
CONVERT Seven Segment Decoder
FC 94
ATH
CONVERT ASCII to Hex
FC 95
HTA
CONVERT Hex to ASCII
FC 96
ENCO
CONVERT Encode Binary Position
FC 97
DECO
CONVERT Decode Binary Position
FC 98
BCDCPL
CONVERT Tens Complement
FC 99
BITSUM
CONVERT Sum Number of Bits
FC 100
RSETI
BIT_LOGC Reset Range of Immediate Outputs
FC 101
SETI
BIT_LOGC Set Range of Immediate Outputs
FC 102
DEV
MATH_FP
Standard Deviation
FC 103
CDT
TABLE
Correlated Data Table
FC 104
TBL_TBL
TABLE
Table to Table
FC 105
SCALE
CONVERT Scaling Values
FC 106
UNSCALE
CONVERT Unscaling Values
SHIFT
Table
Miscellaneous Blocks
Number Name
Family
Description
FB 60
SET_SW
TIMEFUNC supports the summertime/wintertime changeover in CPUs

that do not have the time status. For this purpose it sets
the CPU clock to the current time and according to the
changeover rules in the Control DB.
FB 61
SET_SW_S TIMEFUNC supports the summertime/wintertime changeover in CPUs

that do have the time status. For this purpose it sets the
time status to the current time and according to the
changeover rules in the Control DB.
FB 62
TIMESTMP TIMEFUNC transfers the time-stamped messages of an IM153-2 into

its instance DB.
FC 60
LOC_TIME TIMEFUNC reads the time status or time of the CPU and calculates the
local time. It is therefore only useful on CPUs with time
status.
FC 61
BT_LT
TIMEFUNC calculates the local time from the base time given at the
input.
FC 62
LT_BT
TIMEFUNC calculates the base time from the local time given at the
input.
FC 63
S_LTINT
TIMEFUNC sets the required time interrupt to the preset time. This
time is given in local time.
Siemens Technical Terms

Otherwise known as Siemens speak. Here's a list of Siemens specific abbreviations and their
meanings.
Term
Description
Explanation
C7
Combo PLC/HMI system A PLC and screen in one package
CFC
Continuous Function
Chart
Optional programming language
CP
Communication
Processor
Modules used for special communication protocols
DB
Data Block
Memory storage areas for user data
FB
Function Block
A function with it's own data block
FBD
Function Block Diagram
Standard programming language
FC
Function Call
Called progammed blocks
FM
Function Module
Modules with special functions (e.g. positioning)
GSD
Generic Station
Description
Files used for Profibus descriptions
HiGraph
IM
Interface Module
Modules to connect remote racks
LAD
Ladder Logic Diagram
Standard programming language
M7
Programmable modules
A module with processing capabilities
MMC
Micro Memory Card
Compact plug-in memory card
MPI
Multi Point Interface
Standard communication protocol
OB
Organization Block
Blocks for user programs based on different operating

system events.
OP
Operator Panel
Simple display with or without buttons
PCS
Process Control System
Software for the entire process chain
PG
Programming Terminal
Dedicated Siemens device - basically a PC
PPI
Point to Point Interface
Serial RS-232 communication
Profibus
DP
Profibus Decentral
Peripherals
Networking protocol used for factory automation
Profibus
PA
Profibus Process
Automation
Networking protocol used for process automation
S7
SIMATIC Step 7 product line
Structured Control
SCL
Language
SFB
System Function Block
Integrated FB for CPU information
SFC
System Function Call
Integrated FC for CPU information
SM
Signal Module
Standard Input/Output modules
STL
Statement List
Text based programming language
TP
Touch Panel
Touch screen display
UDT
User-Definded Data
Type
Special data structures defined by the user
VAT
Variable Access Table
Tables used to monitor/modify values in the PLC
Step 7 Elementary Data Types

Type and
Size Format
Options
Description in
Bits
Range and Number

Notation
(lowest to highest values)
Example in STL
BOOL (Bit)
1 Boolean
text
TRUE/FALSE
TRUE
BYTE (Byte)
8 Hexadecimal B#16#0 to B#16#FF

number
WORD
(Word)
DWORD
(Double
word)
16 Binary
number
2#0 to
2#1111_1111_1111_1111
L B#16#10
L byte#16#10
L 2#0001_0000_0000_0000
Hexadecimal W#16#0 to W#16#FFFF

number
L W#16#1000
L word#16#1000
BCD
C#0 to C#999
L C#998
Decimal
number
unsigned
B#(0,0) to B#(255,255)
L B#(10,20)
L byte#(10,20)
32 Binary
number
2#0 to
2#1111_1111_1111_1111_
1111_1111_1111_1111
Hexadecimal W#16#0000_0000 to
number
W#16#FFFF_FFFF
Decimal
number
unsigned
L 2#1000_0001_0001_1000_
1011_1011_0111_1111
L DW#16#00A2_1234
L dword#16#00A2_1234
B#(0,0,0,0) to
B#(255,255,255,255)
L B#(1, 14, 100, 120)

L byte#(1,14,100,120)
INT
(Integer)
16 Decimal
number
signed
-32768 to 32767
L 101
DINT
(Double
integer)
32 Decimal
number
signed
L#-2147483648 to
L#2147483647
L L#101
REAL
(Floatingpoint
number)
32 IEEE
Floatingpoint
number
Upper limit +/-3.402823e+38

Lower limit +/-1.175495e-38
L 1.234567e+13
S5TIME
(SIMATIC
time)
16 S7 time in
steps of
10ms
(default)
S5T#0H_0M_0S_10MS to
S5T#2H_46M_30S_0MS and
S5T#0H_0M_0S_0MS
L S5T#0H_1M_0S_0MS
L
S5TIME#0H_1H_1M_0S_0MS
TIME (IEC
time)
32 IEC time in
steps of 1
ms, integer
signed
T#24D_20H_31M_23S_648MS L T#0D_1H_1M_0S_0MS
L TIME#0D_1H_1M_0S_0MS
to
T#24D_20H_31M_23S_647MS
DATE (IEC
date)
16 IEC date in
steps of 1
day
D#1990-1-1 to
D#2168-12-31
L D#1996-3-15
L DATE#1996-3-15
TIME
_OF_DAY
(Time)
32 Time in
steps of 1
ms
TOD#0:0:0.0 to
TOD#23:59:59.999
L TOD#1:10:3.3
L TIME_OF_DAY#1:10:3.3
A', 'B' etc.
L 'E'
CHAR
(Character)
8 ASCII
characters
S5TIME NOTES
Underscores in time and date are optional
It is not required to specify all time units (for example: T#5h10s is valid)
Maximum time value = 9,990 seconds or 2H_46M_30S
S5TIME Format
Time base Binary Code

10 ms
00
100 ms
01
1s
10
10 s
11
Symbol Table Allowed Addresses and Data Types
Symbol Table Allowed Addresses and Data

Types
English
German
Description
Mnemonics Mnemonics
Data Type
Address
Range
I/O Signals
I
Input bit
BOOL
0 to
65535.7
IB
EB
Input byte
BYTE, CHAR
0 to 65535
IW
EW
Input word
WORD, INT, S5TIME,

DATE
0 to 65534
ID
ED
Input double word
DWORD, DINT, REAL,

TOD, TIME
0 to 65532
Output bit
BOOL
0 to
65535.7
QB
AB
Output byte
BYTE, CHAR
0 to 65535
QW
AW
Output word
WORD, INT, S5TIME,

DATE
0 to 65534
QD
AD
Output double word
DWORD, DINT, REAL,

TOD, TIME
0 to 65532
Marker Memory
M
Memory bit
BOOL
0 to
65535.7
MB
MB
Memory byte
BYTE, CHAR
0 to 65535
MW
MW
Memory word
WORD, INT, S5TIME,

DATE
0 to 65534
MD
MD
Memory double word
DWORD, DINT, REAL,

TOD, TIME
0 to 65532
Peripheral I/O
PIB
PEB
Peripheral input byte
BYTE, CHAR
0 to 65535
PIW
PEW
Peripheral input word
WORD, INT, S5TIME,

DATE
0 to 65534
PID
PED
Peripheral input double

word
DWORD, DINT, REAL,

TOD, TIME
0 to 65532
PQB
PAB
Peripheral output byte
BYTE, CHAR
0 to 65535
PQW
PAW
Peripheral output word
WORD, INT, S5TIME,

DATE
0 to 65534
PQD
PAD
Peripheral output
DWORD, DINT, REAL,
0 to 65532
Symbol Table Allowed Addresses and Data Types
double word
TOD, TIME
Timers and Counters

T
Timer
TIMER
0 to 65535
Counter
COUNTER
0 to 65535
FB
FB
Function block
FB
0 to 65535
OB
OB
Organization block
OB
1 to 65535
FC
FC
Function
FC
0 to 65535
SFB
SFB
System function block
SFB
0 to 65535
SFC
SFC
System function
SFC
0 to 65535
DB
Data block
DB, FB, SFB, UDT
1 to 65535
User-defined data type
UDT
0 to 65535
Logic Blocks
Data Blocks
DB
User-defined data types

UDT
UDT
Siemens S7 Indirect Addressing

by Automation Training
The following is provided by Automation Training from their excellent Siemens Step 7 training
manual. This is a really nice explanation of a difficult but important subject. Check out their
website for hands-on and online training classes.
Introduction
The most common form of addressing used in the Siemens S7 PLCs is direct and symbolic.
When a direct addressed is referenced by an instruction there is no question as to the location
in memory. The following are examples of direct addressing:
Inputs:
I4.0, IB4, IW4 , ID4
Outputs:
Q124.0, QB124, QW124, QD124
Markers:
M11.0, MB10, MW10, MD10
Timers:
T34
Counters:
C23
Local:
L0.0, LB1, LW2, LD4
Data Block:
DB5.DBX2.0, DB5.DBW6, DBD8
By using the methods of indirect addressing the address used by an instruction can be varied to
point to any number of locations. In this case, a memory location stores a pointer to
another memory location. While this may increase the difficulty of troubleshooting, its
advantage is to greatly reduce the number of networks and instructions needed to control a
process. It is also a method that must be understood to use some of the library and system
function calls provided by Siemens.
The POINTER and ANY Data Types
A POINTER data type is used to format a number to be accepted as an address rather then a
value. A pointer is always preceded by a P# symbol. The pointer address may be in three
different formats.
Format
Example
Memory Storage
P#<byte>.<bit>
P#8.0
P#124.3
4 Bytes
P#<area><byte>.<bit>
P#M50.0
P#I4.0
6 Bytes
P#<area><byte>.<bit><length> P#DB25.DBX0.0 BYTE 14

P#M0.0 WORD 2
P#I0.0 DWORD 5
10 Bytes
The ANY data type is used to pass a parameter of an unknown or undefined data type. Some
functions in the library use the ANY data type to work on whole sections of memory. To do
this, the last pointer method is used to describe an area. For example the address P#DB25.DBX
0.0 Byte 14 points to the first byte of DB25 with a length of 14 bytes.
NOTE: A DINT can be converted to a POINTER by simply shifting the double word left by 3 bits.
Data Block Instructions

When working with indirect addressing it is sometimes needed to first of all open a DB and then
begin working on the
address without directly referring to any one DB. This is done using the OPN instruction. The
OPN instruction can open either a shared data block (DB) or an instance data block (DI).
OPN
DB
10
//Open DB10 as a shared data block
DBW
36
//Load data word 36 of DB10 into ACCU1
MW
22
//Transfer the contents of ACCU1 into MW22
OPN
DI
20
//Open DB20 as an instance data block
DIB
12
//Load data byte 12 from DB20 into ACCU1
DBB
37
//Transfer the contents of ACCU1 to data

//byte 37 of the open shared data block DB10
When monitoring in STL the shared DB number is displayed in the DB1 column and the
instance DB number is displayed in the DB2 column.
Furthermore, there are instructions to confirm that the correct DB number is opened and that it
is large enough for the next operation.
DBNO
//Loads the number of the opened

//shared data block into ACCU1
DBLG
//Loads the length of the opened

//shared data block into ACCU1
DINO
//Loads the number of the opened

//instance data block into ACCU1
DILG
//Loads the length of the opened

//instance data block into ACCU1
Memory Indirect Addressing

The first method of indirect addressing is called memory indirect addressing because it allows
for a memory location (M, DB or L) to determine or point to another.
The memory area identifiers T, C, DB, DI, FB and FC use a word (16-bit) pointer location in
integer format. Two examples are as follows:
L
//Load ACCU1 with pointer value
MW
//Transfer pointer into MW2
T [MW 2]
//Load ACCU1 with T5 current time value
OPN
DB [#DB_Temp]
//Open DB whose data block number is

//from the interface temp parameter
//named DB_Temp
The memory area identifiers I, Q, M, L, DB use a double word (32-bit) location using the
POINTER data type.
L
P#0.7
MD
//Transfer pointer into MD2
I [MD 2]
//Check state of I0.7
M [MD 2]
//Assign value of RLO to M0.7
OPN
DB
P#2.0
//Load pointer into ACCU1
#TempPointer
//Transfer pointer to temp location
DBW [#TempPointer]
//Load the value at DB5.DBW2 into ACCU1
//Load a zero into ACCU1
>D
//Check if the value is greater

//then zero
//Open DB5
When monitoring memory indirect addressing the INDIRECT column displays the current
address the instruction is using.
Note that math can be done on the POINTER data type using the double math instructions
(e.g. P#2.0 + P#5.0 = P#7.0).
L
P#2.0
P#5.0
//Load ACCU1 with secondpointer value
+D
MD
//MD0 now contains the value P#7.0
Since the bit position only goes to eight the result of P#8.7 + P#1.1 = P#10.0 and not P#9.8.
These methods can be used to offset the address or increase/decrease the pointer in a loop.
The Address Registers

Besides the regular accumulators, there are two 32-bit address registers (AR1, AR2) for storing
pointers used in register indirect addressing methods. A series of different load and transfer
type instructions can be used to work with AR1. A similar set is available for AR2.
STL
Description
LAR1
Loads AR1 with the contents of ACCU1
LAR1 P#M100.0 Loads AR1 with a pointer constant

LAR1 MD24
Loads AR1 with the pointer in MD24
LAR1 AR2
Loads AR1 with the contents of AR2
TAR1
Transfers the contents AR1 into ACCU1
TAR1 MD28
Transfers the contents in AR1 to a memory location
TAR1 AR2
Transfers the contents in AR1 to AR2
CAR
Exchanges the contents of AR1 with AR2
Addition can be directly accomplished on AR1 and AR2 with the following:
STL
Description
+AR1
Adds the contents of ACCU1 to AR1 and stores the result back into
AR1
+AR1 P#100.0
Adds the pointer constant to AR1 and stores the result back into AR1
Area-Internal Register Indirect Addressing

The area-internal register indirect addressing method uses one of the address registers plus a
pointer to determine the address the instruction is to reference. The format is:
address identifier [address register, pointer]
The address identifier can be I, Q, M, L, DI or DB in bit, byte, word or double word form. The
address register must be previously loaded with a double word pointer without reference to the
address identifier. The exact address is determined by adding the address register with the
pointer. The example below shows the area-internal method using bit locations.
L
P#0.7
LAR1
//Load AR1 with pointer in ACCU1
I [AR1, P#0.0]
//Check input I0.7
Q [AR1, P#1.1]
//If RLO=1 turn on Q2.0
Area-Crossing Register Indirect Addressing

Area-crossing register indirect addressing is similar to the area-internal method except the
pointer loaded into the address register references a memory area (e.g. P#M10.0 or
P#DBX0.0). This means the address identifier used before the opening bracket is not needed if
referencing a bit otherwise it will be a B for byte, W for word or D for double. The example
below shows the area-crossing method using bit locations.
L
P#I0.7
LAR1
P#Q124.0
LAR2
[AR1, P#0.0]
//Check input I0.7
[AR2, P#1.1]
//If RLO=1 turn on Q125.1
This next example shows area-crossing methods using a word and double word format.
L
P#M0.0
LAR1
W [AR1,
P#10.0]
//Load the word whose address is

//determined by the contents of
//AR1 plus 10 bytes (MW10) into ACCU1
OPN
DB
P#DBX 0.0
LAR2
L#0
//Load zero into ACCU1
D [AR2,
P#50.0]
//Transfer the value in ACCU1 to the

//double word whose exact location is
//the address in AR2 plus 50 bytes
//(DB5.DBD50)
//Open DB5
Exercise #1
1. Comment the lines of STL below to describe what this network does:
0.0
JC
M001
P#M10.0
JU
M002
M001:
P#Q0.0
M002:
LAR1
[AR1, P#0.1]
0.1
2. Enter the code, monitor it and verify your answers.
Exercise #2 (Advanced)
1. Create a DB with an array of 10 real numbers. Populate the array with random values.
2. Create a function that will return the max number in the array and its position. Use the
indirect addressing method of your choice.
Siemens S7 Status Word

In Siemens PLCs the Status Word is an internal CPU register used to keep track of the state of
the instructions as they are being processed. In order to use STL more effectively it is
important to understand the Status Word and its functions.
Each bit in the Status Word has a specific function to keep track of bit logic (RLO, STA), math
(OV, OS), comparison operations (CC0, CC1) and whether the logic should continue, be nested
or start new (/FC, OR, BR). Only the first 9 of the 16 bits are used.
Bit Positions
8
BR
CC0
CC1
OV
OS
OR
STA
RLO
/FC
Each instruction may do the following to each bit in the status word.
-
No read or write
Read
May write "1" or "0"
Reset to "0"
Set to "1"
The status word can be seen by displaying the STATUS column while monitoring in STL view.
The RLO (bit 1) and the STA (bit 2) are also displayed in the RLO and STA column.
The Most Important Status Word Bits

/FC First Check (bit 0)

If the /FC bit is a 0 then the instruction is considered to be the first instruction being
processed. If the /FC is a 1 then the instruction being scanned will use the logic from the
previous instruction.Certain instructions like =, S and R will set the /FC bit to 0 thus starting
new logic after it. Other instructions like A or O will set the /FC bit to 1 signalling to combine
the logic with the next instruction.
RLO Result of Logic Operation (bit 1)
The RLO bit stores the running logic state of the currently processing instructions. Certain bit
logic and comparison instruction will turn the RLO to a 1 when the condition is TRUE and write
a 0 when the condition is FALSE. Other instructions read the RLO (=, S, R) to determine how
they are to execute.
STA Status (bit 2)
The STA bit reflects the state of the current Boolean address.
Help with RLO, STA and /FC
If you are used to ladder logic and struggling to understand the purpose of the RLO and STA it
may help to visualize a rung like below. The STA is used to keep track of the state of the
addresses. The RLO is used to keep track of the state of the rung.
The equivalent STL is shown below.
It steps through the logic as follows:

1. At the start the First Check bit (/FC) is zero so an And instruction will logically mirror the
Status bit (STA) over to the Result of Logic Operation (RLO). In this case the address
I0.0 is 1 so the STA is one and the result of the logic (RLO) will be 1. The A instruction
writes a 1 to /FC.
2. On the second line, the /FC bit is now 1 indicating that this line needs to use the RLO
from the previous line. The address I1.1 is on so the STA = 1. The RLO from the last
line is 1 and this is anded with the current STA with a result of 1 in the current
RLO.
3. The same thing happens on the second line but this time 1 and 0 makes the current RLO
= 0.
4. The fourth is the Assign instruction which takes the RLO and writes it out to the
corresponding address. In this case the final RLO = 0 so the output will be off. If
M0.0 was 1 then the And operation will evaluate to true making the RLO = 1 which
will then turn on the output Q1.0.
The Other Status Bits

OR (bit 3)
The OR bit is used for combining AND functions before OR functions.
OS Overflow Stored (bit 4)
In the event of an overflow (OV bit 5) the OS bit will store the value even after the OV bit has
been reset. The following commands reset the OS bit: JOS (Jump if OS=1), block call
instructions, block end instructions.
OV Overflow (bit 5)
The OV bit is set by a math instruction with floating point numbers after a fault has occurred
(overflow, illegal operation, comparison unordered). The OV bit is reset when the fault is
eliminated.
CC0, CC1 Condition Code (bits 6 and 7)

The Condition Code bits provide results for comparison and math instructions.
Comparison Instructions
CC1 CC0 Meaning
0
ACCU2 = ACCU1
ACCU2 < ACCU1
ACCU2 > ACCU1
Unordered (floating point comparison only)
Math Instructions, without Overflow

CC1 CC0 Meaning
0
Result = 0
Result < 0
Result > 0
Integer Math Instructions, with Overflow

CC1 CC0 Meaning
0
Negative range overflow in ADD_I and ADD_DI
Negative range overflow in MUL_I and MUL_DI
Negative range overflow in ADD_I, ADD_DI, SUB_I, and SUB_DI
Division by 0 in DIV_I, DIV_DI, and MOD_DI
Floating Point Math Instructions, with Overflow
CC1 CC0 Meaning

0
Gradual underflow
Negative range overflow
Positive range overflow
Not a valid floating-point number
Shift and Rotate Instructions

CC1 CC0 Meaning
0
Bit shifted out = 0
Bit shifted out = 1
Word Logic Instructions

CC1 CC0 Meaning
0
Result = 0
Result <> 0
BR Binary Result (bit 8)

The Binary Result transfers the result of the operations
onto the next instruction for reference. When the BR bit is 1 it enables the output
of the block (ENO) to be TRUE and thus allow other blocks after it to be
processed. The SAVE, JCB and JNB instructions set the BR bit.

Step 7 Fundamentals Handbook

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Step 7 Fundamentals Handbook

Uploaded by

Copyright:

Available Formats

The Case of the Missing SIMATIC Step 7 Documentation

The Case of the Missing SIMATIC Step 7

http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.]

The Case of the Missing SIMATIC Step 7 Documentation

http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.]

The Case of the Missing SIMATIC Step 7 Documentation

The Pitfalls and Warning Signs

http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.]

The Case of the Missing SIMATIC Step 7 Documentation

http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.]

The Case of the Missing SIMATIC Step 7 Documentation

Pitfall #1 Using Accessible Nodes to Open Blocks

http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.]

The Case of the Missing SIMATIC Step 7 Documentation

Pitfall #2 Viewing Online from SIMATIC manager

http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.]

The Case of the Missing SIMATIC Step 7 Documentation

Pitfall #3 Opening the Online Partner

The Case of the Missing SIMATIC Step 7 Documentation

http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.]

System Function Blocks

Generate an Off Delay

COM_FUNC Uncoordinated Sending of Data

COM_FUNC Uncoordinated Receiving of Data

COM_FUNC Sending Segmented Data

COM_FUNC Receiving Segmented Data

COM_FUNC Read Data from a Remote CPU

COM_FUNC Write Data to a Remote CPU

COM_FUNC Send Data to Printer

COM_FUNC Initiate a Warm or Cold Restart on a Remote Device

COM_FUNC Changing a Remote Device to the STOP State

COM_FUNC Initiate a Hot Restart on a Remote Device

COM_FUNC Query the Status of a Remote Partner

COM_FUNC Receive the Status of a Remote Device

HS_COUNT COUNTERS Counter (high-speed counter, integrated function) (only

FREQ_MES COUNTERS Frequency Meter (frequency meter, integrated function

NOTIFY_8P COM_FUNC Generating block related messages without

COM_FUNC Generate Block-Related Messages with Acknowledgment

COM_FUNC Generate Block-Related Messages without Values for 8

http://www.plcdev.com/book/export/html/564[14/12/2015 09:20:28 p.m.]

COM_FUNC Generate Block-Related Messages with Values for 8

COM_FUNC Generate Block-Related Messages without

COM_FUNC Send Archive Data

COUNTERS Counter A/B (integrated function) (only exist on the CPU

Position (integrated function) (only exist on the CPU 314

Continuous Control (only exist on the CPU 314 IFM)

Step Control (only exist on the CPU 314 IFM)

Pulse Generation (only exist on the CPU 314 IFM)

Positioning with Analog Output (only exist on the S7300C CPUs)

Positioning with Digital Output (only exist on the S7-300C

Controlling the Counter (only exist on the S7-300C CPUs)

Controlling the Frequency Measurement (only exist on

Controlling Pulse Width Modulation (only exist on the S7300C CPUs)

Reading a Data Record

Writing a Data Record

Sending Data (ASCII, 3964(R)) (only exist on the S7300C CPUs)

Receiving Data (ASCII, 3964(R)) (only exist on the S7300C CPUs)

Deleting the Receive Buffer (ASCII, 3964(R)) (only exist

Sending Data (RK 512) (only exist on the S7-300C CPUs)

Fetching Data (RK 512) (only exist on the S7-300C CPUs)

Receiving and Providing Data (RK 512) (only exist on the

Send interrupt to DP master

Read Predefined Parameter

System Function Calls