ST-SERV3 V58 en

1.
Training Units and Addressing
Information and Training 2. Hardware Commissioning

Automation and Drives
3. Software Commissioning
4. Functions, Function Blocks and

Multi-Instances
SIMATIC S7
5. Indirect Addressing
TIA-Service Training 3
6. Using System Blocks
ST-SERV3 Course
7. Analyzing SIMATIC S7 Diagnostic Data
AL: N ECCN: 5D992B1
Export Regulations
AL Number of European resp. German export list. 8. Diagnostic Messages with WinCC flexible
Goods with labels not equal to “N“ are subject to export authorization.
ECCN Number of US export list. (Export Control Classification Number). Goods
with labels not equal to “N“ are subject to re-export authorization for
export to certain countries.
Indication Goods labeled with “AL not equal to N“ (here: technical documentations)
are subject to European or German export authorization when being 9. Commissioning the MM 420 with the
exported out of the EU.
Goods labeled with “ECCN not equal to N“ (here: technical “Starter“ SW
documentations) are subject to US re-export authorization.
Even without a label, or with label “AL:N“ or “ECCN:N“, authorization may
be required due to the final whereabouts and purpose for which the
goods are to be used (here: technical documentations).
Decisive are the export labels stated on order acknowledgements,
delivery notes and invoices.
10. PROFINET IO
This document was produced for training purpose.
SIEMENS assumes no responsibility for its contents.
The reproduction, transmission or use of this document or its contents is not permitted
without express written authority. Offenders will be liable to damages. All rights,
including rights created by patent grant or registration of a utility model or design, are 11. Maintenance
reserved.
© SIEMENS AG 2008
12. Solutions
Name: ___________________________
Course: from ____________ to ____________ 13. What´s Next ?

Instructor:
Infoline Tel: 01805 23 56 11 14.

Fax: 01805 23 56 12
Internet: http://www. siemens.com/sitrain
Version V5.8 (for STEP7 V 5.3) 15.

Training Units and Addressing
SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

Automation and Industrial Solutions
Siemens AG 2007. All rights reserved. File: SERV3_01E.1
Contents Page
Training Area Setup with S7-300 ................................................................................................... 2
Configuration of the S7-300 Training Unit ......................................................................................... 3
The Simulator ................................................................................................................................... 4
The Conveyor Model ..................................................................................................................... 5
Complete Symbol List ..................................................................................................................... 6
If You Want to Know More .............................................................................................................. 8
Training Area Setup with S7 - 400 .................................................................................................. 9
Configuration of the S7 - 400 Training Unit ..................................................................................... 10
SITRAIN Training for ST-SERV3

Automation and Industrial Solutions Page 1 Training Units and Addressing
Training Area Setup with S7 - 300

S7 - 300 Training Area The training area consists of the following components:
• An S7-300 programmable logic controller with the CPU 315-2 DP
• Digital input and output modules, analog module
• Simulator with digital and analog sections
• Conveyor model
• ET 200S distributed peripheral
• MM420 Micromaster with PROFIBUS module
• TP170B Touchpanel
• Programming device or PC

Configuration of the S7 - 300 Training Unit
Module --> PS CPU DI 32 DO 32 DI8/DO8 AI 2
Slot No. --> 1 2 4 5 6 7
I/O Address --> 0 4 8 304

Configuration The programmable controller is configured with the following modules:
Slot 1: Power Supply 24V/5A

Slot 2: CPU 315-2 DP
Slot 4: Digital input 32x24V Inputs from the simulator
and thumbwheel buttons
Slot 5: Digital output 32x24V/0.5A Outputs from the simulator
and digital display
Slot 6: Digital input and output Conveyor model
module 8X24V/ 8x24V 0.5A
Slot 7: Analog input 2 AI Analog section from the simulator
Addresses For the training unit with the CPU 315-2DP and for the S7-400 training unit, you
can set the starting addresses of the modules by parameter assignment
(freely).

The Simulator
Potentiometers for
setting the
BCD Digital Display analog values
“QW_DigDisp“ (QW 6) “PIW_AI1“ (PIW 304)
DI DO
.0 .......... .......... .0
.1 .......... .......... .1
.2 .......... .......... .2
.3 .......... .......... .3 V
.4 .......... .......... .4
.5 .......... .......... .5
.6 .......... .......... .6 -15V...+15V AI2 AO1 -15V...+15V
AI1 AO2
.7 .......... .......... .7
.0 .......... ..........
.0
.1 .......... ..........
.1 AI1 AI2
.2 .......... .......... V
.2
.3 .......... ..........
.3
.4 .......... ..........
.5 .......... ..........
.4
.5
0 8 1 5 AI1 AI2 AO1 AO2
.6 .......... ..........
.6
.7 .......... ..........
.7
Switches LEDs Thumbwheel Buttons

/ Momentary Contact Switches (QW 4) “IW_Thumbw“ (IW 2)
(IW 0)

Design Two cables connect the simulator to the S7-300™ or S7-400™ training unit. The
simulator is divided into the following three sections:
• Binary section with 16 switches / momentary contact switches and 16 LEDs
• Digital section with 4 thumbwheel buttons and a digital display. The

thumbwheel and digital (BCD) display use BCD values,
• Analog section with a voltmeter for displaying the values at analog channels
0 and 1 or the analog outputs 0 and 1. You use the selector switch to choose
the voltage value you want to monitor. There are two separate
potentiometers for setting the values for the analog inputs.
Addressing You use the following addresses to address the inputs and outputs in your user
program :
Sensor / Actuator (DI32, DO32)
Switch / Mom.Cont. IW 0
LEDs QW 4
Thumb. buttons IW 2
Digital display QW 6
Analog channels PIW 304/306

The Conveyor Model
"K_Conv_RIGHT" (Q 8.5) "BAY1" "BAY2" "BAY3" "LB" "Horn"

"K_Conv_LEFT" (Q 8.6) (I 8.5) (I 8.6) (I 8.7) (I 8.0) (Q 8.7)
"T_Bay1" "T_Bay2" "T_Bay3" "T_Bay-LB"

(I 8.1) (I 8.2) (I 8.3) (I 8.4)
"L_Bay1" "L_Bay2" "L_Bay3" "L_Bay-LB"
(Q 8.1) (Q 8.2) (Q 8.3) (Q 8.4)

Design The slide above shows the conveyor model with its sensors and actuators.

Complete Symbol List

Complete Symbol List (Continued)

If You Want to Know More

Note The following pages contain either further information or are for reference to
complete a topic.

Training Area Setup with S7- 400

Contents of the The training area consists of the following components:

Training Area • An S7-400 programmable logic controller with a CPU 412 or CPU 413-2 DP
• Digital input and output modules, analog module
• Simulator with digital and analog section
• Conveyor model
• ET 200S distributed peripheral
• MM420 Micromaster with PROFIBUS module
• TP170B Touchpanel
• Programming device or PC

Configuration of the S7-400 Training Unit
Slot No. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
PS CPU DI DI DO DO AI
32 32 32 32 8

Design You can see the design of the S7-400 training unit in the slide above.
Configuration The UR 1 rack is configured with the following modules:

Slot 1: Power Supply 24V and 5V/20A
Slot 2: -"-
Slot 3: -"-
Slot 4: CPU 412 or other
Slot 5: vacant (when the CPU only has a single width)
Slot 6: vacant
Slot 7: vacant
Slot 8: Digital input 32x24V (from simulator)
Slot 9: Digital input 32x24V (from conveyor model)
Slot 10: Digital output 32x24V 0.5A (to simulator)
Slot 11: Digital output 32x24V 0.5A (to conveyor model)
Slot 12: Analog input 8x13 Bit (from potentiometer on simulator)
Slot 13: vacant
Slot 14: vacant
Slot 15: vacant
Slot 16: vacant
Slot 17: vacant
Slot 18: vacant
Addressing You have the default addresses, as shown in the slide above, as long as no
configuration or parameter settings have been made.

Hardware Commissioning
SIMATIC S7 Date: 13.06.2007

SITRAIN Training for
Contents Page
Objectives .......................................................................................................................................... 2
Commissioning Checklist ……….................................................................................................... 3
From Process to Project .................................................................................................................. 4
SIMATIC S7 – Project Management ................................................................................................ 5
Connecting the PG/PC to Subnets .................................................................................................... 6
Setting the PG/PC Interface …......................................................................................................... 7
PG Routing ...................................................................................................................................... 8
Online Connection using "Accessible Nodes" ……............................................................................ 9
Offline / Online View in the SIMATIC Manager ............................................................................... 10
Erasing Data Stored on the MMC .................................................................................................... 11
Performing a Memory Reset and Warm Restart ............................................................................. 12
Hardware Configuration and Parameter Assignment ...................................................................... 13
Inserting a Station and Generating a Setpoint Configuration ........................................................... 14
Configuring a PROFIBUS - DP Master System ................................................................................ 15
Configuring Compact and Modular DP Slaves …….......................................................................... 16
Monitoring and Modifying Variables ................................................................................................. 17
Opening a Variable Table and Establishing a Connection to the CPU ............................................. 18
Modifying Outputs in the STOP State ............................................................................................. 19
Exercise 1: Performing a CPU Memory Reset and a Warm Restart ............................................... 20
Exercise 2: Setting the PG Interface to MPI .................................................................................... 21
Exercise 3: Retrieving a Project and Saving It ................................................................................. 22
Exercise 4: Uploading a Hardware Station in the PG and Copying "My_Program" .......................... 23
Exercise 5: Configuring the Hardware including the ET200 ............................................................. 24
Exercise 6: Testing the Conveyor Model‘s Sensor/Actuator Wiring ................................................. 25
WinCC flexible ................................................................................................................................. 26
Configuring Phase, Downloading Phase and Process Control Phase .............................................. 27
Exercise 7: Setting the Touch Panel Interface for Transfer ............................................................. 28
Exercise 8: Switching the PG Interface to PROFIBUS DP ............................................................... 29
Exercise 9: Checking the PROFIBUS DP ......................................................................................... 30
Exercise 10: Checking the RT Interface of the WinCC flexible Station ........................................... 31
Exercise 11: Checking the Connection to the Controller ................................................................. 32
Exercise 12: Transferring the WinCC flexible Project into the TP170B .......................................... 33

Automation and Industrial Solutions Page 1 Hardware and Software Commissioning
Objectives
Upon completion of the chapter the participant will ...
… be able to establish an online connection to the controller

... be able to create a hardware station and assign parameters to it
… be able to integrate a DP station and assign parameters to it
... be able to carry out a wiring test using the "Monitor/Modify Variables"
tool
… be able to commission a touchpanel


Commissioning Checklist
• Perform a CPU memory reset.
• Carry out a CPU warm restart.
• Check the LEDs on the modules.
• Start the SIMATIC Manager.
• Configure the hardware.
• Check inputs using the Monitor/Modify Variable tool.
• Check outputs using Modify Outputs.

Checklist The checklist shows the individual preparatory steps for commissioning the
hardware. If you do not want to use the default setting, it may be necessary to
assign parameters to the modules before you check the inputs and outputs.
The individual steps are described in more detail on the following pages.

From Process to Project
Project Management
SIMATIC Manager
Hardware
FB21
OB1
I 1.0 I 1.1 Q4.0
Process Software

Process When you take a closer look at a process you want to automate, you will find
that it is made up of a multitude of smaller sections and sub-processes, which
are all interlinked and dependent on one another.
The first, most important task is to break down the automation process as a
whole into separate sub-tasks.
Hardware and Each sub-task defines certain hardware and software requirements which the
Software the automation system must fulfill:
• Hardware:
- Number and type of inputs and outputs
- Number and type of modules
- Number of racks
- Capacity and type of CPU
- HMI systems
- Networking systems
• Software:
- Program structure
- Data management for the automation process
- Configuration data
- Communication data
- Program and project documentation
Project In SIMATIC® S7 all the hardware and software requirements of an automation

process are managed within a project.
A project includes the necessary hardware (+ configuration), networking
(+ configuration), all the programs, and the entire data management for an
automation solution.

SIMATIC S7 Project Management
Multiproject
“TIA_PRO2_solution“
S7 – Standard Projects

Multiproject A multiproject folder is a folder for all projects and libraries of an automation
solution that contains one or more STEP 7 projects and, optionally, also
libraries. The projects within the multiproject can contain objects with cross-
project interrelations (such as cross-project S7 connections).
Benefits When projects are a component of a multiproject, their scope can be smaller
and easier to follow.
With the help of the multiproject you can, for example, create a project for every
operator for distributed editing and divide the stations according to their
operator between the projects.
Cross-project functions make sure that you can almost handle a multiproject
like one single project.
Examples of cross-project functions in STEP 7 (basic package):
- Save As (save multiproject with all projects in another location)
- archiving (multiproject with all projects)
- adjustment of cross-project networking (such as, bringing together subnets)
- updating the view (all projects of a multiproject)

Connecting the PG/PC to Subnets
Subnets PG with STEP 7 PC with STEP 7 SW
MPI CP 5411 (ISA)
CP5412A2(ISA)
CP 5511(PCMCIA)
CP 5611(PCI)
CP 5511(PCMCIA) CP 5511 (PCMCIA) 1)
PROFIBUS
CP 5611 (PCI) CP 5611 (PCI) 1)
CP 5412 A2(ISA) CP 5412 A2 (ISA) 2)
CP 5613 (PCI) CP 5613 (PCI) 2)
CP 5614 (PCI) CP 5614 (PCI) 2)
Ethernet CP 1411 (ISA) CP 1411 (ISA) 2)
CP 1413 (ISA) CP 1413 (ISA) 2)
CP 1511 (PCMCIA) CP 1511 (PCMCIA) 2)
CP 1613 (PCI) CP 1613 (PCI) 2)
1) All drivers are included in STEP 7 and are already installed

2) One driver has to be installed, such as with the SIMATIC NET
CD

General For troubleshooting in networked systems, you can connect the programming
device or PC directly to the various subnets, such as MPI, PROFIBUS or
Industrial Ethernet. You can see the modules that you need in order to do this in
the table in the slide above.
PG/PC Interface So that you can have an online connection with STEP 7, you have to set up the
PG/PC interface accordingly. In the slide on the right you can see an example
for connecting to Industrial Ethernet.

Setting the PG/PC Interface
Access Point
STEP 7 of the Application:
S7ONLINE
Interface Parameter
CP5611 Assignment Used:
CP5611 (MPI)
CPU

General You use the "Set PG/PC Interface" tool to define the connection between an
application such as STEP 7 and a module such as CP 5611. The tool is
activated with Start Æ Settings Æ Control Panel .
Access Point Other examples of access points are:

• CP_H1_1 for SIMATIC NET (Ethernet)
• CP_L2_1 for SIMATIC NET (Profibus)
• DPSONLINE for ProTool/Pro DP-Slave
• Micro/Win for the S7-200 software
• MPI (WinCC) for the WinCC Software
Interface Parameter Here, enter the module used, such as, CP5611 and the interface used, such
Assignment Used as, MPI. If you connect the PG to the Profibus, use the setting CP5611
(PROFIBUS). To save a switch-over of the PG/PC interface, you can also use
the setting CP5611 (Auto). The bus parameters are then automatically
determined. With this setting, however, the connection takes longer.
Properties In this tab, you adapt the parameters of the interface. For "Address", enter the
MPI address of the PG. This must be unique in the network.
To make communication possible, the "Transmission Rate" and "Highest Node
Address" parameters must be the same for all nodes (stations).
The "PG/PC is the only master on the bus" setting is only activated if only slaves
are connected to the PG.
Diagnostics With this, you can check whether a connection can be made.

PG Routing
SIMATIC PG/PC SIMATIC Controller SIMATIC Controller
SIEMENS
PG 740
MPI
PROFIBUS/Ethernet

Overview With PG Routing, you can use PG functions from a fixed location in the network
even across various subnets. During network configuration with STEP 7, special
routing tables are automatically generated for the gateways. These routing
tables contain system data and must be loaded in the S7-CPUs or CPs in the
associated gateways.
Properties With the PG, all S7 stations that were configured within an S7 project during
network configuration can be reached from a central location in the network that
you choose. User programs or a hardware configuration can be loaded with it or
test and diagnostic functions can be executed, for example.
Prerequisites • The PG Routing function can be used as of STEP 7 V5.0 + SP1.

• The communications-capable modules that the gateways are to establish
between the subnets must be routing-capable.
You can find out which modules these are from Customer Support under the
publication ID: 584459.
• All accessible automation devices (communications partners) of a system
network must be configured and loaded within an S7 project.
• During network configuration, the PG from which the S7 stations are to be
accessed also has to have been configured. Only one PG can be
parameterized as Master.
• The desired S7 station is networked and can be accessed by the PG using
gateways.
• The routing tables generated by NETPRO have to be loaded in the stations.
• The PG must be assigned to an interface.

Online Connection using "Accessible Nodes"

Area of Use This type of connection provides you with quick access, such as for service
purposes. You can access all accessible programmable modules (CPUs, FMs,
CPs) in the network. You choose this method when you don‘t have any project
data about the target systems on your PG.
What to Do You can activate the "Accessible Nodes" window with the menu options PLC Æ
Display Accessible Nodes. In the "Accessible Nodes" object, all accessible
programmable blocks in the network are displayed with their address.
Note Nodes (stations) that are not programmable with STEP 7 can also be displayed
(such as programming devices or operator panels). On the CPU to which the
PG is connected, the addition (direct) is displayed. In the slide, the CPU with the
MPI address =4.

Offline / Online View in the SIMATIC - Manager

Offline View In the project window of the SIMATIC® Manager, the offline view displays the
project structure stored on the hard disk of the programming device.
• The "S7 Program" folder contains the "Sources" and "Blocks" objects.
• The "Blocks" folder contains the system data created with the HWConfig t
tool and the blocks created with the LAD/STL/FBD Editor.
Online View The online view shows the offline project structure in the left window and in the
right window it shows the blocks stored online in the selected CPU.
As a result, the "S7 Program" seen in the online view only contains the "Blocks"
folder which contains the following objects :
• System data (SDB)
• User blocks (OB, FC, FB)
• System blocks (SFC, SFB).
The titlebar in the online window is highlighted in color.
Changing Views Changing between offline and online view takes place:
• through the View Æ Offline or View Æ Online menu items
or
• with the corresponding icon in the toolbar :
- Online
- Offline
Note You can arrange the "ONLINE" and "OFFLINE" views next to each other (as in
the slide) or under each other with Window Æ Arrange Æ vertical
(horizontal)

Erasing Data Stored on the MMC
Accessible Nodes:
Icon
or
Menu option “PLC Æ display

accessible nodes“
Project – Online – View:
Icon
or
Menu option “View Æ

S7-Project online“

Reason When a Micro Memory Card is used in the PLC, the user program is retained
after a memory reset. The following possibilities are available for erasing.
What to Do The Micro Memory Card (MMC) can be erased online through direct access to
the CPU or offline by using an appropriate interface in the programming device:
Erasing Online • In the SIMATIC Manager use the menu options "PLC Æ display accessible
nodes" to select the objects (blocks, files or S7 project archives). Press the
<DEL> button to erase online on the CPU.
or
• In the SIMATIC Manager use the menu option "View online" to get an online
view and select the objects (blocks, files or S7 project archives). Press the
<DEL> button to erase online on the CPU.
Erasing Offline 1. Insert the Micro Memory Card in the slot on the PG and, in the SIMATIC
Manager, press the icon you see to the left.
2. Thereupon, a new window opens which displays the contents of the Micro
Memory Card.
3. With the right mouse button, click on S7 Memory Card and choose the
menu option Delete. Individual objects (blocks, files, projects) can also be
erased.

Performing a Memory Reset and a Warm Restart
Until Oct. 2002 After Oct. 2002
RUN-P
RUN RUN
1. Set the mode selector switch to STOP STOP
MRES
STOP
MRES
RUN-P
2. Hold (Press) the mode selector switch in the MRES RUN
RUN
position until the STOP LED has flashed twice slowly. STOP
Release the mode selector switch so that it returns to MRES
STOP
the STOP position.
MRES
within 1 sec
RUN-P
RUN 3. Turn (Press) the mode selector switch to the MRES posi- RUN
tion once more until the STOP LED begins to flash quickly. STOP
STOP
the STOP position.
MRES
RUN-P
RUN RUN
4. Set the mode selector switch to the RUN-P (RUN)
STOP
position ! (A warm restart is carried out in the transition MRES
STOP from STOP to RUN/RUN-P)
MRES

Memory Reset A memory reset can also be initiated from the PG.
When a memory reset is performed on an S7 CPU, the following happens:
• all CPU user data as well as the entire load and work memory are cleared
• the CPU interrupts all connections to other communications partners
• the CPU parameters and all modules are set to default values
• in the case that a memory card is used, the CPU copies the relevant portion
of the stored program needed for execution into the internal RAM
Important When a memory reset is performed, only the work memory and the RAM load
memory of the CPU (insofar as it exists) are cleared, not the contents of the
inserted Memory Card (EEPROM or MMC)!
If the inserted Memory Card still contains a user program, this is automatically
reloaded into the CPU‘s work memory after the memory reset and subsequent
warm restart. Should this not be desired, you must explicitly erase the memory
card before the memory reset, as previously described.

Hardware Configuration and Parameter Assignment
Configuration Assignment of racks, cards, blocks and

distributed I/O in the station window of the
Hardware Configuration tool.
You can select the components from a
hardware catalog.
Parameter assignment Specifying the behavior of parameter

assignable modules such as startup behavior,
retentive areas, etc.
Planned hardware configuration and

Setpoint configuration parameter assignment using the Hardware
configuration tool.
Actual configuration Actual configuration and parameter assignment

of existing hardware.

HW Configuration The modules are supplied from the factory with preset parameters. If these
default settings are OK, a hardware configuration is not necessary.
A configuration is necessary:
• if you want to modify preset parameters or addresses of a module (such as
to enable the hardware interrupt of a module)
• if you want to configure communication connections
• with stations that have distributed peripherals (PROFIBUS-DP)
• with S7-400™ stations that have several CPUs (multicomputing) or
expansion racks
• with fault-tolerant programmable logic controllers (option package).
Setpoint When you configure a system, a setpoint configuration is created. It contains a

Configuration hardware station with the planned modules and the associated parameters. The
PLC system is assembled according to the setpoint configuration. During
commissioning, the setpoint configuration is downloaded to the CPU.
Actual Configuration In an assembled system, the actual existing configuration and parameter
assignment of the modules can be uploaded from the CPU. This creates a new
HW station in the project.
A configuration upload is necessary, for example, if the project structure does
not exist locally at the PG. After the actual configuration is read out, you can set
parameters and add part numbers.
Notes With the S7-400™, the CPU can be assigned parameters in such a way, that
when there are differences between the setpoint configuration and the actual
configuration, the CPU startup is interrupted.
To call the HW Config tool, there must be a hardware station in the SIMATIC®
Manager.

Inserting a Station and Generating a Setpoint Configuration

Insert Station You insert a new station in the current project by selecting the menu options
Insert Æ Station Æ SIMATIC® 300 Station or SIMATIC® 400 Station.
Generating a This means specifying how the modules are to be arranged in the rack. This
Setpoint configuration, specified by you, is referred to as the setpoint configuration.
Configuration
Rack For example, you open a SIMATIC® 300 station in the Hardware Catalog.
Opening the "RACK-300" folder shows the icon for a DIN rail. You can insert this
in the "Hardware Configuration" window by double-clicking on it (or using drag &
drop).
Two rack component lists then appear in the two-part window: a plain list in the
top part and a detailed view with order numbers, MPI addresses and I/O
addresses in the bottom part.
Power Supply If a load current power supply is required double click or use drag & drop to
insert the appropriate "PS-300" module from the catalog in slot no.1 in the list.
CPU You select the CPU from the "CPU-300" folder, for example, and insert it in slot
no. 2.
Slot No. 3 Slot no. 3 is reserved as the logical address for an interface module (for multi-
tier configurations). If this position is to be reserved in the actual configuration
for the later installation of an IM, you must insert a dummy module DM370
(DUMMY).
"Inserting" Modules From slot no. 4 onwards, you can "insert" a choice of up to 8 signal modules
(SM), communications processors (CP) or function modules (FM) from the
"HardwareCatalog" using drag & drop or with a double-click. The slots on which
the selected module can be inserted are automatically highlighted in green.

Configuring a PROFIBUS DP Master System
Result

Distributed I/O All master systems consisting of a DP master and DP slaves that are connected
using a bus cable and that communicate via the PROFIBUS-DP protocol are
designated as distributed I/Os.
DP Master As DP master you can install:

• S7-CPU with integrated DP master interface (such as CPU 315 2DP or CPU
414 2DP, etc.)
• CP in connection with a CPU (such as CP 443-5, etc.)
Setting Up DP Master To configure a master system, proceed as follows:

1. Select the PROFIBUS interface X2 of your CPU and insert a master system
(Menu Insert Æ Master System)
2. The dialog box "Properties - PROFIBUS interface DP" is opened. In this
dialog you can define the following properties:
• set up a new PROFIBUS subnet or open an existing one
• set the properties of the PROFIBUS subnet (baud rate, etc.).
• define the PROFIBUS address of the DP master.
3. Acknowledge the settings with "OK". The following symbol appears:
for the DP master system. This symbol is used as a
"hanger " for the DP slaves.

Configuring Compact and Modular DP Slaves
DP Slave
Configure rack like central hardware

DP Slaves • Modules with integrated digital/analog inputs and outputs

(compact DP slaves, such as ET200B).
• Interface modules with assigned S5 or S7 modules
(modular DP slaves, such as ET200M, ET 200S).
• S7-200/300 stations with modules that support the "Intelligent Slave"
function (such as CPU 215-DP, CPU 315-2).
Selecting DP Slaves To configure a DP slave, proceed as follows:
1. From the "Hardware Catalog" select the desired compact DP slave (such as
ET200B) or the interface module (such as IM151-1 Standard for ET200S) for
a modular slave.
2. Drag the symbol (such as IM151-1 Standard for ET200S) onto the symbol for
the master system:
The dialog box "Properties – PROFIBUS interface DP" is opened. Here you
can set the following properties:
• properties of the PROFIBUS subnet (baud rate, etc.).
• the PROFIBUS address of the DP slave.
3. Acknowledge the settings with "OK". A configuration table is attached to

the symbol (icon) that represents the I/O configuration of the compact
slave or the rack of the modular slave.
4. For a modular DP slave, you now insert the desired modules from the
"Hardware Catalog" into the configuration table.
The addressing and parameter assignment of the modules is then handled
similar to the configuration of the centrally inserted modules.

Monitoring and Modifying Variables

Monitor You can monitor variables in two ways:

• The status values are monitored or updated once when you select the
Variable Æ Update Monitor Values menu option or click the icon (Update
Monitor Values).
• The status values are monitored according to the trigger settings when you
select the Variable Æ Monitor menu option or click the icon (Monitor
Variables).
Modify Procedure for modifying variables:
1. Enter the modify value in the correct form for the data type selected.
2a. To activate the modifying or updating of the values once, select the
Variable Æ Activate Modify Values menu option or click the icon (Activate
Modify Variables).
2b. To modify according to the trigger settings, select the Variable Æ Modify
menu option or click the icon (Modify Variables).
3. Use the "Monitor" function to confirm that the modify value has been
assigned to the variable.
Modify Value Valid You can make the "Modify value" entered in a table invalid by selecting that
value and clicking on the icon. The now "invalid" value is displayed like a
comment. You can make the modify value "valid" again when you click on the
icon again. Only valid modify values can be activated.
Saving the You can use Table Æ Save or Table Æ Save as... to save a variable table.
Variable Table You can give the variable table any name you choose. The name is inserted as
the symbolic name in the symbol table.
You can reuse saved variable tables for monitoring and modifying, making it
unnecessary to re-enter the variables to be monitored.

Opening a Variable Table and Establishing a Connection to the CPU
Accessible CPUs
Configured
Directly CPU
connected
Station 1 (VAT from Station 2 Station 3
CPU HW Station
"Station 2")
PG

Area of Use Variable tables that are stored in a Blocks folder of an S7 program can be
reopened at a later time for test purposes by double-clicking on them.
However, before you can activate the "Monitor" and "Modify" functions, an
online connection to a CPU has to be established.
For this purpose, the menu commands PLC Æ Connect to . . . or the
associated icons in the toolbar provide the following possibilities:
Configured CPU If the variable table is stored in the Blocks folder of a hardware-dependent S7
program (assigned to a CPU in the project view), a connection to the station
with the MPI address is established. This station was also assigned to the
higher-level CPU with the help of the HW Config tool.
If the variable table is stored in the Blocks folder of a hardware-independent S7
program folder (assigned directly to the project root in the project view), the
MPI address of the hardware-independent S7 program can be established
using the Properties dialog of the program folder while in the online view of the
SIMATIC® Manager.
Direct... A connection is established to the CPU that is directly connected to the PG/PC
via the PG-MPI cable. The PG can determine to which PLC it is connected
through the MPI cable.
Accessible CPU In this case, a dialog is displayed with the project view. In this dialog, you can
select a program folder. An online connection can then be established to its
configured CPU.

Modifying Outputs in the STOP State

Function and The "Enable Peripheral Outputs" function can only be activated when the CPU
Area of Use is in the STOP state.
It switches off the output disable of the peripheral outputs (PQ). This enables
you to modify the peripheral output even though the CPU is in the STOP mode.
The "Enable Peripheral Outputs" function is used to check the functioning of the
output modules and the wiring of the peripheral outputs.
What To Do To enable the peripheral outputs, proceed as follows:

1. Open or edit a variable table (VAT) that contains the peripheral outputs that
you want to test or modify
(specify the peripheral outputs byte-by-byte, word-by-word or doubleword-
by- doubleword; you cannot modify individual output bits!)
2. Select the PLC Æ Connect to… menu option to establish a connection to
the CPU you want
3. Switch the CPU to the STOP state
4. Enter the appropriate values for the peripheral outputs you want to modify in
the "Modify Value" column.
Examples: PQB 7 Modify Value: 2#01000011
PQW 2 W#16#0027
5. Activate the "Enable Peripheral Outputs" via Variable Æ Enable Peripheral
Outputs
6. Activate the Modify value via Variable Æ Activate Modify Values
7. To assign new modify values, enter these and then activate them with
Variable Æ Activate Modify Values
Modifying or "Enable Peripheral Outputs" remains active until you deactivate it
using Variable Æ Enable Peripheral Outputs or you press the ESC key.
Note When you change the operating mode of the CPU from STOP to RUN or
STARTUP, the Enable Peripheral Outputs is deactivated and a message
appears.

Exercise 1: Performing a CPU Memory Reset and a Warm Restart
Until Oct. 2002 After Oct. 2002
RUN-P
RUN 1. Set the mode selector switch to STOP RUN

STOP
STOP MRES
MRES
RUN-P
2. Hold (Press) the mode selector switch in the MRES
RUN RUN
position until the STOP LED has flashed twice slowly.
STOP
STOP the STOP position.
MRES
within 1 sec
RUN-P
RUN 3. Turn (press) the mode selector switch to the MRES posi- RUN
-tion once more until the STOP LED begins to flash quickly. STOP
STOP
the STOP position.
MRES
RUN-P
RUN RUN
4. Set the mode selector switch to the RUN-P (RUN)
STOP
STOP
position. (A warm restart is carried out in the transition MRES
from STOP to RUN/RUN-P)
MRES

Task You are to perform a CPU memory reset and check whether the memory reset
was successful.
What to Do 1. If a CPU with MMC is used at your training area, the MMC must first be
explicitly erased.
For example, SIMATIC Manager Æ Accessible Nodes Æ in the Blocks
folder select all blocks Æ Delete
2. Carry out the memory reset according to the steps in the slide above
(manually and from the PG).
3. Check if the memory reset was successful. It was successful if only system
blocks (SDBs, SFCs, SFBs) are left in the CPU
SIMATIC Manager Æ Accessible Nodes Æ Double-click on MPI=2
Æ Click on Blocks
Notes To make sure that no "old" blocks are left in the CPU, a memory reset of the
CPU should be performed. The following steps are carried out during a memory
reset:
• All user data is deleted (Exception: MPI parameter assignments and the
contents of the diagnostic buffer are retained).
• Hardware test and initialization
• If an Eprom memory card or a Micro Memory Card (MMC) is installed, the
CPU copies all data on the cards that is relevant for execution back into the
internal RAM after the memory reset.
• If no memory card or Micro Memory Card is installed, the preset MPI
address on the CPU is retained. If, however, a memory card is installed, the
MPI address stored on it is loaded.

Exercise 2: Setting the PG Interface to MPI

Task The PG‘s interface is to be switched to MPI so that an online connection to the
CPU can be established.
What to Do 1. Activate the "Set PG/PC Interface" function

SIMATIC Manager Æ Options Æ Set PG/PC Interface
2. In the Properties dialog, change the properties so that they appear as those
shown in the slide

Exercise 3: Retrieving a Project and Saving It

Task You are to retrieve a project and save it under the name "My_Project".
What to Do 1. Start the SIMATIC Manager

2. Delete – should they exist – the old projects "My_Project", "SERV3_A" and
"SERV3_B"
File Æ Delete... Æ User Projects Æ select the projects from the list Æ
confirm
3. Retrieve the project "SERV3_A.zip"
FileÆ Retrieve... Æ Suchen in [Look In]: <Drive>:\S7_Courses\Select an
archive and choose "SERV3_A.ZIP" from the list Æ acknowledge with "OK"
4. Save the project under the name "My_Project"
File Æ Save As... Æ User projects Æ enter "My_Project" as the file name Æ
as the Storage Path choose <Drive>:\S7_Courses Æ confirm
Notes The project contains a WinCC flexible project for the TP170B touchpanel as well
as a hardware-independent S7 program for controlling the conveyor model.

Exercise 4: Uploading a Hardware Station in the PG and copying
"My_Program"

Task A hardware station is to be created in the project and the already existing S7
program "My_Program" is to be assigned to the CPU of the hardware station.
Note When assigning an S7 program to a CPU, its complete program folder with all
blocks including the system data and the symbol table are overwritten. The
system data lost in the process must then be regenerated with the "HW Config"
tool.
Open the HW Station with HW Config Æ Menu Station Æ Save and Compile
What to Do (also see the steps to be done that are shown in the slide)
1. In your project, create a hardware station by reading out your training unit
PLC Æ Upload Station
2. Copy or pull, using drag&drop, the S7 program called "My_Program" to the
CPU (the system data that gets lost in the process will be recreated in the
next exercise).
3. Delete the hardware-independent program called "My_Program".
Check whether the structure of your project corresponds to the one shown in
Picture 3.
Result Your project structure corresponds to the structure of your training unit. It
includes an S7 station with a CPU that contains an S7 program called
"My_Program".

Exercise 5: Configuring the Hardware including the ET200

Task The hardware configuration of the S7 station in the project is to correspond

exactly to your training unit with ET200S and the modules are to be assigned the
following parameters.
What to Do 1. Complete the actual configuration in such a way that it corresponds exactly to
your training station (with power supply module and the order numbers of all
modules).
2. Parameterize the MB 10 memory byte as CPU clock memory byte.
3. Parameterize the measuring range ±10V for the input channels 0 and 1 of the
OFF ON analog input module and deactivate (if they exist) all other input and output
channels.
64
32 4. Expand the existing configuration to include the distributed (remote) station
ET 200S (additional connection possibility for the conveyor model).
16
5. On the IM 151-1‘s address switches, set the Slave Address to 4
8
(see slide left)
4
Note: Changes to the slave address only take effect after Power ON/OFF!
2
1 6. Change the addresses of the mixed DI/DO module in the UR0 Universal
Rack to IB 88 and QB 88.
7. As the input and output addresses in the ET200 S, configure the addresses
IB 8 and QB 8.
Note: So that the 8 channels of a module are located in one byte, you have to
pack the addresses. To do so, select both modules and then click on "Pack
Addresses" (see slide)
8. After "Save and Compile" download the configuration into the CPU.
9. Verify that the configuration is error-free. The error LEDs – Group error (SF)
and bus error (BUSF) must be dark on the CPU.

Exercise 6: Testing the Conveyor Model‘s Sensor/Actuator Wiring
ET200S
Example: Q 8.5
(Conveyor to right)

Task The wiring of the conveyor model‘s sensors and actuators to the distributed
peripheral station ET200S is to be checked.
What to Do 1. Connect the conveyor model to the ET200S

2. Switch the conveyor model on (pushbutton "ON" on the conveyor model)
3. Start the "Monitor/Modify Variables" function, enter the addresses shown in
the slide and save the variable table as "VAT_I/O_conveyor"
4. Using "Monitor Variables" check the wiring of the conveyor model‘s sensors.
5. Using "Enable Peripheral Outputs" check the wiring of the conveyor model‘s
actuators.
If you should encounter any kind of error, please let your instructor know!

WinCC flexible
Advanced
Advanced Demo
- Complete funtional scope
Standard - Limited to a max. 30 days
Compact
*) Option
Micro
E n g i n e e r i n g (ES)
SIMATIC PANEL SIMATIC PANEL SIMATIC PANEL PC - based

Micro 70 / 170 270 / 370 Windows 2000
Windows XP
R u n t i m e (RT)
RT Options
WinCC flexible The Engineering System (ES) is the software with which you carry out all the
Engineering System necessary configuring tasks in order to create an interface for controlling and
monitoring machines and systems.
Editions The Engineering System of WinCC flexible is modularly graded into different
editions. The edition determines which operator panels of the SIMATIC HMI
spectrum can be configured.
With each higher edition, a wider range of target devices and functions is
supported. The configuration data is compatible.
Micro: Configuring the micro panels
Compact: Configuring the micro panels and panels of the 70 and 170 series
Standard: Configuring all panels (micro panels, panels of the 70/170/270 and
370 series)
Advanced: Configuring the PC-based and all other panels (micro panels,
panels of the 70/170/270/370 series and PC Runtime)
Advanced Demo:Test version limited to 30 days
Changing the WinCC With the WinCC flexible Compact edition and above, you can change to a higher
flexible Edition WinCC flexible edition with a "Powerpack".
Runtime WinCC flexible Runtime (RT) is the software for process visualization on the
operator panel. With Runtime, you execute the project during process operation.
The various panels already come delivered with operating system and the
appropriate Rutime version. Possible, additionally required Runtime components
are loaded along with the project onto the panel.
Options Both components can be expanded through Options (licenses).

The options depend on the target system used. An operator panel that doesn‘t
support a specific functionality also cannot use the associated option.

Configuring Phase, Downloading Phase and Process Control Phase
Configuring phase Transfer Process control phase

(Offline)
PC/PG
WinCC flexible
PC/OP/TP
Configuration Configuration
data data Flash Flash
Source file
<Name>.hmi
Ethernet MPI
DP
PLC

Introduction You configure your project on a PC or programming device (PG). You then
generate the configuration under WinCC flexible and download it to the
PC/OP/TP.
If the PC/OP/TP is connected to the PLC, the PC/OP/TP displays the current
values in the tags and graphics. The three phases of working with the
configuration data are shown in the slide.
Configuring The configuring process consists of various partial steps:
1. Defining the PLC and the type of connection (MPI, PROFIBUS DP,
Industrial Ethernet etc.)
2. Making general settings for the PC/OP/TP (defining the current
connections etc.)
3. Generating objects such as tags, screens, messages etc.
4. Downloading (transferring) the generated database to the HMI system via
MPI, PROFIBUS DP, or Industrial Ethernet
The configuration is stored as a source file <Name>.hmi in your S7 project

(Directory …HmiEs). After the compiling phase, a file of the type fwx is created
• <Name>.fwx for Windows-based HMI systems
Editors WinCC flexible includes a set of editors (tools) for configuring the different types
of objects. You create each object under a symbolic name. You must specify
this symbolic name time and again, for example, when creating, editing,
referencing or deleting the object.

Exercise 7: Setting the Touch Panel Interface for Transfer
Loader V07.01.01.00_01.34
Transfer PROFIBUS OK X
Panel is the only master on bus
Start
Station Parameters
Address: 1
Control
Panel Time-out: 1s
NetworkParameters
Transmission Rate: 1.5 Mbits/s
Highest Station: 126
Profile: DP
Bus Parameters…
Transfer Settings OK X
Channel Directories
S7-Transfer Settings OK X
Channel 1:
Enable Channel MPI
Serial:
Remote Control PROFIBUS
Channel 2:
MPI/ Enable Channel
Properties...
Profibus
Remote Control Advanced

Task The interface of the TP170B is to be set up as in the slide, so that the WinCC
flexible project can then be downloaded from the PG to the panel.
Before you can parameterize the interface, you must exit Runtime. For this,
there is, as a rule, a button in the Start screen for doing so. After exiting
Runtime, the "Loader" appears through which the "Control Panel" (see slide)
can be activated. The Loader also appears after every voltage recovery.
What to Do 1. Exit the touch panel‘s Runtime

2. Activate the "Control Panel"
3. Double-click on "Transfer" to select
4. Make the settings as shown in the slide and accept these by pressing the
"OK" button until the "Control Panel" reappears
5. Double-click on the icon "OP"
6. Press the "Save Registry" button
7. Go back to the Loader by closing the Control Panel.
8. Via "Transfer", activate the "Transfer Mode". In this mode, the TP 170B waits
for a connection set up through the PG.
Notes Channel: In addition to the serial transfer channel (Channel 1), a

second channel (Channel 2) can be selected for
downloading the project onto the operator panel.
Remote Control: The loading of the WinCC flexible project can be triggered
without first having to manually exit Runtime. The panel
automatically exits Runtime and switches to the Transfer
mode.
Advanced: Setting of transmission parameters for MPI or PROFIBUS
DP.

Exercise 8: Switching the PG Interface to PROFIBUS DP
SIMATIC Manager
Options
Set PG/PC Interface

Task So that the WinCC flexible project can be downloaed from the PG onto the
touch panel, the PG‘s interface parameters and the transfer settings of the
touch panel must both be parameterized to PROFIBUS DP.
What to Do 1. Change the PG‘s interface to PROFIBUS DP. Use the parameters shown in
the slide.
Attention:
For "Interface Parameter Assignment Used" DO NOT select "PROFIBUS -
DP Slave"
2. Plug the PG‘s online cable onto the CPU‘s PROFIBUS plug.

Exercise 9: Checking the PROFIBUS DP
SIMATIC Manager
Options
Set PG/PC Interface

Task Now connected to the PROFIBUS are:

- the PG (address 0, active)
- the Touch Panel (address 1, active)
- the S7 controller (address 2, active)
- the ET200S (address 4, passive)
Using the function "SIMATIC NET Diagnostics" (see slide), check whether all
nodes are accessible via the PROFIBUS DP.
What to Do 1. Start the diagnostic function

SIMATIC Manager Æ Options Æ Set PG/PC Interface Æ Diagnostics...
2. Check the PROFIBUS network using the "Test" button
3. Using the "Read" button, determine which nodes are accessible via the
PROFIBUS.
Note The "active" and "passive" node properties indicate whether a node can (active)
or cannot (passive) initiate communication to another node.

Exercise 10: Checking the RT Interface of the WinCC flexible Station

Task So that the panel‘s Runtime can communicate with the S7 station during the
process control phase, the panel‘s interface must be parameterized with the
HW Config tool.
What to Do Using the HW Config tool, check the parmeterization of the panel‘s interface. If
necessary (see slide) make the appropriate corrections.

Exercise 11: Checking the Connection to the Controller
2xL

Task Make a connection so that the panel‘s Runtime communicates with your training
unit.
What to Do Check whether your S7 station is set up as connection partner.

Exercise 12: Transferring the WinCC flexible Project into the TP170B

Task The given WinCC flexible project "TP_170B_Color" is to be downloaded into the
panel.
What to Do 1. Activate the Transfer function and make the settings as shown in the slide
2. Start the data transfer to the panel using "Transfer"

Software Commissioning

Contents Page
Objectives .......................................................................................................................................... 2
System Description: The Conveyor Model as Distribution Line ........................................................ 3
Check List for SW Commissioning .................................................................................................. 4
STEP7 – Debugging Tools, Overview .............................................................................................. 5
Eliminating Stop Errors ................................................................................................................... 6
Diagnostics with I Stack, B Stack, L Stack ..................................................................................... 7
Displaying the Hardware Diagnostics .............................................................................................. 8
Exercise 1: STOP Troubleshooting .................................................................................................. 9
STOP Troubleshooting ..................................................................................................................... 10
Displaying Cross References ........................................................................................................... 11
Go To Location ............................................................................................................................... 12
Step-by-Step Function Test of the System ....................................................................................... 13
Program Test with PLCSIM ............................................................................................................... 14
Program Structure of the S7 Program Provided .............................................................................. 15
Exercise 2: Commissioning - Startup Program and Operating Mode Section ................................. 16
Exercise 3: Commissioning - Checking the Weight ........................................................................ 17
Exercise 4: Commissioning - Controlling the Conveyor Motor ........................................................ 18
Exercise 5: Commissioning - Monitoring the Transport Functions ................................................... 19
Exercise 6: Commissioning - Conveyor Model – Indicator Lights .................................................... 20
Exercise 7: Commissioning - Counting Parts and Statistics .......................................................... 21
If You Want to Know More ............................................................................................................... 22
The Data Type: STRUCT (Structures) ............................................................................................. 23
Declaration of STRUCTs ............................................................................................................... 24
User-defined Data Types: UDT ........................................................................................................ 25
Using UDTs ..................................................................................................................................... 26

Automation and Industrial Solutions Page 1 Software Commissioning
Objectives
Upon completion of this chapter the participant will ...
... be familiar with the PLCSIM option package
... know the procedure for software commissioning
… be able to apply the error search functions of STEP 7 for software

commisssioning


System Description: The Conveyor Model as Distribution Line
DI DO Display Preselect
L_Weight_invalid Q 4.0 0 10
L_SYSTEM Q 4.1 0 0 0 5
V
L_MAN Q 4.2
"IW_Thumbw" (IW 2) AI1
AI2 AO1
L_AUTO Q 4.3 AO2
-15V...+15V
Statistic Values / Weight
L_Restart_man Q 4.5 AI1 AI2
L_Restart_aut Q 4.6
Preset weight
"QW_DigDisp" (QW 6) "PIW_AI1" (PIW 304)
I 1.0 T_Ackn_Fault L_Conv_Fault Q 5.0
Start Position
Start Pushbutton

Conveyor Model as Parts are laid on the coveyor at the light barrier bay and weighed. After you press
Distribution Line the pushbutton at the light barrier bay, the part is transported to the first free bay
(1, 2 or 3) and counted.
Operation The distribution line can be operated completely from the touchpanel. Messages,
such as, System ON or conveyor fault are displayed on the touchpanel as well as
on the simulator. Statistical values (quantities and utilization of Bays 1 to 3) can
be preselected via the BCD thumbwheel and are displayed on the BCD digital
display. These values are displayed on a separate screen on the touchpanel.
Operating Modes The system can be switched on and off via the buttons "System On" and "System
Off". When the system is turned on, either the MANUAL or AUTO mode can be
preselected using the button "M/A-ModeSelect" and then switched on using the
button "Accept".
MANUAL Mode In Manual mode, you can move the conveyor in the desired direction using the
buttons "Jog right" and "Jog left".
AUTO Mode When AUTO mode is switched on, the indicator light at the light barrier bay
indicates with its continous light that a new part can be placed in the light barrier
if …
• …a valid weight is set on the simulator potentiometer (100 < weight < 400)
• …at least one of the Bays 1 to 3 is free (bay indicator light is dark)
• …there is no conveyor fault (LED "L_Conv_Fault" or display on the TP)
Transport is started by pressing the pushbutton at the light barrier bay. As soon
as a part reaches an empty bay, the conveyor motor is stopped. A 2Hz flashing
indicator light indicates that the part can be removed from the conveyor. The bay
is still considered to be occupied even though the part has been removed and is
only enabled when the bay pushbutton is pressed to acknowledge the change.
Each transport function is monitored for time. If it takes longer than 6 seconds,
there is a fault and the conveyor motor is automatically switched off.

Check List for Software Commissioning
• Hardware commissioning is completed.
• Download user program.
• Eliminate stop errors.
• Step-by-step function test of the system.
• Document program modifications.
• Save and archive the program.

Hardware Make sure that the hardware commissioning was carried out.
Commissioning For this, a visual control of the LEDs on the modules was carried out and the
sensors and actuators were checked with the "Monitor/Modify Variables" tool.
Downloading User Software commissioning begins by downloading the user program.

Program Previous to that, the memory was reset on the CPU and the CPU was switched
to the Stop state. As a rule, the user program also contains the configuration
data with the module parameters.
Stop Errors After a warm restart, errors can now occur that lead the CPU to Stop. You can
localize these with the "Module Information" tool and eliminate them.
Function Test After the Stop errors have been eliminated, you have to check the correct
of the System functioning of the system. If the user program is a structured program, you can
carry out the commissioning step-by-step, by enabling the block calls one after
the other in the organization block.
Documenting If program modifications are necessary during commissioning you must

Program document them. You can do this in several ways.
Modifications The easiest way is to hand-write corrections into the program printout. You can
also enter appropriate comments into the blocks and adjust the version identifier
of the blocks.
Saving and Archiving The final version of the program is transferred to diskette when commissioning
the Program is completed. So that the project can fit onto a diskette, it must be archived
(compressed).

STEP7 - Debugging Tools, Overview
Error
Error detected by the System: Functional fault:

General Rule: CPU in STOP General Rule: CPU in RUN
(such as accessing a non-existent DB) (Process fault, such as a wire break)
(Diagnostic interrupt of a signal module) (logical programming error, like a double assignment)
Debugging Tools:
Debugging Tools:
• Module Information
• Monitor / Modify Variables
- Diagnostic buffer
• Monitor Blocks (Block Status)
- I STACK
• Reference Data
- B STACK
- Cross References
- L STACK
- Assignment of I/Q/M/T/C
• Hardware Diagnostics
- Program Structure
- Addresses without Symbols
- Unused Symbols
Regardless of the cause of the error you could use:

• Enable Peripheral Outputs (control outputs)
• Force
• Set Breakpoints

Using There are various STEP 7 test functions for troubleshooting, depending on the
Test Functions ... type of error caused:
…when CPU in STOP For errors that are detected by the system, the test functions Diagnostic Buffer, I
STACK, B STACK, L STACK and Hardware Diagnostics give detailed
information on the cause of the error and the location of the interruption. By
programming Error OBs (see the chapter on Organization Blocks), information
on the error that occurred can be evaluated by program and the transition of the
CPU into the STOP state can be prevented. If the CPU has stopped, the use of
the test functions Monitor / Modify Variable and Monitor Blocks makes little
sense since the CPU neither reads nor outputs process images while in the
STOP state, and also no longer executes the program.
…when CPU in RUN Vice versa, it makes little sense, as a rule, to use test functions such as I
STACK, B STACK or L STACK for troubleshooting when the CPU is in RUN,
since program execution has not been interrupted and the system does not
provide any information on the error that occurred. The Module Information test
function merely provides general information on the CPU‘s operating mode or
on errors that occurred in the past. Functional errors can be diagnosed as
follows:
• Process Fault (such as a wiring error)
- wiring test of the inputs: Monitor Variable
- wiring test of the outputs: Enable Peripheral Outputs (only when CPU
STOP)
• Logical Programming Errors (such as a double assignment)
- All test functions listed, with the exception of Enable Peripheral Outputs ,
can be used for searching for logical program errors.
Force Forced control of addresses regardless of the program logic.

Breakpoints For following the program execution in single steps.
Both test functions are used mostly during program design.

Eliminating Stop Errors

Introduction If no program was written for an error organization block or the error OB
contains the call of the SFC block "STOP", then the CPU goes into the Stop
state when there are program errors or hardware faults. You can determine the
cause of the Stop from the diagnostic buffer.
The diagnostic buffer is a part of the "Module Information" tool. It can be
accessed from the SIMATIC Manager or from the Program Editor by selecting
the menu options:
PLC -> Diagnostic/Setting Æ Module Information Æ Diagnostic Buffer tab.
Diagnostic Buffer The diagnostic buffer is is a FIFO buffer in a battery-backed memory area in the
CPU that cannot even be deleted by a memory reset. It contains all diagnostic
events in the order in which they occurred.
All events can be displayed on the programming device in plain text and in the
sequence in which they occur.
Details on Event When you select an event, additional information is supplied in the "Details on
Event" box:
• Event ID and event number,
• additional information, depending on the event, such as the address of the
instruction that caused the event,
• etc.
Open Block When you click on the box, the block in which the error
occurred can be opened in the CPU.

Diagnostics with I Stack, B Stack, L Stack
Block containing error
Program structure
Point of interruption
The B stack shows a list of the Point of interruption

blocks that were executed up
to the point of interruption.
You can see the contents of the You can see the values of the
accumulators, registers, status word temporary variables at the
etc. at the time of interruption in the
time of interruption in the L stack.
I stack.

Introduction For synchronous errors (OB 121, OB122) it may make sense, depending on the
circumstances, to display further information about the cause of the error or its
location using the stack contents (I stack, B stack, L stack). That way, you can
determine for example, which values were stored in the accumulators at the
time when the CPU went into STOP.
B Stack Blocks are often called several times in a user program. This means that the
information concerning the block number and the instruction causing the
interruption does not clearly indicate in which call chain the error occurred.
The B stack contains a list of all those blocks called whose execution at the time
of the transition to the STOP state were started but were not as yet completed.
I Stack The I stack contains the contents of the registers at the time of interruption:
• contents of the accumulators and address registers
• which data blocks are open
• contents of the status word
• program execution level (such as OB 1 or OB 10)
• interrupted block specifying the network and the number of the instruction
• next block to be executed
L Stack The L stack contains the values of the temporary variables of the blocks. You
need some experience to evaluate this data however, since the contents are
given in a "Hex Dump" rather than in "plain language".

Displaying the Hardware Diagnostics
Twice

Diagnosing Hardware The function opens the station that can be accessed online and gives you
information about the status or operating mode of the modules. You can see that
there is diagnostic information for a module when you see the diagnostic symbols
that indicate the status of the associated module or the operating mode of the
CPU. When you double-click the symbol, a screen with further information pops
up.
In the example shown, the analog input module (slot 7) has triggered a diagnostic
interrupt. As a result, the CPU has gone into the STOP mode. Both modules have
been given symbols accordingly. By double-clicking the CPU, you would see the
diagnostic buffer. By double-clicking the analog module, you would be given the
relevant diagnostic data. In the example, the external auxiliary voltage (supply
voltage) of the analog module has failed.
Opening the Tool You can call the function as follows:

• in the SIMATIC Manager
- using PLC Æ Diagnostic/Setting Æ Hardware Diagnostics
- in the online view with a double-click on the Hardware icon of the station
• in HWConfig, by opening the station using the online button
Customizing Settings If you have selected the Options Æ Customize Æ View menu options in the
SIMATIC® Manager and activated (checked) the "Display Quick View when
Diagnosing Hardware" checkbox, only a list of faulty modules will be displayed
instead of the full "Diagnosing Hardware" view.
Note You will find an actual application example on this test function in the Analog
Value Processing chapter.

Exercise 1: STOP Troubleshooting

Task The previously described S7 program for controlling the conveyor model is now to
be commissioned. It contains 3 STOP errors that you are to find and eliminate so
that the CPU remains in RUN after a warm restart.
What to Do Please note, that after every STOP error correction, you must carry out a CPU
warm restart. If, after the warm restart, the CPU once again goes into the STOP
state, there still exists a further STOP error.
1. Create a backup copy of the S7 program provided which is called
"My_Program" and rename it "Backup_Program".
2. Download all the blocks of the S7 program "My_Program" into the CPU and
carry out a warm restart.
3. Search for and correct the 3 STOP errors and while making the corrections
answer the questions of the following page.
Note In addition to the errors (STOP errors) detected by the system, the program also
contains functional errors (RUN errors) so that the correct program function is still
not established after the STOP errors have been eliminated. The RUN errors will
be eliminated in the next exercises.

STOP Troubleshooting
What to Do Please note, that after every STOP error correction, you must carry out a CPU
warm restart. If, after the warm restart, the CPU once again goes into the STOP
state, there still exists a further STOP error.
During error correction, answer the following questions on the errors that occur:
First STOP error determined:

interrupted block: ...................…………………………………………………..….
error: ................………………………………………….......................................
correction: (old instruction Æ new instruction)
……….……...………..………………………………………………………...…….
Second STOP error determined:

interrupted block: .................…………………….…………………….....……….
error: ........……………………………………………….......................................
………………………………...…………………………………………………….
Even if it is not necessary for troubleshooting here:
From the B STACK determine in which block the FC 28 is called and a faulty
actual operand is passed:
Block called: ...........…………………………………… ……………………….…
From the I STACK determine which data block was open via the DB Register 1
at the time of interruption:
Data block opened via DB Register 1: …….....................……………………..…
Third STOP error determined:

interrupted block: .............……………………….…………………….....……….
error: ...............………………………………………….......................................
……………...……………………………………………………………………….
Even if you already know the solution:
Open the SIMATIC station with HW Config and check what the correct
peripheral addreass must be.

Displaying Cross References

Area of Use The Cross References (list) gives you information about how which addresses
are used in which blocks (with which instruction). Thus, you can find out, for
example, where in the entire user program a memory bit is (double) assigned.
You open the cross references with View Cross Æ References or by clicking the
icon you see here on the left.
You can display the cross references for all inputs, outputs, bit memories,
timers, counters, blocks (except OBs), peripheral inputs and outputs.
Cross Reference of When you select an address in the cross reference list, you can open a new
Individual Addresses window using the right mouse button and View Æ Cross Reference for Address.
This window contains only the cross references for this one address.
Structure The cross references list is structured as a table. This list has the following
columns:
• Address (Symbol): absolute address of the operand
• Block (Symbol): block in which the address is used
• Type: read-only (R) or write-only (W) access
• Language: programming language in which the block was
created
• Location: network and instruction which uses the address

Go To Location
1 x right

Function and In troubleshooting, it is often necessary only to determine where one address is
Area of Use used or assigned in the program. In this case, it makes more sense to call the
"Go To Æ Location" function instead of the cross references list. The Go to
Location is called directly from the LAD/FBD/STL Editor and gives you an
excerpt from the cross references list for the specific address.
When you select the option Overlapping Access to Memory Areas, word-by-
word accesses to an address are also displayed, for example.
Handling Using the right mouse button, click on the address. The Go to Location dialog
window appears. Its entries have the same meaning as those in the cross
references.
If an entry is of particular interest or an indicated program location is to be
shown, you use Go To Æ Location to open the indicated block with the Editor.
In the above example, the program location at which the input I 0.2 is scanned
(Access Type R) is of interest. After selecting the relevant line, you can use the
Go To button to open FC 17, NW 5 directly.
When you click the Starting Point button, you return to the beginning.
Type of Access By default, all accesses to the addresses are displayed. When you choose
"Selection", you can display, for example, write-only accesses (assignment, set,
reset).

Step-by-Step Function Test of the System
1
Startup
6 5 4
FC 1 FC 2
Scan
cycle DB 4
3 2
FC 3 FB 4
FB 4
7
Hardware
interrupt
8
Cyclic
interrupt
x Sequence for program test

Introduction You can carry out the commissioning of a structured program (every block
contains a specific system function) step-by-step.
What to Do Download the user program with the exception of the organization blocks. That
way, the blocks are not yet executed.
Now, as a first step, you can test the start-up characteristics by downloading the
OBs for the startup (OB 100-OB102).
The cyclic program can now be tested step-by-step, that is, beginning with the
block in the highest nesting depth (in the example FB 4). For this, the necessary
block calls are inserted in OB 1. Then you can commission system sections, that
consist of a group of blocks (in the example FC 1). To do so, insert a network
with the instruction BEU into OB 1 (which contains all block calls). Move this
network through the program until all blocks are called.
Depending on the program structure, the program sections for interrupt handling
are either tested at the end (if the interrupt program doesn‘t intervene in the
cyclic execution) or are integrated in the test of the cyclic program.

Program Test with PLCSIM

Area of Use With S7-PLCSIM (option package), you can process and test your program on a
simulated automation system that exists on your computer or programming
device.
Since the simulation is implemented completely in the STEP 7 software you
don‘t need any S7 hardware (CPU or signal modules).
With the simulated S7-CPU, you can test programs for S7-300 and S7-400
CPUs and eliminate errors.
S7-PLCSIM offers you a simple operator interface for monitoring and modifying
the various parameters that are used in your program (to switch on and switch
off inputs, for example). While your program is being processed by the
simulated CPU, you can run the STEP 7 software to monitor and modify
variables with the variable table (VAT), for example.
That way, the program quality can be increased and commissioning time
reduced.
Functions The following functions are available for testing the user program:
• continuous scan or single scan mode,
• display of Tabs,
• simulation of inputs, outputs, bit memories, timers, counters, and data,
• ActiveX Control for exchanging process values with another application.
Call The simulation software is called directly from the SIMATIC Manager with the
icon

Program Structure of the S7 Program Provided

Application The program structure describes the call hierarchy or the nesting of blocks in an
S7 user program.
Block, Instance DB Displays the name of the block and the associated instance DB. If "Display
absolutely and symbolically" was selected in the filter settings, the symbolic
name for both is also displayed.
Local Data (in Path) Displays the sum of the bytes needed in the CPU for local data that are required
for the called blocks of a call path up to the respective block.
Language Shows the language for the calling block that is located one level up in the call
hierarchy.
Location Shows the language-dependent location of the call position in the calling block
that is located one level up in the call hierarchy.
Local Data Displays the number of bytes for local data that are needed in the CPU for the
call of the block.

Exercise 2: Commissioning - Startup Program and Operating Mode
Section
DI DO
L_Weight_invalid Q 4.0
L_SYSTEM Q 4.1
L_MAN Q 4.2
L_AUTO Q 4.3
L_Restart_man Q 4.5
L_Restart_aut Q 4.6

Function (OB100) A manual warm restart (CPU STOP->RUN) is indicated with the simulator LED
Startup Program "L_Restart_man" (Q 4.5); an automatic warm restart (power recovery) with the
simulator LED "L_Restart_aut" (Q 4.6).
Function (FC 15) The system is switched on via the touchpanel button "System On". It is switched
Operating Mode off via the button "System Off". The state is indicated with the simulator-LED
Section "L_SYSTEM" (Q 4.1) and displayed on the touchpanel.
When the system is switched on, the warm restart indicators "L_Restart_man"
(Q 4.5) and "L_Restart_aut" (Q 4.6) are automatically acknowledged.
When "L_SYSTEM" (Q 4.1) is turned on, a MAN mode or an AUTO mode can
be preselected via the button "M/A-ModeSelect" and then switched on using the
button "Accept". With every preselect change, the mode currently active is
switched off.
What to Do 1. Open the OB1 block and after the "Call FC 15" instruction, insert the
instruction "BEU" (Block End unconditional).
2. On the touchpanel select the "Conv" screen.
3. Correct the program (S7 program and/or the touchpanel program!) so that
the above-described functions are established.
Note You will eliminate the problem of the flashing simulator LED "L_Weight_invalid"
in the next exercise.
Errors Found .............................................................................................................................

.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
Exercise 3: Commissioning - Checking the Weight
DI DO Display Preselect
0 10
L_SYSTEM Q 4.1 0 0 0 5
L_MAN Q 4.2 V
"IW_Thumbw" (IW 2) AI1
L_AUTO Q 4.3 AI2 AO1
AO2
-15V...+15V
Statistic Values / Weight

L_Restart_man Q 4.5 AI1 AI2
L_Restart_aut Q 4.6
Preset weight
"QW_DigDisp" (QW 6) "PIW_AI1" (PIW 304)
Message when
invalid
weight
Display
of current
weight

Function (OB35) The part weight (0 to 500kg) is simulated via the simulator potentiometer
Weight Check "PIW_AI1" (PIW 304) and displayed on the touchpanel in the screen "Conv".
As long as an invalid weight (weight < 100kg or weight > 400kg) is set…
• … the simulator indicator light "L_Weight_invalid" (Q 4.0) flashes
• … a message exists on the touchpanel in the screen "Messages"
• … a display window appears once showing the message
What to Do 1. On the touchpanel, select the "Messages" screen

2. On the simulator potentiometer, set an invalid weight and check whether the
corresponding messages (see slide) are displayed.
Errors Found .............................................................................................................................

.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
.............................................................................................................................

Exercise 4: Commissioning - Controlling the Conveyor Motor
Bay 3 Start Position

"BAY3" (I 8.7) "LB" (I 8.0)
Start Pushbutton "T_Bay-LB" (I 8.4)

Note The conveyor model indicator lights don‘t show any signals as yet since the
corresponding program section (FC 14) has not yet been commissioned. In this
block, however, the maintenance, of which bay is empty and which one is
occupied or has not yet been acknowledged, is also programmed.
Consequently, all bays are currently always "empty". Since a transport function
always ends at the first "empty" bay, this now always happens at Bay 3.
Function (FC 16) The control of the conveyor motor is programmed in FC 16 and is to function in
Conveyor Control the MANUAL and AUTO modes as follows:
MANUAL Mode When MANUAL mode is switched on, you can move the conveyor using the
buttons "Jog left" and "Jog right".
AUTO Mode With AUTO mode, a transport function works as follows:

The start position for a transport is the light barrier bay. The transport function is
started after a part is placed on the conveyor in the light barrier and the start
momentary contact "T_Bay-LB" (I 8.4) has been pressed. The transport function
is stopped as soon as the part reaches an empty bay (in the current program
status, always Bay 3).
What to Do 1. Open the OB1 block and move the instruction "BEU" (Block End
unconditional) to behind the instruction "Call FC16".
2. On the touchpanel, select the "Conv" screen.
3. Test the jogging to the RIGHT and LEFT while in MANUAL mode.
4. Set a valid weight (100 < Weight < 400) and check the transport while in
AUTO mode.
Errors Found .............................................................................................................................

.............................................................................................................................

Exercise 5: Commissioning - Monitoring the Transport Functions
DI DO
L_SYSTEM Q 4.1
L_MAN Q 4.2
L_AUTO Q 4.3
L_Restart_man Q 4.5
L_Restart_aut Q 4.6
T_Ackn L_Conv
I 1.0 Q 5.0
_Fault _Fault
Conveyor Fault:
- Flashing light
- Message
Start Pushbutton "T_Bay-LB" (I 8.4)

Function (FC 17) The transport functions while in AUTO mode are (timely) monitored. If a
Monitoring transport function takes longer than 6 seconds, the conveyor is switched off and
the fault is indicated with a flashing light on the simulator LED "L_Conv_Fault"
and on the touchpanel in the screen "Conv". As well, a display window appears
with a message that is also output in the "Messages" screen.
Only after the fault has been acknowledged via the touchpanel button
"Acknowledge Fault" or on the simulator via the pushbutton "T_Ackn_Fault"
(I 1.0) can a new transport function be started.
Durchführung 1. Open the OB1 block and move the instruction "BEU" (Block End
2. On the touchpanel, select the "Conv" screen and activate the AUTO mode.
3. Test whether a transport function can be started.
4. Check whether the corresponding messages (as shown in the slide) are
output when there is a conveyor fault.
Errors Found .............................................................................................................................

.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
.............................................................................................................................

Exercise 6: Commissioning - Conveyor Model – Indicator Lights
Bay 1 Bay 2 Bay 3 Start Position

"BAY1" (I 8.5) "BAY2" (I 8.6) "BAY3" (I 8.7) "LB" (E 8.0)
"T_Bay1 (2) (3)" "L_Bay1 (2) (3)" Start button

I 8.1 (2) (3): Q 8.1 (2) (3): "T_Bay-LB" (I 8.4)
Acknowledgement Dark: Bay empty
Moment.Contact Cont. light: Bay occupied "L_Bay-LB" (Q 8.4):
Flash. light: Remove part Cont. light: Put new part on conv.
Flash. light: Press Start button

Function (FC 14) In AUTO mode, the parts are transported from the light barrier bay to the first
Indicator Lights empty bay. When the part reaches the bay, the conveyor stops and the indicator
light the the associated bay indicates with a 2Hz flashing light that the part can
be removed from the conveyor. After the part has been removed, the bay is still
considered to be "occupied" which is indicated by a continuous light on the
indicator light. Only after acknowledging with the associated bay momentary
contact is the bay "enabled".
What to Do 1. Open the OB1 block and move the instruction "BEU" (Block End
2. On the touchpanel, select the "Conv" screen
3. Activate the AUTO mode and set a valid weight.
4. Check whether all bays are utilized.
Errors Found .............................................................................................................................

.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
.............................................................................................................................
.............................................................................................................................

Exercise 7: Commissioning - Counting Parts and Statistics
Display Preset Statistic Values / Weight
0 0 0 5 0 0 3 3
"IW_Thumb" (IW 2) "QW_DigDisp" (QW 6)
0001 to 0003 Quantities Bay 1 to 3
0004 Total Quantity
0005 to 0007 Utilization Bay 1 to 3
0008 Current weight

Function (FB 18) The parts transported in AUTO mode are counted for each bay. The total
Count Parts/Statistic quantity and the quantities of the individual bays as well as their proportional
utilization are displayed on the touchpanel in the "Statistic" screen.
Function (FC 28) In addition to the weight set on the simulator potentiometer, the above-
BCD Display mentioned quantities can also be displayed on the BCD digital display. For this,
the appropriate preselection must be set on the BCD thumbwheels:
Preselection at IW 2: Display at QW 6:
0001 to 0003 Quantites Bay 1 to 3
0004 Total Quantity
0005 to 0007 Utilization Bay 1 to 3
0008 Current part weight
other Error message 'EEEE'
What to Do 1. In OB1, remove the instruction BEU (Block End unconditional) so that all
blocks are executed.
2. On the touchpanel, select the "Statistic" screen.
3. Compare the values from the Statistic screen with the values that are
displayed on the BCD digital display.
4. Check the above-described functions and correct the program (both the S7
as well as the touchpanel program!)
Errors Found .............................................................................................................................

.............................................................................................................................
.............................................................................................................................


complete a topic.

The Data Type: STRUCT (Structures)
STRUCT (Structure):
z Group of Motor: STRUCT
components of Set_Speed: REAL
different data types Actual_Speed: REAL
z Declaration: Enable: BOOL
StructName: STRUCT Disturbance: BOOL
Comp1Name: data type; END_STRUCT
Comp2Name: data type;
...
END_STRUCT
Example:
z Declaration of a variable: Access to the variable
• MotorControl : STRUCT S #MotorControl.ON
ON : BOOL; L #MotorControl.ActualSpeed
OFF : BOOL; T #MotorControl.SetSpeed
SetSpeed : INT; ...
ActualSpeed : INT;
END_STRUCT;

Overview The STRUCT (Structure) data type represents a specific number of components
that can each have different data types. A structure can have up to eight nesting
levels.
A structure can be declared in the declaration part of a logic block, in a global
DB or in a user defined data type (UDT).
The following restrictions apply for the data types of the components of a
structure:
• elementary (no restrictions)
• complex (DATE_AND_TIME, ARRAY, STRUCT, UDT)
• no parameter types
• no FBs (multi-instance model)
Access to STL instructions can be used to access components (elementary data types) of
Components a structure. A component of the structure is addressed using:
• StructureName.ComponentName
A period must be inserted between StructureName and ComponentName as a
separator.
If the nesting depth of the structure is greater, that is, components of the
structure are in turn structures, then access of the lowest components of the
structure is possible using the “name path”, such as:
• StructureName.ComponentName.SubcomponentName. ...
A period must be inserted between the names of components and
subcomponents in each case.

Declaration of STRUCTs
Example: Declaration of Array - Structure - Array
"Hall_1" (DB6, Declaration view)
"Hall_1" (DB6, Data view)

Overview In the above example, a one-dimensional ARRAY [1 to 4] with components of

the STRUCT type is declared within DB6 ("Hall_1") with the incremental data
block editor.
The structure in turn consists of three components of which the first two, that is,
"START" and "STOP" have the BOOL data type. The third component has the
complex data type ARRAY[1 to 10].
The components of this ARRAY[1 to 10] data type are in turn of the STRUCT
type with the REAL components "Cutoffpoint_front", "Cutoffpoint_ back" and
"Stoppingpoint" .
Access The individual components can be addressed as follows, for example:

• L "Hall_1".Axis[3].Position[7].Cutoffpoint_back
• S "Hall".Axis[2].START, etc.
Initialization The individual structure components can be pre-assigned values in the

of STRUCTs declaration (column “Initial Value”). The following parameters or variables
cannot be initialized:
• input, output and in/out parameters for FCs
• in/out parameters in FBs
• local data in OBs, FBs and FCs
The initialization value’s data type must be compatible with the component’s
data type.
Acceptance of If new initialization values are entered in the declaration view of a DB, these
Initialization changes become effective (valid as actual values) only after the menu option
Values Edit Æ Initialize Data Block has been carried out.
The initialization values of STRUCTs in the declaration of input and output
parameters in FBs are accepted in the instance DB when it is generated.

User-defined Data Types (UDT)
UDT user-defined data types:
z create a template
for later use
in declarations
z globally valid for all blocks
of the program folder
Example:
z Definition of a new data type (Structure):
UDT1 STRUCT
SetSpeed : REAL; ...
ActualSpeed : REAL; UDT1: STRUCT
Enable : BOOL; Set_Speed: REAL
Disturbance : BOOL;
END_STRUCT; Actual_Speed: REAL
z Declaration of variables: Enable: BOOL
Motor_1: UDT1; Disturbance: BOOL

Motor_2: UDT1; END_STRUCT
z Access to variables:
L #Motor_1.ActualSpeed

Overview When a data structure repeats itself frequently in a user program or when a data
structure is to be given its own name, then STEP7 permits user defined data
types (UDT= User Defined Data Type) to be defined (like typedef in the high
level language "C").
A task to be solved can be programmed more efficiently through the use of
application-related data types. Users, like manufacturers, can then draft and use
data types adapted for their problem.
Creation of UDTs UDTs are created with the DB Editor or with the text editor and then stored in
the block folder as a block (UDT1 to UDT65535).
A symbolic name can then be assigned to this UDT or to the related data
structure in the global symbol table. A globally valid "template" is created
through a UDT. This template can then be used as often as is desired in the
declaration of new variables or for the creation of global DBs.

Using UDTs
UDT5
FC23

Overview In the above example, UDT5 is created from four components (SetSpeed,
ActualSpeed, Enable, Disturbance) for a drives structure and then inserted in
FC23 in the declaration of in/out parameters.
A one-dimensional ARRAY with 10 components of the UDT5 data type is
declared in FC23.
Initial Values for User defined data types are pre-assigned and then used in the user program
UDTs just like structures. The structure of a UDT is the same as that for a STRUCT.
The declaration of variables that can be processed by the user program, has not
yet taken place with the creation of a UDT. The UDT is a "template" that you can
use as often as you like for the declaration of new variables.
Just as with a structure, you can also define initial values in the UDT. If the UDT
is then used for the declaration of a variable, the contents of these variables are
initialized with the initial values of the UDT (not for parameters in FCs, for in/out
parameters of FBs and temporary variables).
Creation of DBs A UDT can also be used as a pattern for the creation (Dialog: New Data Block)
of a global data block. In this case, a DB is set up with the same structure and
with the initial values of the respective UDTs.

Functions, Function Blocks and Multi-Instances

Contents Page
Objectives ........................................................................................................................................ 2
Block Overview in STEP 7 ............................................................................................................... 3
Variables - Overview ........................................................................................................................ 4
Total Usage of the Local Data Stack ................................................................................................. 5
IEC Counter and Timer Functions ........................................................................................................ 6
Exercise 1: Replacing Traditional Counters with IEC Counters (SFBs) .......................................... 7
Exercise 2: Replacing the Traditional Timer Function with IEC Time (SFB) ................................... 8
Blocks for Structured Programming ................................................................................................. 9
Parameter Declaration in Functions and Function Blocks ................................................................. 10
Function Properties .......................................................................................................................... 11
Function Block Properties ................................................................................................................. 12
Instance Formation of Function Blocks ............................................................................................. 13
Structure of the Multi-Instance Model ................................................................................................ 14
Exercise 3: Using Multi-Instances of the Type IEC Counter ............................................................ 15
Exercise 4: FB 17: Using Multi-Instances of the Type IEC Timer .................................................... 16

Automation and Industrial Solutions Page 1 FC, FB and Multi - Instances
Objectives
... reinforce his knowledge of data types and parameters
… understand the properties of functions and function

blocks and be able to apply them
… understand the term "reusability" and be able to apply it
… understand the basics of multi-instantiation
… be able to copy and program reusable function blocks

for the conveyor model


Block Overview in STEP 7
Type of Block Properties

- user interface
Organization
- graduated priorities (0 to 27)
block (OB)
- specific start information in the local data stack
- parameter-assignable (parameters can be assigned in a call)

Function block (FB)
- with (recall) memory (static variables)
- parameter-assignable (parameters must be assigned in the call)

Function (FC)
- basically without memory (only temporary variables)
- structured local data storage (Instance DB)

Data block (DB)
- structured global data storage (valid throughout the entire program)
System function - FB (with memory) stored in the CPU‘s operating system and
block (SFB) callable by the user
System - function (without memory) stored in the CPU‘s operating system

function (SFC) and callable by the user
System data
- data block for configuration data and parameters
block (SDB)

Blocks in STEP 7 Blocks are, by their function, their structure or their application, limited parts of
the user program. The blocks in STEP 7 can - in keeping with their contents - be
divided into two classes :
• User Blocks: User blocks include Organization Blocks (OB), Function Blocks
(FB), Functions (FC) and Data Blocks (DB).
The programming person stores the program instructions for data
processing or process control in the blocks (OB, FB and FC).
In the data blocks (DB), the programming person can save data that occur
during program execution and then reuse them at a later time.
User blocks are created in a programming device and are downloaded from
there into the CPU.
• System Blocks: System blocks include System Function Blocks (SFB),
System Functions (SFC) as well as the System Data Blocks (SDB).
SFBs and SFCs are used to solve frequently required PLC standard tasks.
They are integrated in the CPU‘s operating system.
SDBs contain parameter assignment data that are evaluated exclusively by
the CPU. SDBs are not created or written by the user program, but by tools
such as HW-CONFIG or NETPRO.
SDBs are created by these tools during saving of the parameter
assignment data - invisible to the user - and downloaded into the CPU.
Downloading is only possible in the STOP mode.
Downloading In addition to the advantages of structured programming, the STEP 7 block

Blocks Later On concept also provides the following advantage:
• User blocks (OB, FB, FC and DB) in STEP 7 can be modified and
downloaded into the CPU during runtime.
That way, software parts of the system can be upgraded during running
operation or (software) errors that occur can be eliminated, for example.

Variables Overview
Global Variables / Data Local Variables / Data

(valid in the entire program) (only valid in one block)
Temporary Variables Static Variables

• PII / PIQ
• are overwritten with undefined • are retained even after the
• I / O Peripherals values after the associated block is executed
•M/T/C block is executed
• permanent storage in DBs
• DB areas • temporary storage in L stack
• can be used in FBs only
• usable in OBs / FCs / FBs
absolute symbolic
Access

General Up until now, the inputs and outputs in our programs were coded directly with
their actual address assignments. This type of programming is fixed to these
address locations and is therefore not well-suited for repetitive processes.
Blocks that are not parameterized are best used for custom machinery where
there is no repetition in the process.
For frequently reoccurring functions in larger systems it is better to make
reusable, parameter-assignable blocks (Functions, FCs and Function Blocks,
FBs). These blocks use symbolic input and output parameters (local symbol
names), which are supplied with actual operands when the block is called.
You have to assign these operands when you make a call to a Function or a
Function Block. The program logic of the FC/FB remains unchanged and you
can therefore reuse the logic several times.
Local Variables Up until now, you used global variables (bit memories and data blocks) to save
production data, for example. In this chapter you will find out more about data
storage in local variables.
Local variables can be read only by the block in which they were originally
created. Because of this, local variables cannot be used as data interfaces
between different program blocks.
There are two types of local variables: Temporary and Static.
• Temporary Variables:
Temporary variables are variables that are stored only while the block is
being executed. They can be declared in all program blocks (OB, FC, FB).
• Static Variables:
If the data are to be retained even after the block is executed, the data must
be stored in static variables.
Static variables can only be declared in function blocks. The instance DB
assigned to the FB is used as the storage location for these static variables.

Total Usage of the Local Data Stack
Operating
system
1
OB 1 FC 17 FC 20
3
2
with temp. with temp.
variables 4 variables
5 FC 30
7 with temp.
6 variables
Result 1 2 3 4 5 6 7
Usage of
the L stack
256 Bytes
FC30
FC20
FC17 FC17 FC17 FC17 FC17
OB1 OB1 OB1 OB1 OB1 OB1 OB1

Total Usage For every program execution level or priority class (such as, OB 1 with all
blocks that are called in it or by it), a separate L stack is reserved. That is, a
segment of defined size is reserved on the L stack of the CPU (allocation or
reservation of memory space).
The local variables of OB 1 as well as the local, temporary variables that are in
blocks (FCs and FBs) called in or by OB 1 are stored in this L stack.
You can use the "Reference Data" tool to show to what extent an S7 program
puts a burden on the Local stack.
Reference Data In the SIMATIC Manager, select the Blocks folder and choose the menu
options Options Æ Reference Data Æ Display Æ Program Structure.
Note If the (CPU specific) maximum number of local data is exceeded (overflow of
the L stack) during program execution in the CPU, the CPU goes into the
STOP mode. "STOP caused by error when allocating local data" is entered as
the cause of error in the diagnostics buffer.

IEC Counter and Timer Functions

General In addition to the traditional timer and counter functions (SIMATIC S5), you also
have the IEC timers and counters..
They correspond in their function to the IEC standard 61131 (EN 61131). They
are stored as system blocks in the CPU‘s operating system.
Benefits The IEC timers and counters have greater timer and counter ranges. The
number of timers and counters is only limited by the size of the work memory.
Timer range as Time data type: -T#24D_20H_31M_23S_648MS to

+T#24D_20H_31M_23S_647MS
Counter range: -32768 to 32767.
Timers The following IEC timers and counters are available:

• Generation of a pulse: SFB 3 "TP"
• Generation of an ON delay: SFB 4 "TON"
• Generation of an OFF delay: SFB 5 "TOF"
• Count up: SFB 0 "CTU"
• Count down: SFB 1 "CTD"
• Count Up/Down: SFB 2 "CTUD".
Note Please look in the STEP 7 ONLINE Help for an exact description of the
individual system function blocks. To do so, select the block and press the F1
key.

Exercise 1: Replacing Traditional Counters with IEC Counters (SFBs)

Task In "FB_Statistic" (FB 18), the transported parts for each bay are counted with
traditional counters (S5 counters). In order to implement a greater counting
range, the traditional counters are to be replaced with the IEC counter "CTU"
(SFB 0).
What to Do 1. In FB 18, replace the S5 counters used with the IEC counter "CTU"
(SFB 0) and use the data blocks DB 101 to DB 103 as instance data blocks
in the call of the SFB 0.
Note:
In the LAD/FBD/STL Editor, you will find the necessary IEC counter "CTU"
(SFB 0) under: View Æ Overviews Æ in the Overviews folder Libraries Æ
Standard Library Æ System Function Blocks
2. Download all modified / newly generated blocks into the CPU and test the
program.

Exercise 2: Replacing the Traditional Timer Function with IEC Time
(SFB)

Task In "FC_Fault" (FC 17), the transport functions while in AUTO mode are
monitored with the traditional timer (S5 time). The traditional timer is now to be
replaced with the IEC timer "TON" (SFB 4).
What to Do 1. In FC 17, replace the S5 timer used with the IEC timer "TON" (SFB 4) and
use the data block DB 104 as instance data block for the SFB.
Note:
In the LAD/FBD/STL Editor, you will find the necessary IEC counter "CTU"
(SFB 0) under: View Æ Overviews Æ in the Overviews folder Libraries Æ
Standard Library Æ System Function Blocks
2. Download all modified / newly generated blocks into the CPU and test the
program.

Blocks for Structured Programming
Modularization of the OB 1 FB1 FB10
Entire Task: Motor 1 Controller
Controller
Motor 1
Partial tasks are solved in . . .
their own blocks
FB2 FC 5 SFC
Parameter assignment Limit
enables flexible usage Valves Copying
Valves value
• Example: Drilling cycle
with parameter- DB 2
assignable depth OB 1 FB 1
Address Decl. Name Type
0.0 in Start BOOL
Re-usability of Blocks: . 0.1 in Stop BOOL
2.0 out Motor_on BOOL
Blocks can be called as . 4.0 out Speed INT
6.0 stat Speed_old INT
often as is required CALL FB1, DB2 0.0 temp Calc_1 INT
Start :=I 0.0
Restrictions: Stop :=I 0.1 .
.
• no access to global Motor_on :=Q12.0 .
Speed :=QW14 A #Start
addresses . AN #Stop
= #Motor_on
• communication only via . .
the parameter list

Modularization Abstraction is the basis for solving complex problems, in which we concentrate
of Tasks on the fundamental aspects of a program in every abstraction level and ignore
all the details that are not essential. Abstraction helps us to divide complex tasks
into partial tasks which can then be solved on their own.
Structured STEP7 supports this concept of modularization with its block model. The partial
Programming tasks that result from the division of the entire task are assigned blocks in which
the necessary algorithms and data for solving the partial problems are stored.
STEP7 blocks such as functions (FC) and function blocks (FB) can be assigned
parameters so that the concepts of structured programming can be implemented
with them. This means:
• Blocks for solving partial tasks implement their own data management with
the help of local variables.
• Blocks communicate with the "outside world", that is, with the sensors and
actuators of the process control or with other blocks of the user program,
exclusively through their block parameters. No access to global addresses
such as inputs, outputs, bit memories or variables in DBs can be made from
within the instruction section of blocks.
Advantages Structured programming has the following advantages:

• The blocks for the partial tasks can be created and tested independent of
one another.
• With the help of parameters, blocks can be designed so that they are
flexible. That way, for example, a drilling cycle can be created that has the
coordinates and the depth of the drilling hole passed on to it by means of
parameters.
• Blocks can be called as often as is required in different locations with
different parameter data records, that is, they can be reused.
• "Re-usable" blocks for special tasks can be delivered in pre-designed
libraries.

Parameter Declaration in Functions and Function Blocks
Parameters are the channels
for transferring information: Add. Decl. Name Type Initial Value ...
Input parameters: 0.0 in Start BOOL FALSE
Caller -> Block 0.1 in Stop BOOL TRUE
2.0 in Speed INT 0
Output parameters:
2.0 out Motor_on BOOL FALSE
Block -> Caller
8.0 out Setpoint INT 0
In/Out parameters:
10.0 inout EMER_OFF BOOL FALSE
Caller <-> Block
... stat ... ... ...
Parameters form the ... temp .. ... ...
"shell" of a block:
Parameters are in the code section
like "local" variables
Parameters can have any
"Motor" ENO
EN
data type
Out-
Data type check during Start Motor_on put
call Input Setpoint para-
Stop
(Exception: POINTER, ANY) parameters Speed
meters
Call interface is In/Out
language-independent EMER_OFF
parameters
PLC languages
can be mixed

Overview Parameters are used as channels for transferring information between the
calling block and the called block. The symbolic names, data types and, if
necessary, initial values of parameters are established in the declaration table.
Declaration Types The type of parameter indicates the direction of the data transfer:
in Input parameters (FB, FC): They are used to pass information from the calling
block to the called block. Only a read-only access to the input parameters is
possible within the called block.
out Output parameters (FB, FC): They are used to pass information (results) from
the called block back to the calling block.
in_out In/Out parameters (FB, FC): In/Out parameters are used to transfer information
in both directions. A read and write access is possible to in/out parameters.
Name and Type Just like local variables, parameters have a symbolic name and a type (data or
parameter type). Parameters can be used in the code section of a block in the
same way as local variables of the same data type.
For this reason, parameters are also called formal parameters within a block.
Block Calls In a block call, the formal parameters of a block (FC) must be assigned to actual
parameters. If the FB is not assigned actual values with the call, initial values
from the DB will be used.
To avoid a misinterpretation (regarding the data type) or erroneous use of the
actual parameters that are passed, the PLC Editor checks that the actual
address created is exactly the same type as the formal parameter when the
block is called (Exception: POINTER and ANY).
The type check and the parameter passing mechanism is language
independent. This guarantees that blocks that were created with different PLC
Editors (STL, LAD, FBD, SCL, etc.) can call each other.

Function Properties
Parameter-assignable
blocks:
as many input, output, and Function FC10
in/out parameters as
required Program
in On_1 BOOL
in On_2 BOOL
without memory, i.e. only execution out Off BOOL
temporary variables ...
IEC 61131-3 conform: CALL FC 10

On_1 := I 0.1 ...
as many input parameters On_2 := I 0.2 A #On_1
as required Off := Q8.0 A #On_2
= #Off
only one output parameter ...
RET_VAL
no access to global
variables and absolute
addresses
with the same input
parameters they deliver the
identical result
Expand the instruction set of
the processor
Overview Functions represent parameter-assignable blocks without memory. In STEP 7

they can have as many input parameters, output parameters and in/out
parameters as is required.
Functions have no memory; no separate, permanent data area for storing
results exists. Temporary results that occur during function execution can only
be stored in the temporary variables of the respective local data stack.
Functions expand the instruction set of the processor.
Application Functions are primarily used when function values are to be returned to the
calling blocks. (for example, mathematical functions, single control with binary
logic operation).
IEC 61131 If IEC 61131-3 conforming functions are to be created, then the following rules
Conforming must be observed:
Functions
• Functions can have as many input parameters as is required. They can,
however, only return one result to the output parameter RET_VAL.
• Global variables can neither be read nor written within functions.
• Absolute addresses can neither be read nor written within functions.
• No instances of function blocks can be called within functions.
Because of the missing "memory", the returned result of a norm-conforming
function is solely dependent on the values of the input parameter. For identical
values of the input parameter, a function also returns the identical result.
It is therefore up to the programming person to create norm-conforming
functions or to do the block programming and structuring in STEP 7 as it is in
STEP 5.

Function Block Properties
Parameter-assignable blocks: Drive
IEC 61131-3 conforming DB 16
as many input, output and 0.0 Start BOOL
in/out parameters as 0.1 Stop BOOL
required FB 5 2.0 Motor_on BOOL
4.0 Speed INT
with memory, that is, not in Start BOOL
only temporary but also in Stop BOOL
static variables out Motor_on BOOL
out Speed INT
Call with own data area stat ...
(instantiating) CALL FB5, DB16 Temp...
Start :=I 0.0
"Data encapsulation„ Stop :=I 0.1
Motor_on :=Q8.0 ...
Speed :=QW12 A #Start
Application: AN #Stop
= #Motor_on
Timer and counter functions ...
Controlling process units
with internal states
boilers
drives, valves, etc.

Overview Function blocks (FB) are blocks of the user program and represent logic blocks
with memory according to the IEC Standard 61131-3. They can be called by
OBs, FBs and FCs.
Function blocks can have as many input, output and in/out parameters as is
required as well as static and temporary variables.
Unlike FCs, FBs are instantiated, that is, an FB is assigned its own private data
area in which the FB can "remember" process states from call to call, for
example. In the simplest form, this private data area is its own DB, the so-called
instance DB.
"Memory" The programming person has the opportunity to declare static variables in the
declaration section of a function block. The function block can "remember"
information from call to call in these variables.
The ability of a function block to "remember" information over several calls is the
essential difference to functions.
Application With the help of this "memory", a function block can implement counter and
timer functions or control process units, such as processing stations, drives,
boilers etc., for example.
In particular, function blocks are well suited for controlling all those process units
whose performance depends not only on outside influences but also on internal
states, such as processing step, speed, temperature etc.
When controlling such units, the internal status data of the process unit are then
copied to the static variables of the function block.

Instance Formation of Function Blocks
OB, FB or FC SFB 0 DB 2
Counter
Algorithm values
CALL SFB0, DB2
...
for
counting
+ for
... Bay 1
FB Instance
FB x
stat Bay_1_count SFB 0 Counter

stat Bay_2_count SFB 0 values
stat Bay_3_count SFB 0 for
SFB 0 Bay 1
CALL #Bay_1_count Counter

Algorithm values
CALL #Bay_2_count for
for
counting
CALL #Bay_3_count Bay 2
Counter
Declaration within FBs
values
(Multi – instances) for
Bay 3

What is an The concept of instantiating function blocks has great importance and makes up
Instance? the essential distinctive criterion to the FCs. The setting up of variables within a
high level language such as "C" under declaration of variable name and data
type in the declaration is called "instantiate" or "instance forming".
Just like variables, function blocks are also "instantiated". Only through this
‘own’ data area, in which the block parameter values as well as the static
variables are stored, does an FB become an executable unit (FB-instance).
The control of a physical process unit, such as a drive or a boiler then takes
place with the help of an FB instance, that is, a function block with an assigned
data area. The relevant data for this process unit are then stored in this data
area.
Instantiating You can create an FB instance, that is, the assignment of its own memory area
in an FB call, in two ways in STEP 7:
• through the explicit declaration of an instance data block when a function
block is called.
• through the explicit declaration of instances of a function block within a
higher-level function block (multi-instance model).
STEP 7 then makes sure that the data area required for the instance is set
up within the data area of the higher-level FB.
Advantages The instance concept of STEP 7 has the following advantages:

• In the call of FBs, no measures for saving and administrating local data are
necessary except for the assignment of instance DBs.
• A function block can be used several times due to the instance concept. If,
for example, several drives of the same type are to be controlled, then this
takes place using several instances of an FB. The status data of the
individual drives are stored in the static variables of the FB.

Structure of the Multi-Instance Model
DB10
FB10
FB1
...
e.g. OB1 stat Drill FB1 Algorith-
stat Motor_1 FB2 ms Data
stat Motor_2 FB2 for for drill
drilling
.
CALL FB10,DB10
CALL Drill
. Data
. FB2
for
CALL Motor_1 Control Motor_1
logic for
.
a motor
CALL Motor_2 Data
for
Motor_2
Instance DB of FB10

Multi-instance Model In addition to instantiation of function blocks, when you specify an instance DB
in an FB call, STEP 7 also supports the explicit declaration of FB instances
within a higher-level function block.
For this purpose, instances of the called function blocks are declared with data
type FB1 or FB2 using symbolic identifiers (Drill, Motor_1 and Motor_2). This
takes place in the declaration section of the calling FB 10 function block in the
section "static variable". Within the higher-level function block, the individual
instances are then called using their symbolic identifier. The higher-level FB10
function block must however be called with its own instance DB (DB10).
In the creation of the higher-level instance DB, STEP 7 makes sure that the data
areas required for the individual instances are set up in the data area of the
higher-level FB10.
In the call of the individual instances using the symbolic names, the CALL macro
makes sure that the AR2 register is set to the beginning of the data area
assigned to the instance so that the parameters and local variables of the
instance are also accessed during the processing of the called function block.
Benefits The use of the multi-instance model has the following benefits:
• The individual instances do not require their own data block every time.
Within a call hierarchy of function blocks, only one instance DB is used in
the call of the "outer" function block.
• The multi-instance model "welds" a function block and an instance data area
into one object (FB instance), that can also be handled as one unit. The
programming person does not have to take care of the management
(creation, addressing) of the individual instance data areas. He must simply
provide an instance DB for the "outer" FB.
• The multi-instance model supports an object-oriented programming style.

Exercise 3: Using Multi-Instances of the Type IEC Counter
right
mouse button

Task In "FB_Statistic" (FB 18), the bay quantities are recorded, while in AUTO mode,
by calling the IEC timer "CTU" (SFB 0). The data blocks DB 101 to DB 103 are
used as instance data blocks for the SFB calls.
Instead of the direct SFB calls, calls of multi-instances of the data type SFB 0
are now to be employed.
What to Do 1. In FB 18, declare the multi-instances, that is, the static variables "Count1",
"Count2" and "Count3" of the data type SFB 0 (see slide).
2. In FB 18, replace the calls of the IEC counter, that is, the calls of "CTU"
(SFB 0) with the previously declared multi-instances.
Note: The call of a multi-instance is edited exactly the same way as that of
an FC or FB. You will find the declared multi-instances in the Program
Element Catalog in the directory "Multiinstances".
A conventional FB call can also be changed very easily into a multi-instance
call, as shown in the slide.
3. In OB 1, update the call of the FB 18 and download all modified / newly
generated blocks into the CPU.

Exercise 4: FB 17: Using Multi-Instances of the Type IEC Timer

Task To make use of the benefits of the multi-instance model, a multi-instance of the
type "TON" IEC Timer is now to be used instead of the directly used IEC timer.
Note Multi-instances can only be declared in FBs. The timely monitoring of transport
functions programmed in FC 17 must therefore now be programmed in an FB.
Since it is not possible to rename an FC as an FB, the FB must be created. To
do so, proceed as follows:
What to Do 1. Create the new "FB_Fault" (FB 17) function block and in it declare the multi-
instance or static variable "SD_Time" of the data type SFB 4 (see slide).
2. From FC 17, copy all networks into the new FB 17.
3. In FB 17, replace the call of the SFB4 with the call of the multi-instance
"SD_Time" (see slide)
4. Instead of FC 17, now integrate FB 17 into your program and use the DB 17
data block as the instance DB to FB 17.

Indirect Addressing (1)
er
? o int
#P
?
#Ini_Value
?
#Counter

Contents Page
Objectives ........................................................................................................................................ 2
Addressing Possibilities with STEP 7 ................................................................................................ 3
Direct Addressing of Variables ......................................................................................................... 4
Direct Addressing of Address Identifiers in Data Blocks .................................................................... 5
Analyzing DB Information in the Program ........................................................................................ 6
Memory Indirect Addressing ............................................................................................................. 7
Structure of Pointers with Memory Indirect Addressing ..................................................................... 8
Address Areas for Storing 16-Bit and 32-Bit Pointers ........................................................................ 9
Example of Memory Indirect Addressing ........................................................................................... 10
Testing the Program Execution using Breakpoints (Part 1) ............................................................. 11
Testing the Program Execution using Breakpoints (Part 2) .............................................................. 12
Exercise 1: Storing Part Weight Values (FC 35) ........................................................................... 13
If You Want to Know More .............................................................................................................. 14
Programming Loop Operations ....................................................................................................... 15
Area-Internal, Register Indirect Addressing ...................................................................................... 16
Area-Crossing, Register Indirect Addressing .................................................................................... 17

Automation and Industrial Solutions Page 1 Indirect Addressing (1)
Objectives
... understand the basics of memory indirect addressing

and be able to apply it
… understand and be able to assign parameters of the

ANY type
… be familiar with register indirect addressing
… be able to use the test function "Breakpoint"


Addressing Possibilities with STEP 7
Addressing Procedure
Direct Addressing Indirect Addressing
absolute symbolic memory indirect register indirect
32-bit pointer
16-bit pointer 32-bit pointer 32-bit pointer area-
(DB, T, C) area-internal area-internal crossing
Examples:
A I 4.0 A "Mot_on" OPN DB[MW10] A I[MD30] A I[AR1,P#0.0] A [AR1,P#0.0]

L IW10 L #Num SP T["runtime"] L IW["Number"] L ID[AR1,P#5.0] T W[AR1,P#0.0]

Direct With direct addressing, the memory location is coded in the instruction. That is,
Addressing the address identifier specifies the address value the instruction is to process.
Symbolic In a control program, addresses can have absolute addressing (such as I 1.0)
Addressing or symbolic ("start signal" for example). The symbolic address uses names
instead of the absolute addresses.
A program is easier to read when meaningful names are used. With symbolic
addressing differentiation is made between local symbols (in the declaration part
of a block) and global symbols (symbol table).
Indirect With indirect addressing you are able to address address identifiers whose
Addressing address is determined only at program runtime. With indirect addressing,
program parts, for example, can be scanned repeatedly (loop programming),
whereby the addresses used are assigned different addresses with every scan.
With indirect addressing, differentiation is made between:
• memory indirect addressing: A pointer to the addressed address is found in
a user memory’s memory cell (such as MD30).
With memory indirect addressing, the variables, in the memory in which the
pointer of the addressed address identifier is stored, can also be assigned
symbolic names.
• register indirect addressing: The pointer to the addressed address is loaded
in one of the two address registers (AR1 or AR2) of the S7 processor before
being accessed. (Is dealt with in the Course ST-PRO3).
Caution Since the addresses are only calculated at run-time with indirect addressing,
there is the danger that memory areas are unintentionally overwritten and you
can then have an unexpected PLC reaction.

Direct Addressing of Variables
Memory Additional
Address Meaning
Location (for example) Access Widths
Byte, word,
I 37.4 Inputs
double word
Byte, word,
Q 27.7 Outputs
double word
Byte, word,
PIB 655 Peripheral inputs
double word
Byte, word,
PQB 653 Peripheral outputs
double word
Byte, word,
M 55.0 Bit memories
double word
T 114 -- Timers
C 13 -- Counters
Byte (DBB), word (DBW), Data addressed via

DBX 2001.6
double word (DBD) DB register
Byte (DIB), word (DIW), Data addressed via
DIX 406.1
double word (DID) DI register
Byte (LB), word (LW),
L 88.5 Local data stack
double word (LD)

Direct Addressing With the help of direct addressing, simple (elementary) variables, that is,
of Variables variables up to a length of a maximum of 4 bytes, can be addressed. Simple
variables consist of:
• an address identifier (such as: "IB" for input byte)
• an exact address (memory location) (byte or bit address) within the memory
area, that is determined by the address identifier.
Global, symbolic names (symbol table) can also address addresses or simple
variables.
Peripherals Unlike S5, it is now necessary to make a distinction between inputs and outputs
when accessing peripherals. However, it is still only possible to have a read-only
access (L PIW) of peripheral inputs and a write-only access (T PQW) of
peripheral outputs.
Local Data With STEP 7 it is also possible to have an absolute access of the local data
stack’s own blocks, for example:
• A L 12.6 (scan local data bit with address 12.6 for signal state = 1)
• L LW 12 (Load local data word in ACCU1)
DBX/DIX You can also access directly simple variables within data blocks:
• A DBX 12.6 (Scan data bit with address 12.6 of a DB for signal state =
1, DB must be opened beforehand).
• L DB5.DBW10 (Load DW10 in DB5)
Complex You can symbolically access local variables that have a complex data type,
Variables such as structures or arrays,.
Absolute access is only possible with components of complex variables that are
elementary data types.

Direct Addressing of Address Identifiers in Data Blocks
Open Load and transfer

data blocks in data blocks
OPN DB 19 L DBB 1 Load data byte 1

OPN "Values" L DBW 2 Load data word 2 (byte 2/3)
L5 Load number 5
T DBW 4 Transfer into word 4
OPN DI 20 L 'A' Load ASCII character A
L DIB28 Load data byte 28
A DBX 0.0 Scan bit 0 from byte 0
Combined instruction L DB19.DBW4 Load data word 4 from DB 19

(contains OPN DB..)
L "Values".Number_1 Symbolic access of
variable Number_1. DB19
has the symbol name
"Values"
A DB10.DBX4.7 Scan bit 7 from byte 4 of DB 10

Overview The CPU makes two data block registers available for data address processing.
The numbers of the data blocks currently open are found in these registers.
Before you can access a data block, you must first open it using one of the two
data block registers.
You can open a data block using the following instructions:
• OPN DBx or OPN DIx
or by means of a fully-qualified access to a DB variable:
• L DBx.DBWy (L DIx.DIWy is not possible!)
In this case DB number x is also loaded in the DB register.
Addressing Data blocks are organized byte-by-byte in STEP7. For the direct access of
addresses with BIT, BYTE, WORD or DWORD length, the byte address (as for
I/Q/M) is indicated in each case.
Symbolic Access For a symbolic access you enter the data block’s symbol name in the symbol
list. You use the DB Editor to assign symbolic names to the data block’s
individual variables.
Now, a complete symbolic access of a data element is possible with the L
"Values"..Number_1 instruction. DB19 now opens ("Values" is the symbol name
of DB 19) and DW 2 is loaded (Number_1 is the symbol name of DW2).

Analyzing DB Information in the Program
Instructions with DB Registers:

z CDB: Exchange DB Registers
DB Register 123 24
CDB 123
DI Register 24
before: after:
z Load DB Register in ACCU1

L DBNO (load opened DB number in ACCU1)
L DINO (load opened DI number in ACCU1)
z Load length of data blocks

L DBLG (load the length/bytes of the opened DB in ACCU1)
L DILG (load the length/bytes of the opened DI in ACCU1)

DB, DI Registers These registers contain the current valid numbers of the opened data blocks.
You can open two data blocks simultaneously in a call level.
STL prefers to use the first DB register for accessing shared (global) DBs and
the second DB register for accessing instance DBs. These registers are also
called DB register or DI register for this reason .
The CPU treats these registers equally. Every data block can be opened with
one of these two registers (even with both simultaneously).
CDB CDB (Exchange DB registers) exchanges the contents of the DB and DI

registers. The DB register’s contents are transferred into the DI register and vice
versa. This instruction affects neither the contents of ACCU1 nor the status bits.
L DBLG, L DILG: These instructions read out the data length of the currently opened data blocks
in number of bytes. With the help of this information, the user program can test if
a DB has the necessary length before the DB is accessed.
L DBNO, L DINO: These instructions read out the numbers of the currently opened data blocks.

Memory Indirect Addressing
z 16-bit Pointer in Word Format (Addressing of DBs, T, C)

Instruction: executed operation: (examples)
OPN DB [MW 60] OPN DB 11 if [MW60] = 11

OPN DB 25 if [MW60] = 25
z 32-bit Pointer in Double Word Format (Addressing such as for I,

Q, M,)
Instruction: executed operation: (examples)
L IW [MD50] L IW 24 if [MD 50] = P#24.0

L IW 86 if [MD 50] = P#86.0
Instruction Address Access Pointer

ID width (Address)

Overview With memory indirect addressing, the address of the variable to be accessed
is found in an address (memory location).
Program statements using memory indirect addressing contain:
• an instruction (such as: OPN, A, L)
• an address identifier (such as DB, C, T, I, QW, MD)
• and a [variable], that must be enclosed within square brackets.
This variable contains the address (pointer) of the operand that the
instruction accesses.
The instruction will interpret data stored in the specified [variables], as either a
word or double word pointer depending on the address identifier used.
Instructions with You use the 16-bit pointer for addressing timers, counters or blocks (DB, FC,
16-bit Pointers FB).
You can address all timer and counter instructions with indirect addressing. To
address timers, counters or blocks, use area identifiers of the form T, C, DB,
DI, FB, FC. The address (memory location) of the addressed operand is stored
in a word.
A DB or DI register can open a data block. If a zero is found in the pointer
when you indirectly open a data block (DB, DI), then the DB/DI register is
loaded with the value "0". An error is not triggered when you load with "0".
You can use the UC or CC instructions (not CALL) to address the call of logic
blocks indirectly. The blocks, however, may not contain any block parameters
or static variables.
This pointer in word format is interpreted as an integer number (0 to 65 535).
The pointer refers to the number of a timer (T), a counter (C), a data block
(DB, DI) or a logic block (FC, FB).

Structure of Pointers with Memory Indirect Addressing
z Structure of a 16-bit Pointer:

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 1 0 0 1 0 0 1 0 146
215 27 20
Interpretation as unsigned integer between 0 and 65 535
z Structure of a 32-bit Pointer (area-internal): P#25.3

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 0 1 1
215 20 22 20
not analyzed Byte address (unsigned integer) Bit

address
z Loading of 32-bit Pointer Constants (area-internal):

L P#25.3 (P = Pointer, Byte address= 25, Bit address: 3)

Instructions with Memory indirect addressing using 32-bit pointers can access the following
32-bit Pointers addresses :
• Bits that are addressed by bit logic operations.
I, Q, M, L, DIX or DBX can be used as address identifiers
• Bytes, words and double words that are addressed by load or transfer
instructions. IB, IW, ID, DBB, DBW, DBD, DIB, DIW, DID, PIB, PIW, PID,
can be used as address identifiers.
The address of the addressed operand is interpreted as 32-bit pointer. In this
double word, the least significant bits (bit 0 to bit 2) are interpreted as bit
address. The next 16 bits (bit 3 to bit 18) are interpreted as byte address of the
addressed operand. Memory indirect addressing does not analyze bits 19 to
31.
Note If you want to access an address by means of memory indirect addressing and
use load or transfer instructions, you must make sure the bit address of the
pointer is “0”.
If this is not the case, the CPU triggers a runtime error during execution.
Loading of 32-bit You can use the following syntax to load 32-bit pointer constants into ACCU1:
Pointer Constants
L P#<Byte address>.<Bit address>
Storage Locations for You must store 16-bit and 32-bit pointers for memory indirect addressing in
Pointers one of the following areas:
• M - Bit memory
• L - Local data
• D - Data block (DB or DI)

Address Areas for Storing 16-Bit and 32-Bit Pointers
Absolute or symbolic addressing (examples):
OPN DB[MW30] OPN DB[#DB_No]

Bit memory A I[MD30] Local data stack A I[LD10]
T QD[“Speed_1“] T QD[#Pointer]
Only addressable absolutely; DB or DI must be opened first (examples):
OPN DB[DBW0] Æ overwrites DB Register !

Global data block A I[DBD10]
T QD[DBD22]
OPN DI[DIW0] Æ overwrites DI Register !

Instance data block A I[DID10]
T QD[DID22]

Address Areas With memory indirect addressing, the address (memory location) is found in a
for Pointers 16-bit or a 32-bit address. This address can be found in one of the following
areas:
• Bit memory: as an operand addressed absolutely or as variable addressed
symbolically through the symbol table.
• Local data stack: as an operand addressed absolutely or as temporary
variable declared in the block’s declaration section.
• Global (Shared) data block: as an operand addressed absolutely. When
you use global (shared) DBs as the storage location for pointers, make
sure that the DB register (OPN DB n, for example) opens the “correct” data
block before accessing.
• Instance data block: as an operand addressed absolutely. When you use
instance data observe the following points:
• OBs and functions: Within functions or OBs, a pointer stored in an instance
data block can be used exactly as if it were stored in a global (shared) DB.
Just remember that instead of the DB register, the DI register is now used.
• FBs: Within FBs, instance data, that is, parameters or static variables,
cannot generally be used symbolically for memory indirect addressing.
• Absolute access of local data within an FB is, in principle, possible using
the “address” entered in the declaration section. However, when the FB is
used as multi instance, it must be noted that this address is not the
absolute address specified in the instance DB but is actually the
address relative to AR2.
Note When you pass pointers for memory indirect addressing to blocks or you want
to keep the value permanently in static variables, then you must copy the
pointer value from the parameter or static variable into a temporary variable.
Then complete the access using this temporary variable.

Example of Memory Indirect Addressing

Description This example shows a function that initializes all bytes, that is, all variables of a
data block and overwrites them with the value "0".
In Network 1, the number of the data block passed via the input parameter
#DBNr is first of all copied onto the temp variable #Nr, which then serves to
indirectly open the data block. It is necessary to recopy onto a temp variable
because parameters cannot be used for indirect addressing.
In Network 2, the length [in bytes] of the data block is first of all determined and
assigned to the temp variable #number, which serves as the loop counter in the
subsequent LOOP.
Within the LOOP, the temp variable #Pointer is used for indirect addressing of
the data block byte that is first of all to be overwritten with the value 0. In the first
loop pass this is the DBB 0 because #Pointer was already initialized in Network
1 on the value P#0.0. With each loop pass the #Pointer is increased by the
value P#1.0 using DINT addition so that in the second loop pass #Pointer points
to DBB 1, in the third loop pass to DBB 2 etc..
Since the number of loop passes corresponds exactly to the length of the data
block in bytes, all data block bytes are addressed in ascending order via
#Pointer and overwritten with the value 0.
Note The system function SFC 21 (FILL) can also be used to delete or pre-assign a
memory area.

Testing the Program Execution using Breakpoints (Part 1)

Breakpoints With the help of this test function, you can test a program you see in STL in single-
step mode and thus follow the sequence of the executed instructions as well as the
associated register contents.
You can set several breakpoints, depending on the CPU. The number of possible
breakpoints depends on the CPU used.
Note In order to carry out these test functions, you must have fulfilled the following
requirements:
• The "Test Operation" mode must have been assigned parameters.

• The block to be tested must be opened online.
• The LAD/FBD/STL Editor must be explicitly set to View Æ STL.
• The block must not be protected (Know_how_protect)
Breakpoint You can choose the breakpoint functions in the Program Editor by selecting the
Functions "Test" menu option or through the Breakpoint Bar.
You can activate the breakpoint bar by selecting the View Æ Breakpoint Bar menu
option in the Program Editor.
Attention If the program execution encounters a breakpoint, the CPU switches from RUN to
HOLD mode.
In this mode, the STOP LED lights up and at the same time the RUN LED flashes.
The outputs are deactivated for safety reasons.

Testing the Program Execution using Breakpoints (Part 2)
Break-
point
Next
state-
ment

Breakpoint Bar
Set/Delete Breakpoint Breakpoints Active (on/off)
Show Next Breakpoint
Execute Call
Delete All Breakpoints Resume Next Statement
Set/Delete Breakpoint With "Set/Delete Breakpoint" you determine where the program execution is to be
halted. The breakpoint‘s statement is not executed.
Breakpoints Active With "Breakpoints Active" you activate all breakpoints; not only those already set but
also those still to be set.
Show Next With "Show Next Breakpoint", the Editor jumps to the next selected breakpoint,
Breakpoint without executing the program.
Resume With "Resume", the program runs until the next active breakpoint.
Next Statement With "Next Statement", you execute the program in single-step. If you reach a block
call, you jump to the first statement after the block call with "Next Statement".
The Execute Next Statement and Execute Call menu options require a free
breakpoint for the internal implementation.
Execute Call Here, when you reach a block call you branch into the block with "Execute Call". At
the end of the block you jump back to the next statement after the block call.

Exercise 1: Storing Part Weight Values (FC 35)
Call in OB 1

Task In AUTO mode, parts are transported from the light barrier bay to Bays 1 to 3.
Always at the moment when the part reaches the first empty bay or when the
conveyor is stopped (see slide, FC 35 – call condition), the just set weight value
is to be stored in the data block "DB_Weight".
If the maximum number of part weight values is reached, the values are to be
overwritten from the beginning, that is, beginning with "PartWeight[1]".
To manage the part weight values, the data block variables "Max_Number"
(DBB 0) with the maximum number of part weight values and "Act_Number"
(DBB 1) with the current number of stored values of part weight values is used.
What to Do 1. From the S7 program called "Chap05_indirect_address" in the S7 project

"SERV3_B", copy the FC 35 block into your own S7 program.
2. Create the data block "DB_Weight" (DB 35) with the variables shown in the
slide.
3. In OB 35, program the call of the FC 35 as shown in the slide.
4. Download all modified / newly created blocks into the CPU and test the
program. Follow the storing of the individual weight values by monitoring the
DB 35 online.
5. Correct the FC 35 so that the required functions are fulfilled.
Tip:
To make it easier to monitor if the data block really overwrites from the
beginning when it reaches the maximum number, set the maximum number
to 5, for example.


complete a topic.

Programming Loop Instructions
The way it works
Initialize
loop counter
Transfer to
NEXT: loop counter
Code section to be
executed several
times
Load loop counter

in ACCU1.
Yes LOOP NEXT

decrement ACCU1,
ACCU1 <> 0 ?
No
Iteration
Continue
(end-controlled)
Code
Accu 1 > 0?

Loop Instruction The loop instruction LOOP simplifies the programming of program loops.
For programming a loop instruction, the desired number of loop scans to be
executed are loaded in ACCU1-L. LOOP interprets the right word of
Accumulator 1 as unsigned 16-bit number in the range from 0 to 65535.
With every execution of the LOOP instruction, the value in ACCU1-L is
decremented by one. Subsequently, the value is compared to zero. If the value
is unequal to zero, a jump takes place to the jump label designated in the LOOP
instruction. If the value is equal to zero no jump takes place, and instead, the
immediately following instruction is executed.
Note The loop counter must not be initialized with 0, because this would cause the
loop to be executed 65535 times.

Area-Internal, Register Indirect Addressing
z Area-internal Pointer in AR 1 or AR2:

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 B B B B B B B B B B B B B B B B X X X
215 20 22 20
not analyzed Byte address (unsigned integer) Bit

address
z Command Syntax:
LAR1 P#10.0 // Presetting of AR1: 00000000 0000 0000 0000 0000 0101 0000
+ 200
L M W [AR1, P#200.0]
Area Access Address Constant Executed: L MW 210

width register offset Instruction

Overview With register indirect, area-internal addressing, the address (memory location)
of the operand to be accessed is found in one of the two address registers (AR1,
AR2).
The address registers’ contents are, in this case, an area-internal 32-bit pointer
with the same configuration and the same meaning as with memory indirect
addressing.
Syntax With register indirect, area-internal addressing, the entire instruction consists of:
• an instruction (such as: A, L, T)
• an address identifier (such as I, MB, QD), that is the combination of an area
identifier (I, Q, M, DB, DI, etc.) and an identifier for the access width
(B=Byte, W=WORD, D=DWORD).
• and the declaration of an address register, which together with a constant
offset must be enclosed within square brackets. This offset is added to the
contents of the specified address register before the instruction is executed.
The address register’s contents and the offset have the format of area-
internal pointers consisting of byte address and bit address.
The offset’s declaration (even P#0.0) in the command syntax is imperative.
Notes • With indirectly addressed byte, word or double word addresses, the entire
offset must have the bit address "0". Otherwise the CPU triggers a runtime
error during execution of the instruction.
• If the AR1 or AR2 address register specified in the register indirect, area-
internal addressing contains an area-crossing pointer (see next page), then
the pointer’s area identifier is not evaluated during execution of the
instruction.
The area identifier in the address identifier is valid.

Area-Crossing, Register Indirect Addressing
z Area-crossing Pointer in AR 1 or AR2:

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
1 0 0 0 0 R R R 0 0 0 0 0 B B B B B B B B B B B B B B B B X X X
Area identifier Byte address (unsigned integer) Bit

address
Bit 31=0: area-internal
Bit 31=1: area-crossing
z Area Identifiers: 000 I/O 001 Inputs (PII)

010 Outputs (PIQ) 011 Bit memories
100 Data in DB Register 101 Data in DB Register 2 (DI)
110 own local data 111 LD of calling block
z Command Syntax:
LAR1 P#E10.0 // Presetting of AR1: 10000001 0000 0000 0000 0000 0101 0000
L W [AR1, P#200.0] + 200
Access Address Constant Executed: L IW 210

width register offset Instruction

Overview With register indirect, area-crossing addressing, the area identifier (such as I, Q,
M) and the address (memory location) (byte.bit address) of the operand to be
accessed is found as area-crossing pointer in one of the two address registers
(AR1, AR2).
Syntax With register indirect, area-crossing addressing, the entire instruction consists
of:
• an instruction (such as: A, L, T)
• an identifier for the access width (B=BYTE, W=WORD, D=DWORD).
• and the declaration of an address register, which together with a constant
offset must be enclosed within square brackets.
The address register’s contents must be an area-crossing pointer with an
area identifier and a byte.bit address in this case.
The offset has the format of an area-internal pointer consisting of a byte and
bit address that is added to the pointer’s byte.bit address in the declared
address register before the instruction is executed.
The offset’s declaration (even P#0.0) in the command syntax is imperative.
Notes • With indirectly addressed byte, word or double word addresses, the entire
offset must have the bit address "0". Otherwise the CPU triggers a runtime
error during execution of the instruction.
• For CPUs that have older firmware versions, access to their own local data
(identifier: 110) is not possible with indirect area-crossing addressing.
In these cases, the runtime error "unknown area identifier" is triggered.
Access to their own local data is then only possible with area-internal
addressing.

Using System Blocks

Contents Page
Objectives .......................................................................................................................................... 2
Interesting Facts about Libraries ..................................................................................................... 3
Design and Contents of the Standard Library ................................................................................... 4
Interesting Facts about System Functions ...................................................................................... 5
Overview of the System Functions (Excerpt) .................................................................................... 6
System Functions that Exist in the CPU ......................................................................................... 7
Call of System Functions and System Function Blocks .................................................................. 8
Example: "READ_CLK" (SFC 1) ....................................................................................................... 9
TIME_OF_DAY and DATE_AND_TIME Data Types ........................................................................ 10
Example: "BLKMOV" (SFC 20) .......................................................................................................... 11
Assignment of Parameters of the ANY Data Type ........................................................................... 12
Analyzing an Error Message …....................................................................................................... 13
Exercise 1: Recording the Time Stamp with SFC 1 .......................................................................... 14
Exercise 2: Data Backup with SFC 20 .............................................................................................. 15
If You Want to Know More ............................................................................................................. 16
Additional Exercise: Specified Time Relay ...................................................................................... 17
The Library: TI-S7 Converting Blocks (Excerpt) .............................................................................. 18
The Library: IEC Function Blocks (Excerpt) .................................................................................... 19
The Library: Communication Blocks .............................................................................................. 20
The Library: PID Control Blocks ..................................................................................................... 21
The Library: Miscellaneous Blocks (Excerpt) .................................................................................. 22

Automation and Industrial Solutions Page 1 Using System Blocks
Objectives
... be familiar with the standard libraries and their usage,

... be able to integrate blocks from the library in a user program
... be able to interpret the error numbers of the parameter "RET_VAL"
… be familiar with the application of multi-instances


Interesting Facts about Libraries
Area of Use:
Storage of reusable program components
It is not possible to directly transfer into the CPU and test
Library Structure:
A library may contain several program folders
A library may not contain any "Hardware"
Each program folder contains:
the folders "Blocks", "Sources", "Symbols"
the folder "Charts" (only for the option software: S7-CFC)
Using Libraries:
With the SIMATIC Manager you can:
create libraries (not with the same names as projects)
copy Blocks and Sources between libraries and projects
archive libraries
With the LAD/FBD/STL Editor you can
store network templates in libraries as Sources and then reuse them
whenever you need

Overview Libraries are used to store reusable program components for the SIMATIC S7.
The program components can be copied into a library from existing projects or
they can be created directly in the library regardless of the projects.
For the creation of S7 programs in a library, you have the same functions as for
projects – with the exception of testing.
Design Just as for projects, libraries have a hierarchical design:

• Libraries can contain S7 programs.
• An S7 program can have exactly one Blocks folder, one Sources folder,
one Charts folder as well as one Symbols object (symbol table).
• The Blocks folder contains the blocks that can be downloaded to the S7
CPU. The contained variable tables (VAT) and user-defined data types
(UDT) are not downloaded to the CPU.
• The Sources folder contains the sources for the programs created in the
diverse programming languages.
• The Charts folder contains the CFC Charts (only for the option software
S7-CFC)
When you insert a new S7 program, one Blocks and one Sources folder each as
well as one Symbols object is automatically created in it.
Using Libraries Blocks that are to be used again and again can be stored in libraries. From
there, you can copy them into the appropriate user progam and they can be
called by other blocks.

Design and Contents of the Standard Library

Introduction When you install the STEP 7 software, a standard library with the name
"Standard Library" is automatically installed on the hard drive.
Opening the Library To open a library, you either use the command: File Æ Open or the appropriate
icon in the toolbar.
Then, a further dialog pops up in which you can select the desired project,
library or sample project.
Standard Library The Standard Library contains the following S7 program folders:
• Communication Blocks: contains the functions for connecting to
distributed peripherals when using an S7-300 PROFIBUS CP,
• IEC Function Blocks: contains blocks for IEC functions such as, for handling
the data types DATE_AND_TIME and STRING,
• Miscellaneous Blocks: contains blocks for the time stamping of messages
and for time of day synchronization,
• Organization Blocks: contain all OBs with the symbolic identifiers for the start
information,
• PID Control Blocks: with function blocks for PID control,
• S5-S7 Converting Blocks: with the standard blocks needed for the
conversion of S5 programs to S7,
• System Function Blocks: contains all S7-300/400 system functions (SFCs
and SFBs),
• TI-S7 Converting Blocks: with generally usable standard functions, such as
Scaling analog values, etc.
Notes When option packages are installed, additional libraries may be created.
You can find a description of the S7 Libraries - PID and TI-S7 Converting Blocks
under: Toolbar Æ SIMATIC Æ Documentation Æ English Æ STEP 7- PID
Control or System and Standard Functions for TI-S7 Converter.

Interesting Facts about System Functions
The system functions (SFCs and SFBs) are stored

in the CPU‘s operating system
System Software Reference Manual for S7-300/400

System Functions and Standard Functions
Extensive Online help available in the STEP 7 software

Introduction Functionality, that cannot be implemented with STEP 7 instructions (for example
DB creation, communication with other PLCs, etc.) can be implemented in
STEP7 with the help of system functions (SFCs) or system function blocks
(SFBs).
SFCs and SFBs are blocks that are stored in the CPU’s operating system
instead of in the user memory. For that reason, the actual instruction part is not
transmitted but only the SFC’s or SFB’s declaration part during the reading out
of an SFC or SFB from the CPU.
With the help of the STL/LAD/FBD Editor, the "block" that is read out can be
opened and the declaration part displayed. A reverse transmission of SFCs and
SFBs into the CPU is, however, not possible.
In the user program, the SFBs and SFCs can however be called just like FBs or
FCs using the CALL instruction. With SFBs, a user DB must also be specified as
instance DB for the SFB for that reason.
Which SFBs and SFCs are available depends individually on the PLC system
(S7-300 or S7-400) used and on the CPU installed. The blocks have, however,
regardless of whether they are called in an S7-300 or S7-400, the same
numbers, the same functionality and the same call interface.
Manual An extensive description of the system functions can be found in the manual:
• The System Software Reference Manual for S7-300/400, System Functions
and Standard Functions.
Online Help There is also an extensive description of the system functions in the STEP 7
software. Call the help menu in the program editor and select the entry:
• Help Topics Æ Calling Reference Helps (LAD, FBD, STL, Blocks ... )
Æ Jumps to Language Descriptions and Help on Blocks and System
Attributes Æ Help on SFBs/SFCs.

Overview of the System Functions (Excerpt)
Function Group Function Block S7-300 S7-400

Block move SFC 20 X X
Pre-assign field SFC 21 X X
Create DB SFC 22 X X
Copy and
Delete DB SFC 23 - X
Block Function
Test DB SFC 24 - X
Compress SFC 25 - X
Replace. value in Accu. 1 SFC 44 X1) X
Multi computing interrupt SFC 35 - X
Trigger cycle time SFC 43 X X
Program Control
Stop state SFC 46 X X
Delay (Wait) SFC 47 X X
Set time-of-day SFC 0 X X

Handling the Clock Read time-of-day SFC 1 X X
Synchronize SFC 48 - X
Set counter SFC 2 X1) X

Start and stop SFC 3 X1) X
Run-time Meter
Read out SFC 4 X1) X
Read system time SFC 64 X X
1) not for CPU 312IFM

Copy and Block • SFC 20 copies the contents of a memory area (source) into another memory
Functions area (destination)
• SFC 21 fills a memory area (destination field) with the contents of a pre-
defined memory area (source field)
• SFC 22 creates a non-initialized DB in the work memory
• SFC 23 deletes a DB in the work memory and if necessary in the load mem.
• SFC 24 determines whether a DB exists in the work memory (with length)
• SFC 25 compresses the memory, since gaps occur when block corrections
are made and these gaps are closed when compression takes place
• SFC 44 (Call in OB 122) deposits a replacement value for a faulty input
module in the Accumulator. Usage in OB121 is also possible.
Program Control • SFC 35 triggers the synchronized start of OB 60 in all CPUs when
multicomputing
• SFC 43 restarts the cycle time monitoring of the CPU
• SFC 46 puts the CPU into the Stop state
• SFC 47 implements waiting times in the user program of up to 32767 µs
Handling the Clock • SFC 0 sets the real-time clock date and time on the CPU
• SFC 1 reads the current date and time of the CPU
• SFC 48 synchronizes all the slave clocks on a bus segment. The CPU with
the call must be parameterized as the master clock.
Run-Time Meter The CPU has a specific number of run-time meters with which it can record the
operating time of equipment, for example.
• SFC 2 sets the run-time meter to a pre-assigned value
• SFC 3 starts and stops the run-time meter
• SFC 4 reads the current operating hours and the status
• SFC 64 reads the CPU‘s system time. The system time is a cyclic time
counter that counts up every 10 ms (S7-300) or 1 ms (S7-400).

System Functions that Exist in the CPU

General In the "Performance Data" you can, among other things, query online which
system functions are available on a CPU.
SIMATIC Manager Æ PLC Æ Diagnostic/Settings Æ Module Information ... Æ
Performance Data

Call of System Functions and System Function Blocks
System Functions:
SFC20
CALL SFC 20 EN ENO
SRCBLK :=
RET_VAL:= ??.? SRCBLK RET_VAL ??.?
DSTBLK :=
DSTBLK ??.?
Call in STL Call in LAD
System Function DB5

Blocks: SFB3
EN ENO
CALL SFB 3,DB5
IN:=
PT:= ... IN Q ...
Q := ... PT ET ...
ET:=

System Function A system function block SFB is a function block that is integrated in the
Blocks operating system of an S7-CPU. For that reason, SFBs are not downloaded into
the CPU as part of the user program.
Just like FBs, SFBs are blocks "with a memory". They have to be instantiated in
the user program.
System Functions A system function is a function that is integrated in the operating system of the
S7-CPU. SFCs can be called from the user program just like FCs.
Just like FCs, SFCs are blocks "without a memory".
Call When a system function is called it is automatically copied into the associated
user program.
Furthermore, all system functions are stored in the Standard Library, S7
Program System Function Blocks. From this library, the SFCs and SFBs can
also be copied into the user program.
There is a completed symbol list (with English identifiers) in the library from
which the symbols of the blocks used are automatically entered in the symbol
list of the user program.

Example: "READ_CLK" (SFC 1)
SFC1
EN ENO
RET_VAL ??.?
CDT ??.?
Parameter Declaration Data Type Memory Area Description

ENO OUTPUT BOOL I, Q, M, D, L = '1' if error-free exeuction of the function
(BR Bit) = '0' if faulty execution of the function
RET_VAL OUTPUT INT I, Q, M, D, L = 0 if error-free execution of the function

= Error code if execution with errors
CDT OUTPUT DT D, L Date and Time

SFC1 "READ_CLK" The SFC 1 "READ_CLK" (read system clock) reads out the time in the CPU and
provides as a result a time stamp consisting of a date and the time of day.

TIME_OF_DAY and DATE_AND_TIME Data Types
Structure of TIME_OF_ DAY (TOD):
Number of milliseconds since 0:00 o‘clock
Structure of DATE_AND_TIME (DT):
Year Month
Byte n1) Byte n+1
(90 ... 89) (01 ... 12)
Byte n+2
Day Hour
(01 ... 31) (00 ... 23) Byte n+3
Minutes 1=Sunday
Byte n+4
Seconds 2=Monday
(00 ... 59) (00 ... 59) Byte n+5
3=Tuesday
4=Wednesday
Milliseconds Weekday 5=Thursday
Byte n+6 Byte n+7 6=Friday
(000 ... 999) (1..7) 7=Saturday
All Values in BCD format

TIME_OF_DAY A variable of the TIME_OF_DAY data type occupies a doubleword. It contains

the number of milliseconds since the beginning of the day (0:00 o‘clock) as
unsigned integer. (such as: TOD#23:59:59.999).
DATE_AND_TIME The DATE_AND_TIME data type represents a point in time, consisting of the
date and the time. Instead of DATE_AND_TIME you can also use the
abbreviation DT.
DATE_AND_TIME or DT are key words and can therefore also be written in
lower case.
In the declaration, you can pre-assign an initial value to a variable (not as block
parameter in an FC, as in/out parameter in an FB or as temporary variable).
The pre-assignment must be of the type:
• DT#year-month-day-hours:minutes:seconds.milliseconds
You don‘t have to specify the milliseconds.
Variables of the DATE_AND_TIME data type can either be processed with the
help of absolute accesses to the individual components or with the associated
functions of the IEC library.

Example: "BLKMOV" (SFC 20)
SFC20
EN ENO
??.? SRC_BLK RET_VAL ??.?
DST_BLK ??.?
Parameter Declaration Data Type Memory Area Description
SRC_BLK INPUT ANY I, Q, M, D, L Memory area to be copied

(=source field).
ENO OUTPUT BOOL I, Q, M, D, L = '1' if error-free execution of the function

(BR Bit) = '0' if faulty execution of the function
RET_VAL OUTPUT INT I, Q, M, D, L = 0 if error-free execution of the function

= Error code if execution with errors
DST_BLK OUTPUT ANY I, Q, M, D, L Memory area in which copying is to

take place (destination field)

SFC20 "BLKMOV" The system function "BLKMOV" (block move) copies the contents of a memory
area (= source field) into another memory area (= destination field).
Permittable source areas (fields) are:
• parts of data blocks
· • bit memories
· • process image input table
· • process image output table
Notes Source and destination areas may not overlap. If the specified destination area
is larger than the source area, then only as much data is copied into the
destination area as is contained in the source area. If the specified destination
area is smaller than the source area, then only as much data as fits into the
destination area is copied.
The source area can also be located in a data block that is only stored in the
load memory (DB that was compiled with the keyword UNLINKED ) !

Assignment of Parameters of the ANY Data Type
Pointer Display:
z P#[Data block.]Bit address Type Number
P#DB10.DBX12.0 REAL 20 Pointer to an area in DB10, beginning with
Byte 12, consisting of 20 addresses of
data type REAL (ARRAY[1..20] OF REAL)
P#I 10.0 BOOL 8 Pointer to a field of 8 bits in IB10
Declaration of Address:
z absolute:
DB5.DBD10 Data type: DWORD, Replication factor: 1
DB number: 5, Pointer: P#DBX10.0
IW32 Type: WORD, WF: 1, DB Nr: 0, Pointer: P#I 32.0
T35 Type: TIMER, Nr.: 35
z symbolic:
#Motor_1.speed With elementary data types, the compiler
"Pump".Start establishes the correct data type, replication
factor 1 and pointer
Note
With symbolic assignment (ARRAY, STRUCT, STRING, UDT), the data type
identifier 02 (BYTE) and the area length in bytes is merely established by the
compiler and entered in the ANY pointer
Assignment A parameter of the "ANY" data type can be assigned using the pointer display
as well as by direct declaration of address (variables).
Pointer Display With assignment using the pointer display (for example: P#DB5.DBX10.0 INT 8)
the STL/LAD/FBD Editor sets up an ANY pointer that corresponds in type and in
number with the declarations.
Assignment in the pointer display always makes sense when a data area is to
be addressed for which no variable was defined or for example, no suitable
variable (ARRAY or STRUCT, for example) can be defined (P, PII, PIQ, M, for
example).
In addition, the absolute pointer display must be used when the correct
information about the replication factor and the data type is required within the
called block (for example, ARRAY[1..8] OF REAL).
Address A parameter of the "ANY" type can also be directly assigned with the address
Display to which the ANY pointer is to point. This declaration can take place absolute or
using the symbolic variable name.
With the declaration of an absolute address, the STL/LAD/FBD Editor
automatically determines the associated data type (BOOL, BYTE, WORD,
DWORD,), a replication factor of "1", the DB number as well as the area-
crossing pointer to the first bit of the address and enters these values in the
pointer structure.
Likewise, the STL/LAD/FBD Editor determines the correct information using the
address when the declaration takes place using the symbol name and the
variable that is entered is of the elementary data type.
Note If a variable is of the complex data type (for example, ARRAY[1..8] OF REAL),
then the STL/LAD/FBD Editor merely enters information in bytes about the area
occupied by the variable (that is,: replication factor: 32, data type: BYTE).

Analyzing an Error Message
The scan of the BR-bit (binary result) returns RLO=0 for

processing with fault and RLO=1 for fault-free processing.
Scan of BR for STL with A BR
Scan in LAD/FBD using the output parameter ENO
Most of the system functions return an error code with the

following configuration in the output parameter RET_VAL (INT):
RET_VAL=W#16#8 X Y Z
Error class, error‘s individual number (SFC specific)

or event number (general)
X>0: general error, X= No. of faulty parameter
X=0: SFC specific error occurred
"8" signals: error occurred
Example:
W#16#8081 is an SFC specific error code.
W#16#823A is a general error code; the error was caused by
Parameter No. 2.

Error Information A processed SFC shows you in the user program, whether the CPU could
successfully execute the SFC function or not. You receive corresponding error
information in two ways:
• in the BR bit of the status word and
• in the output parameter RET_VAL (return value).
Note You should always proceed as follows before evaluating the SFC specific output
parameter:
• first of all evaluate the BR bit of the status word.
• subsequently check the output parameter RET_VAL.
If a faulty processing of the SFC is signalized through the BR bit or a general
error code is found in RET_VAL, you may not analyze the SFC specific output
parameter.
General Errors The general error code indicates errors that can occur with all system functions.
A general error code consists of the following two numbers:
• a parameter number between 1 and 127, whereby 1 indicates the first
parameter, 2 the second parameter etc., of the SFC called.
• an event number between 0 and 127. The event number indicates a
synchronous error.
An extensive description of the general error codes can be found in the manual:
"System Functions and Standard Functions" or in the Online Help.
Specific Errors Several system functions (SFCs) have a return value that provides a specific
error code. This error code indicates that an error that belongs to a specific
system function occurred during the processing of the function.
A description of the specific error code can be found in the Online Help for the
associated system function (keyword "Error Information").

Exercise 1: Recording the Time Stamp with SFC 1
DB 18
FB 18
Year/Month
Day
Hours/Minutes
Seconds
ms/weekday

Function (FB 18) The parts transported while in AUTO mode are counted for each bay. The total
Count Parts/Statistic quantity and the quantities of the individual bays as well as their percental
utilization are stored in the statistic variable "Statistic_Values" (declared
according to UDT18, see slide).
Task In the next exercise a data backup of the variable #Statistic_Values is carried
out.
But first, the time stamp for the data backup is to be entered in the variable
"DB_DataBackup".DateTime.
What to Do 1. Create the new data block "DB_DataBackup" (DB 10) with the variable
shown in the slide.
2. In FB 18, call the system function SFC 1 for reading out the system time and
pass the variable "DB_DataBackup".DateTime onto its OUT parameter CDT
(see slide).
3. Select the screen "Conv" and switch off the AUTO mode (Q 4.3) and then
switch it back on again.
4. With the test function "Monitor/Modify Variables" monitor the data block
operands or components of the variable "DB_DataBackup".DateTime
shown in the slide.
Note Monitoring data block variables of the data type Date_and_Time (DT) is not
possible with the test function "Monitor Data Block". The test function "Monitor
Variable" provides help because you can monitor the individual components of
the DT variable (see slide).

Exercise 2: Data Backup with SFC 20
DB 18
FB 18

Function (FB 18) The parts transported while in AUTO mode are counted for each bay. The total
Count Parts/Statistic quantity and the quantities of the individual bays as well as their percental
utilization are stored in the statistic variable "Statistic_Values" (declared
according to UDT18, see slide).
Task For purposes of data backup, all values of the static variable "Statistic_Values"
are to be stored in the data block "DB_DataBackup" (DB 10) every time
"L_AUTO" (rising edge of Q 4.3 = #ON_Edge) is turned on, before the values
are overwritten with 0. That way, the old statistic values are still available even
after the system has been turned on.
What to Do 1. In FB 18, call the SFC 20 block and check the program function as follows:
2. Open "DB_DataBackup" (DB 10) in the data view and activate the "Monitor"
test function.
3. On the touchpanel select the "Statistic" screen and make note of the current
quantities and utilization of the individual bays.
4. Select the "Conv" screen, switch the AUTO mode off and then switch it on
again and in the process observe whether the statistic values are
transferred into the data block.
5. Select the "Statistic" screen once more and check whether the current values
shown have been reset to 0.


complete a topic.

Additional Exercise: Specified Time Relay

General With the IEC Function Blocks, the Standard Library provides very useful
complex functions, such as how a specified time relay can be used for a system
expansion.
Task In a new FC119, create a specified time relay with the help of the IEC Function
Blocks from the Standard Library. The relay is to be used to switch an oil heater
on at 8:00 o‘clock in the morning and switch it off at 16:00 o‘clock. The heater is
energized through the output Q 5.3.
In the Standard Library S7 program "System Function Blocks", use the SFC 1 to
read the current time from the real-time clock in the CPU. With the FC8 function
from the S7 program "IEC Function Blocks", the current time can be extracted
from the time stamp of SFC1. Then the times 8:00 o‘clock and 16:00 o‘clock can
then be compared using 2 comparison functions.
To simulate these times, the desired time in the CPU is adjusted in each case
using the menu options PLC Æ Set Date and Time.
What to Do 1. Create an FC 119 according to the task

2. Also call the FC 119 block in OB 1
3. Download the blocks and test the function by changing the time in the CPU.
Note So that in Network 2, a direct comparison of the time can be programmed in

LAD or FBD, either switch off the type check or copy the variable #time into a
variable of the DINT data type.
To switch off the type check use the menu options Options Æ Customize and
deactivate the option "Type Check of Addresses" in the LAD/FBD tab.

The Library: TI-S7 Converting Blocks (Excerpt)
Block Symbol Description
FC 80 TONR Start time as stored ON Delay

FC 81 IBLKMOV Indirectly transfer data area
FC 82 RSET Reset memory bit or peripheral range
FC 83 SET Set memory bit or peripheral range
FC 84 ATT Enter value in table
FC 85 FIFO Output first value in table
FC 86 TBL_FIND Find value in table
FC 87 LIFO Ouput last value in table
FC 88 TBL Execute table operation
FC 89 TBL_WRD Copy value from table
FC 90 WSR Save date in shift register
FC 91 WRD_TBL Logically gate value with table element and save
FC 92 SHRB Shift bit into shift register
FC 93 SEG Generate bit sequence for 7 segment display
FC 94 ATH Convert ASCII character string into hexadecimal number
FC 95 HTA Convert hexadecimal number into ASCII character string
FC 96 ENCO Set preset bit in the word
FC 97 DECO Read bit number of least significant set bit
FC 98 BCDCPL Generate ten‘s complement
FC 99 BITSUM Count number of set bits
FC 105 SCALE Scale analog value (convert to physical quantity)

FC 80 The FC80 function starts the "timer function as storing ON Delay (TONR)". The
FC80 accumulates time until the current value of elapsed time (#ET) equals or
exceeds the preset value (#PV).
FC 81 With the indirect move of a data area function (IBLKMOV), you can move a
block of data consisting of either bytes, words, integers (16 bits), double words
or double integers (32 bits) from a source block to a destination block.
The #S_DATA and #D_DATA POINTERS point to structures of the POINTER
data type which identify the starting locations of the source and destination data.
The area length to be copied is determined through special parameters.
FC 82/83 Sets the signal state of each bit in a specified range to "1" (FC83), or to "0" (FC
82), if the MCR bit is "1". If the MCR bit is "0", the signal state of each bit in the
range remains unchanged.
FC 84-FC 92 These functions are table functions to implement FIFO functions, for example.
The values are to be entered in the word format; the length can be set.
FC 93-FC 99 This group provides various conversion functions.
FC 105 Converts the digitalized value of an analog channel into a physical quantity
(such as weight).

The Library: IEC Function Blocks (Excerpt)
FC 3 D_TOD_DT Combine variable Date and TIME_OF_DAY as DT

FC 6 DT_DATE Extract date from variable of type DT
FC 7 DT_DAY Extract day of week from variable of type DT
FC 8 DT_TOD Extract time-of-day from variable of type DT
FC 9 EQ_DT Compare 2 variables of type DT for equal to
FC 12 GE_DT Compare 2 variables of type DT for greater than or equal to
FC 14 GT_DT Compare 2 variables of type DT for greater than
FC 18 LE_DT Compare 2 variables of type DT for smaller than or equal to
FC 23 LT_DT Compare 2 variables of type DT for smaller than
FC 28 NE_DT Compare 2 variables of type DT for unequal

FC 3 The FC 3 function combines the data formats DATE and TIME_OF_DAY (TOD)
and converts these formats into the data format DATE_AND_TIME (DT).
FC 6 The FC 6 function extracts the data format DATE from the format
DATE_AND_TIME.
FC 7 The FC 7 function extracts the day of the week from the format
DATE_AND_TIME. The weekday exists in the data format INTEGER and begins
with 1 = Sunday to 7 = Saturday.
FC 8 The FC 8 function extracts the data format TIME_OF_DAY from the format
DATE_AND_TIME. The input value can only be assigned with a symbolically
defined variable.
FC 9 - FC 28 The functions compare the contents of two variables in the DATE_AND_TIME

format for same, greater than, smaller than, etc., and output the result as a
return value. The return value is signal state "1", when the comparison of both
times is fulfilled.

The Library: Communication Blocks
FC 1 DP_SEND Send data to PROFIBUS CP

FC 2 DP_RECV Receive data from PROFIBUS CP
FC 3 DP_DIAG Load diagnostic data of a station
FC 4 DP_CTRL Send control tasks to the CP
Exclusively in the configuration:

S7-300 CPU with CP 342-5
CP 342-5

Overview The library functions FC1, FC2, FC3 and FC4 are used exclusively in the
following configuration:
• S7-300 CPU with external PROFIBUS CP 342-5
In all other cases, that is, for S7-300 with integrated PROFIBUS-DP interface
and for the entire S7-400 system, the corresponding functions are implemented
with the standard load and transfer commands (L ... , T...) or through SFC14
(DPRD_DAT), SFC15 (DPWR_DAT), SFC11 (DPSYC_FR) and SFC13 (
DPNRM_DG).
FC1 The DP_SEND block transfers the data of a specified DP output area to the
PROFIBUSCP for output to the distributed peripherals.
FC2 The DP_RECV block receives the process data of the distributed peripherals as
well as status information in a specified DP input area.
FC3 The DP_DIAG FC block is used to request diagnostic information. The following
types of job are possible:
• Request DP station list;
• Request DP diagnostic list;
• Request DP single diagnosis (status);
• Read input / output data of a DP slave acyclically;
• Read DP mode.
FC4 The DP_CTRL FC block transfers control jobs to the PROFIBUS CP. The
following types of job are possible:
• Global control acyclic / cyclic;
• Delete older diagnostic data;
• Set current DP mode;
• Set DP mode for PLC/CP stop;
• Read input/output data cyclically;
• Set the operating mode of the DP slave.

The Library: PID Control Blocks
FB 41 CONT_C continuous PID control block

FB 42 CONT_S PI controller with binary manipulated value
output
FB 43 PULSEGEN Pulse generator for PID controller with pulse
output

FB 41 The SFB "CONT_C" (continuous controller) is used on SIMATIC S7

programmable logic controllers to control technical processes with continuous
input and output variables. During parameter assignment, you can activate or
deactivate sub-functions of the PID controller to adapt the controller to the
process.
You can use the controller as a PID fixed setpoint controller or in multi-loop
controls as a cascade, blending or ratio controller. The functions of the controller
are based on the PID control algorithm of the sampling controller with an analog
output signal, if necessary extended by including a pulse generator stage to
generate pulse duration modulated output signals for two ro three step
controllers with proportional actuators.
FB42 The SFB "CONT_S" (step controller) is used on SIMATIC S7 programmable

logic controllers to control technical processes with binary manipulated value
output signals for integrating actuators. During parameter assignment, you can
activate or deactivate sub-functions of the PI step controller to adapt the
controller to the process.
You can use the controller as a PI fixed setpoint controller or in secondary
control loops in cascade, blending or ratio controllers, however not as the
primary controller. The functions of the controller are based on the PI control
algorithm of the sampling controller supplemented by the functions for
generating the binary output signal from the analog actuating signal.
FB43 The SFB "PULSEGEN" (pulse generator) is used to structure a PID controller
with pulse output for proportional actuators.
Using SFB "PULSEGEN", PID two or three step controllers with pulse duration
modulation can be configured. The function is normally used in conjunction with
the continuous controller "CONT_C".

The Library: Miscellaneous Blocks (Auszug)
FB 60 SET_SW Standard/Daylight-savings time adjustment

FB 62 TIMESTMP Messages with time-stamp from IM 153-2
FC 60 LOC_TIME Determine local time

FB 60 The FB supports Standard/Daylight-saving Time adjustment for CPUs that do

not have the time status. The block adjusts the CPU clock to the currently
applicable time according to the adjustment rules in the Rule DB.
FB 62 The FB TIMESTMP transmits time-stamped messages of an IM153-2 to its

instance DB. There, data are available for further processing in the user
program.
FC 60 The FC reads the time-of-day status and the time of the CPU and calculates the
local time from it.
This function is not available for all CPUs. If it is not, the FC 60 gives out an
error message.
Time-of-Day Status You can determine the current time-of-day status of your CPU with the SFC 51
"RDSYSST". The time-of-day status contains the following information:
• correction factor for the clock
• Standard/Daylight-saving Time identification
• Announced hour of transition (the next time the hour changes, the clock is
adjusted from Standard to Daylight-saving or vice versa).

Analyzing SIMATIC S7 Diagnostic Data
Reading Out System Status Lists with SFC 51
Report System Errors

Contents Page
Objectives ........................................................................................................................................ 2
Overview of the S7 Diagnostic Functions ..................................................................................... 3
Writing User Messages in the Diagnostic Buffer ............................................................................. 4
System Function SFC 52 .................................................................................................................... 5
Calling the SFC 52 Block ................................................................................................................ 6
Structure of the EVENTN Parameter of the SFC 52 Block ................................................................ 7
Configuring Your Own Message Texts ............................................................................................. 8
Exercise 1: Interpreting the Error Code of the SFC 52 ……………………………………………….. 9
Exercise 2: Writing a User Message in the Diagnostic Buffer ......................................................... 10
If You Want to Know More ................................................................................................................ 11
SFC 51 System Function - Reading System Status Lists (SZL) ....................................................... 12
SZL Header and UDT Structure ........................................................................................................ 13
Additional Exercise: Reading Out the SZL Sublist "Status of LEDs" ............................................... 14

Automation and Industrial Solutions Page 1 Outputting Diagnostic Messages
Objectives
At the end of the chapter the participant will ...
… be able to enter user messages in the diagnostic buffer
... be familiar with selected system functions for

determining diagnostic data
… be able to read out system status lists from the CPU


Overview of the S7 Diagnostic Functions
Diagnostic interrupt (OB 82)
Read out system status lists with SFC 51
Report system errors
Diagnostics-capable
CPU
module
Own message "all bays occupied", Actual value: ... Diagnostic

SFC 52
buffer

Introduction You can enter your own messages in the diagnostic buffer using the SFC 52
system function.
Diagnostics-capable modules, such as analog modules, trigger a diagnostic
interrupt when there is a hardware fault. To obtain additional diagnostic data,
you can call the SFC 59 system function in OB 82.
Another system function (SFC51) lets you read out the System Status Lists.
These lists contain the status of the LEDs on the CPU module, for example.

Writing User Messages in the Diagnostic Buffer
Send buffer
SEND = TRUE
Diagnostic
buffer
…
SFC 52
“Write User Message“

Introduction The FC 52 system function permits you to write your own messages, for
example, lower limit for hydraulic pressure violated, in the diagnostic buffer.
Parallel to this, the message can also be displayed on the programming device
or OP. The diagnostic messages must be enabled for this purpose.
Program The SFC 52 system function is called and assigned parameters in the user
program. Certain standard texts are stored in the CPU. A parameter of the SFC
selects these texts. You will find more information in the Standard and System
Functions manual, or in the Online Help.
Example SFC 52 is called in the program example, if the analog value of peripheral input
word 304 exceeds the value of 2000 units. The message is output only once as
a result of logic edge detection. The block is assigned parameters in such a way
that a diagnostic message is also output on the PG (SEND = TRUE). The
EVENTN parameter determines the text to be output.

System Function SFC 52

Parameter "SEND" With signal state "1" at the input "SEND" a message is sent to a PG or OP
parallel to the entry in the diagnostic buffer. On the PG, the tool "CPU
Messages" must be activated for this. On the OP (HMI system), a message
window has to be set up in the screen.
Parameter "EVENTN" Fixed texts are assigned to the message numbers in the range W#16#8xxx and
W#16#9yyy. You will find the assignment of the texts to the message numbers
in the "System and Standard Functions" manual in Chapter 29 - Events.
Thus, the text "Manual Mode" is assigned to the message number W#16#9101,
for example.
You can also configure your own message texts. The number range
W#16#Axxx and W#16#Byyy is provided for this.
Parameter "INFO1" With this you can show an accompanying value (wildcard) that is 1 word long in
the message text. Permitted data types are Word, Int and Array [0..1] of Char.
Parameter "INFO2" With this you can show an accompanying value (wildcard) that is 2 words long in
the message text. Permitted data types are DWord, Dint, Real, Time and Array
[0..3] of Char.
Parameter The output parameter "RET_Val“ returns the following error messages:
"RET_VAL"
W#16#0000 no error
W#16#0091 no station (PG/OP) logged on
W#16#8083 data type of INFO1 not permitted
W#16#8084 data type of INFO2 not permitted
W#16#8085 EVENTN not permitted
W#16#8086 length of INFO1 not permitted
W#16#8087 length of INFO2 not permitted
W#16#8091 no station (PG/OP) logged on. This error code only appears for
specific CPU versions.
W#16#8092 Sending is momentarily not possible since the send buffer is
full.

Calling the SFC 52 Block
Network 2: User message when limit value exceeded
CMP>R
MD 120 IN1 SFC 52

M 90.1
P
5.000000e+003 IN2 EN
M 0.1 SEND
W#16#A901 EVENTN
RET_VAL #error_sfc52
#dummy INFO 1
MD 120 INFO 2 ENO

Introduction In the slide you can see a program example, in which a user message is
entered in the diagnostic buffer and is displayed through the CPU messages.
Description The SFC 52 block is called conditionally through the input "EN" if the analog
value (MD 120) exceeds the limit of 5000.
The "SEND" input has the signal state "1" and as a result, the message is sent
to a PG logged-in with CPU Messages.
At input "EVENTN" it was specified that the first message of group A is to be
displayed as an incoming event.
You can enter wildcards in the message text through the inputs "INFO1/INFO2".
In the example, the analog value is to be displayed as well.
The "RET_VAL" output delivers an error message if:
• the message cannot be sent because no node is logged-in or the buffer is
full, or
• the SFC52 was assigned parameters with invalid values or formats in the
call.

Structure of the EVENTN Parameter of the SFC 52 Block
EVENTN 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Event class Identification Event number
1..9 are standard texts for the different events

Event class (see the Standard and System Functions manual)
A..B free texts, that are specified using Message Configuration
C..F reserved for expansions in the future
Specifies if it is an incoming or an outgoing event, or, an internal

or an external event, for example:
Identification Bit 8="1" --> Text for incoming message
Bit 8="0" --> Text for outgoing message
Bit 10="1" --> internal error
Bit 11="1" --> external error
Continuous message number from 1 to 255 within an

Event number
event class

General You can see the structure of the EVENTN parameter in the slide with which you
specify which message text is to be entered in the diagnostic buffer.

Configuring Your Own Message Texts

Call With the right mouse button, click on an S7 program and select the menu
options Special Object Properties Æ Message... .
Configuring Message Start with the "New message" button. The next free message number, such as
A0003 is suggested.
In the "Default texts" tab you can enter the message text for incoming and
outgoing messages.
In the "Message number" tab, you can change the message number.
Wildcards Up to two wildcards can be inserted in the message text. These values are
passed via the parameter "INFO1/INFO2" of the SFC 52.
In the example, the value of INFO 2 is output as a real number.
To insert a wildcard, you begin and end with the @ character. This is followed
by 1 or 2, depending on whether you want to display the value from INFO1 or
INFO2. The format declaration then follows.
The following format declarations are possible:
• %ix hexadecimal number with i places
• %iu unsigned decimal number with i places
• %id signed decimal number with i places
• %e scaled real number, the exponent is preceeded by e
• %E scaled real number, the exponent is preceeded by E
Example: @1%4u@
inserts the value passed at the parameter INFO1 as a 4-digit
unsigned decimal number into the message

Exercise 1: Interpreting the Error Code of the SFC 52
FC 15

Task Always, at the moment the MANUAL or AUTO mode is switched on (edge
detection required), a corresponding standard message is to be entered in the
diagnostic buffer.
What to Do 1. From the S7 program called "Chap07_Diagnostic" in the S7 project

"SERV3_B", copy the FC 15 block into your own S7 program and then
download it into the CPU.
2. In the copied FC 15, the entry of the message "Manual mode" is already
programmed, however, it contains errors (associated error code in MW 200).
Monitor the MW 200 memory word with the "Monitor/Modify Variables" test
function, make note of the error code and find out the meaning of the error
code using the online help for FC 15.
3. Correct the FC 15 program and check whether the message "Manual mode"
is entered in the diagnostic buffer.
4. In a new network, program a further call of SFC 52 for entering the message
"Automatic mode" in the diagnostic buffer.
Solution hint: Event ID Message
W#16# 9101 "Manual mode"
W#16# 9001 "Automatic mode"

Exercise 2: Writing a User Message in the Diagnostic Buffer

Task If all bays are occupied while in AUTO mode, the message "all bays occupied,
current weight: xxxx" is to be entered in the diagnostic buffer. As a wildcard, the
current weight is to be inserted in the message as a 4-digit unsigned decimal
number (see slide).
What to Do 1. Write a program for the required function in the FC 14 block by calling the
SFC 52 in a new network.
2. Switch on the AUTO mode and let one part be transported to each bay so
that all bays are occupied (all bay indicator lights show a continuous light)
3. Check whether the corresponding message was entered in the diagnostic
buffer.
Solution Hints:
• The current weight is recorded in OB 35 and stored in memory word
"MW_Weight" (MW 36, data type INT).
• The required format declaration is: @1%4u@


complete a topic.

SFC 51 System Function - Reading System Status Lists (SZL)
Parameter Declaration Data type Memory area Description
REQ INPUT BOOL I, Q, M, D, L, Const. REQ=1: triggers processing

SZL_ID INPUT WORD I, Q, M, D, L, Const. SZL-ID of the sublist or of the sublist excerpt
INDEX INPUT WORD I, Q, M, D, L, Const. Type or number of an object in a sublist
RET_VAL OUTPUT INT I, Q, M, D, L If an error occurs while the SFC is being processed,
then the RET_VAL parameter contains an error
code.
BUSY OUTPUT BOOL I, Q, M, D, L TRUE: Read function not yet completed
SZL_HEADER OUTPUT STRUCT D, L see page after next
DR OUTPUT ANY I, Q, M, L, D Target range for the SZL sublist that is read or
the SZL sublist excerpt that is read.

Area of Use Data about the status of modules is stored in the CPU or in diagnostics-capable
modules. This data is stored in system status lists (SZL).
These divide themselves into SZL sublists that are addressed through an
identifier SZL_ID. Every SZL_ID has specific data records assigned to it that are
differentiated by an index.
By reading out a sublist you can obtain additional information for further error
analysis.
Unlike the SFC 59, you can also query performance data (for example, number
of DBs) and status data (for example, key switch position) of the CPU.
SFC 51 Call You will need additional information on the SZL sublists in order to correctly
assign parameters.This can be found in the "System and Standard Functions"
manual. In the following table you will find an excerpt.
SZL_ID Index Record contents

0111h 0001h CPU type and version
0014h - Size of PII, PIQ, M, T, C …
0015h - Number + Size FC, FB, OB, DB
0019h - LED status
0232h 0004h Position of the key switch
0692h - OK status

SZL Header and UDT Structure
ARRAY assignment
UDT 51
“Data record“

SZL_Header For the parameter "SZL_Header" of the SFC 51 block, you need a structure
declaration with the following arrangement: elements "LENGTHDR" and "N_DR"
(both WORD types), that contain information about the number and length of the
data records that are read. You create this structure in a data block or as a local
variable in a logic block.
UDT User-defined / universal data types (UDT) are used as "templates", to
• generate individually structured data blocks,

• create arrays that have the same structure many times over,
• create local variables in FC, FB with predefined structure.
Data Record When you read out the SZL sublist ‘Block Types‘ ( SZL_ID 0019H), you receive
back 5 data records with a length of 4 bytes each. At the output parameter "DR"
of the SFC 51 you are to specify a memory area (data type ANY) which can
accept the 5 data records with 4 bytes each.
Name Length Meaning

Index 1 Word LED identifier
W#16#0001 SF
W#16#0004 RUN
W#16#0005 STOP
W#16#0006 FRCE
W#16#0008 BATF
LED_on 1 Byte 0 = LED off, 1 = LED on
LED_blink 1 Byte 0 = LED doesn‘t blink

1 = LED blinks with 2 Hz
2 = LED blinks with 0.5 Hz

Additional Exercise: Reading Out the SZL Sublist “Status of LEDs“

Task The system status sublist (ID 0019 (Hex)) is to be read out with the SFC 51 and
stored in DB 51. If the LED "FRCE" is illuminated, the signal "Force_active"
is to be assigned in DB 51.
In the following chapter, this signal triggers an event message on the HMI
system to signal a running force job.
What to Do 1. Create a UDT 51 data structure as shown in the slide.

2. Enter the DB 51 block (see slide).
3. Create an FC 51 block that reads out the system status list "Status of the
module LEDs" with the SFC 51. As long as the LED "FRCE" is illuminated,
the data bit “Force_active“ is to have signal state "1".
4. Download the blocks and test the program.
Note If data block DB 51 was assigned the symbol name "DB_LED_Status" in the
symbol table, a symbolic access from the user program could appear as follows:
L "DB_LED_Status ".CPU_LEDs[1].Data_record.led_on

Diagnostic Messages with WinCC flexible
PROFIBUS-DP

Contents Page
Objectives .......................................................................................................................................... 2
Error Analysis when an ET200S Slave Fails .................................................................................... 3
Diagnosis through LED Display (ET 200S) ....................................................................................... 4
BT 200 PROFIBUS Test Device ....................................................................................................... 5
Diagnosis Repeater .......................................................................................................................... 6
Diagnostic Buffer and Hardware Diagnosis when a Slave Fails ...................................................... 7
Error Analysis in OB 86 when a Slave Fails .................................................................................... 8
Principle of Slave Diagnosis ............................................................................................................ 9
Slave Diagnosis with SFC 13 (DPNRM_DG) ................................................................................ 10
Structure of the Diagnostic Data ....................................................................................................... 11
Task: PROFIBUS Diagnostic Package .......................................................................................... 12
Exercise 1: Integrating the WinCC flexible – Station "PC RT" ......................................................... 13
Exercise 2: Parameterizing the Runtime Interface of "PC RT" ......................................................... 14
Exercise 3: Parameterizing the Connection of "PC RT" ................................................................... 15
Exercise 4: Integrating FB125 into the S7 Program ......................................................................... 16
Exercise 5: Testing the PROFIBUS Diagnostic Package with WinCC flexible - Runtime ................ 17
Alarm_S / SQ Procedure ................................................................................................................. 18
Report System Error (1) .................................................................................................................. 19
Report System Error (2) .................................................................................................................. 20
Exercise 6: Integrating "Report System Error" in the S7 Program .................................................. 21
Exercise 7: Displaying Alarm_S Alarm Messages ........................................................................... 22
If You Want to Know More ............................................................................................................... 23
Installing PROFIBUS-DP Slaves Later On ..................................................................................... 24

Automation and Industrial Solutions Page 1 Diagnostic Messages with WinCC flexible
Objectives
... know the possibilities for error analysis.

... be able to program the error OB 86.
... be able to read out additional diagnostic information with the
SFC 13 system function.
... be familiar with the PROFIBUS diagnostic package.


Error Analysis when an ET200S Slave Fails
Diagnostic possibilities
Visual check of the LEDs STEP 7 software User program
LEDs on the Master LEDs on the Slave
Read out Diagnose Start info Call Diagnose

diagnostic buffer hardware error OB SFC 13 FB 125

LED There are three LEDs on the IM 151 interface module for error display. For more
information, see the next page.
On the CPU with the integrated DP interface, there are two LEDs (SF DP and
BUSF).
STEP 7 Software When an error occurs, read out the diagnostic buffer or start the "Hardware
Diagnostics" tool (see next page).
User Program When a slave fails and recovers, the error OB 86 is called. The diagnostic
address of the failed slaves is then stored in the start information.
Through the call of system function SFC 13, you get additional diagnostic data
on the slave, as defined in the standard EN 50 170.
The standard block FB 125 provides detailed information right up to the
individual channel. This block is offered on the Internet as a diagnostic package
along with the standard screens for HMI.

Diagnosis through LED Display (ET 200S)
LEDs
SF BF ON Meaning
There is no voltage to the interface module
? ? The interface module has voltage
? Incorrect or no parameter assignment. Check the hardware

configuration
? Baudrate search, unpermitted PROFIBUS address, cable
break
? Setpoint and actual configuration is not the same
Data exchange taking place. All OK.
LED off
LED continuous light
LED flashes
? LED not relevant

General There are three LEDs for error analysis on the IM 151 interface module:
• SF Group error (red)
• BF Bus error (red)
• ON Power supply (green).
For a first error analysis use the LED display on the interface module, as
described above.

BT 200 PROFIBUS Test Device
Checking the bus cable

Wire break, shield break, terminating resistors, cable exchange
Short circuit (between A and B, between A/B and shield)
Detecting reflection spots
Measuring the installed cable lengths
Testing the PROFIBUS-DP interface (Master + Slaves)
RS485 driver, internal 5V, RTS signal
Life List
Display of the accessible nodes
Multilingual (6 languages)

Area of Application During the installation phase, you can check the PROFIBUS cable with the BT
200 test device. You can check the wiring even with installed nodes. Installation
errors are found quickly and easily; no special PROFIBUS knowledge is
required.
Even before commissioning of the system, it is possible to test the RS 485
interfaces of the PROFIBUS-DP nodes with the BT 200. A listing of accessible
slaves on the wired bus is also possible and that without a master on the
PROFIBUS-DP.
Individual bus segments can be checked for their functionality ahead of time,
which shortens the commissioning times. In case of an error, these last two test
functions are helpful in localizing the error and so minimizing the system
downtimes.
With the help of the optional reporting kit, you can store the individual tests in
the BT 200 and transfer them to a PC. The test results can then be printed out in
the form of a report. The simple and fast creation of an inspection report is thus
possible, for example.

Diagnostic Repeater
Errors that are detected:

Interruption of the bus cables A, B
Short circuit between the bus cables A, B
and shield
Missing terminating resistors
Also, sporadic errors are detected!
Error messages take place in the form of:
PROFIBUS segment name
Location of fault (such as, between node
X and Y)
Distance information between
the nodes
Cause of error (such as, wire break)

Area of Application The Diagnostic Repeater for PROFIBUS-DP connects PROFIBUS-DP

segments in the RS 485 technology. As well, it physically monitors the copper
bus cables during online operation.
When an error occurs it sends a diagnostic message with detailed information
about the type of failure and the location to the DP Master.
Design • Housing with degree of protection IP 20

• Installation on S7-300® mounting rail or standard DIN rail
• LEDs to display DC 24 V, bus activity and cable failure for each segment
• Terminal block external 24VDC power supply
• 9-pole Sub D connector for PG connection
• Connections for 3 bus segments in FastConnect clamp-cut technology
Mode of Operation The Diagnostic Repeater is integrated in the bus system as a standard RS 485
repeater, but it has its own PROFIBUS-DP address:
The Diagnostic Repeater, initiated through STEP 7 or COM PROFIBUS,
determines the topology of the connected segments and stores this in the
internal diagnostic memory.
When there is a fault, the Repeater automatically transmits a standard
diagnostic message to the bus master that contains information on the affected
segment, the location of the fault, the distance of the location and the type of
error.
The error messages are graphically displayed in STEP 7 and COM PROFIBUS.
They are completely integrated into the SIMATIC® System Diagnosis (such as
the function "Report System Error").

Diagnostic Buffer and Hardware Diagnosis when a Slave Fails
Diagnostic Buffer
Hardware Diagnosis

Diagnostic Buffer In the slide you can see an error message for a DP slave that has failed. In this
case, the slave with the PROFIBUS address 6 has failed.
The "Logical base address of the DP-Slave/Master" corresponds to the
diagnostic address that was entered with the Hardware Configure tool during
parameter assignment. Through this diagnostic address, the master is informed
of the failure and/or the recovery of a DP slave. The CPU then starts OB 86
"Rack_Fault_DP".
As well, you can fetch the entire diagnosis of the DP slave with SFC 13
"DPNRM_DG" at this address and integrate it in the CPU program.
Hardware Diagnosis If you use the "Hardware Diagnostics" tool for troubleshooting, you can
recognize the station that has failed by the red line through the slave icon.

Error Analysis in OB 86 when a Slave Fails
Change data type

to DWord
Slave address
e.g. 4 for ET 200S

OB 86 The CPU operating system (CPU 315-2DP or S7-400) calls OB86 when the
failure of a rack, a subnet or a station in the distributed peripherals is detected in
an incoming as well as outgoing event.
If you have not programmed the OB86 and such an error occurs, the CPU goes
into STOP.
Start Info of OB 86 Meaning of the variables in OB86
OB86_FLT_ID: B#16#C4 //DP station has failed

OB86_FLT_ID: B#16#C5 //DP station faulty
OB86_MDL_ADDR: Logical base address of the DP master
(diagnostic address)
OB86_ RACKS_FLTD: ==> Rename data type in :DWord
Contents:
Bit 0 to 7: Number of the DP station
(PROFIBUS address)
Bit 8 to 15: DP subnet ID
Bit 16 to 30: Logical base address of the DP slave
(diagnostic address)
Bit 31: I/O identification
Example In the example, the PROFIBUS address of the slave that has failed is identified.
It is located in the right byte of the variable OB86_RACKS_FLTD.

Principle of Slave Diagnosis
Slave error
OB86
Incoming / outgoing event (OB86_EV_Class)

Master address (OB86_MDL_ADDR)
Start
Diagnostic address/ Master system (OB86_RACKS_FLT) Info
. OB 86
.
.
SFC13
EN ENO
??.? REQ RET_VAL ??.?
??.? LADDR RECORD ??.?
BUSY ??.?

OB 86 The error OB 86 is called when a PROFIBUS slave fails or when an expansion

unit fails.
Start Info OB 86 In the start information of the OB 86, the CPU operating system stores additional
information as to the cause of the failure.
SFC 13 Every DP slave has slave diagnostic data that are structured according to
EN 50 170 Volume 2, PROFIBUS. You need the SFC 13 "DPNRM_DG" to read
out this diagnostic data.

Slave Diagnosis with SFC 13 (DPNRM_DG)
"DPNRM_DG"
EN ENO
REQ RET_VAL #error_sfc13
W#16#3FF LADDR RECORD "DP_Diagnosis.

Diagnosis_data“
BUSY #busy_sfc13
Parameter Declaration Data type Memory area Description

REQ INPUT BOOL I, Q, M, D, L, Const. REQ = 1: Request to read
LADDR INPUT WORD I, Q, M, D, L, Const. Configured diagnosis address of DP slave
RET_VAL OUTPUT INT I, Q, M, D, L If an error occurs while the function is being
processed, the return value contains an error
code. If no error occurred, the length of the
data actually transmitted is found in RET_VAL.
RECORD OUTPUT ANY I, Q, M, D, L Target area for the diagnostic data read. Only the
BYTE data type is permitted. The minimum length
of the data record to be read or the target area is
6.
BUSY OUTPUT BOOL I, Q, M, D, L BUSY = 1:
The reading process is not yet completed.

Slave Diagnosis With the SFC 13 "DPNRM_DG" (read diagnostic data of a DP slave), you read
the diagnostic data of a DP slave in the format as defined in the EN 50 170.
After an error-free data transmission, the read data are entered in the target
area that is created by RECORD (OUT 2).
You start the reading process by assigning signal 1 to the input parameter REQ
(IN0) when calling SFC 13.
Structure of the You will find the principle structure of the slave diagnostic data in the following
Slave Diagnosis table. Further information can be found in the manuals on DP Slaves
.
Principle structure of the slave diagnostic data
Byte: Meaning:
0 Station status 1
1 Station status 2
2 Station status 3
3 Master station number
5 Vendor I/O (low byte)
6... Further slave-specific diagnostic information

Structure of the Diagnostic Data
Station status 1 Station status 2
Byte 0 Station status 1 Bit Meaning Meaning
Byte 1 Station status 2 DP slave cannot be - DP slave must be
0
Byte 2 Station status 3 addresses reparameterized
Byte 3 Master Profibus Add. 1 DP slave not ready yet
There is a diagnostic
Byte 4 Manufacturer ID message
Byte 5 Manufacturer ID Configuration does not Bit = "1", when DP slave
2
equal structure exists
Byte 6 Identification related 3 External diagnosis exists
The response monitoring
Byte 7 : is activated
: : Function not supported Control command
4
Byte 14 diagnosis by DP slave "FREEZE" received
Master cannot interpret Control command
5
Byte 15 Module status answer from slave "SYNC" received
: Slave type not the same
6 Bit is always "0"
: : as configuration
Byte 34 : DP slave is parameterized
7 DP slave is deactivated
by another master
Byte 35 Channel related
: diagnosis
max. to :
Byte 63 :

Diagnostic Data The system function SFC 13 supplies the diagnostic data as can be seen on the
left side in the slide. For this, you create an array of 64 bytes in a data block.
This data area is specified at Parameter "RECORD" of the SFC 13.
Station Status The Station status 1 to 3 provides an overview of the status of a DP slave. The
assignment of Station status 1-2 can be seen on the right of the slide.
In Station status 3, only the bit 7 is relevant. When Bit 7 ="1", there are more
diagnostic messages than the DP slave can store.
Master PROFIBUS The PROFIBUS address of the DP master that parameterized the DP slave
Address and that has reading and writing access to the DP slave is stored in the
diagnostic byte Master PROFIBUS Address,.
Manufacturer ID A code is stored in the manuafacturer identification that describes the type of DP
slave, for example, Hexa 806A for ET 200S with IM 151.
Identification-related The identification-related diagnosis states whether modules of the ET 200S are
Diagnosis faulty or not. The identification-related diagnosis begins from Byte 6 and
includes 9 bytes. From byte 7 onwards, a bit is set for every faulty module. Bit 0
="1" of byte 7 is assigned to module 1, etc.
Module Status The module status outputs the status of the configured modules and represents
the identification-related diagnosis in detail. Stored in the module status is
whether a module is missing or whether it is an incorrect module, for example.
Channel-related The channel-related diagnosis gives you information about channel errors of
Diagnosis modules and represents the identication-related diagnosis in detail. The
channel-related diagnosis signals a channel cable break, for example. The
maximum length is limited by the maximum total length of the slave diagnosis of
64 bytes.

Task: PROFIBUS Diagnostic Package

PROFIBUS A PROFIBUS diagnostic package is available on the Internet on the Siemens

Diagnostic Package Product Support page. This package can be downloaded free of charge:
http://support.automation.siemens.com
It contains prefabricated WinCC flexible stations for different operator stations
and also the appropriate S7 program or the FB 125 function block that uses,
among other things, the previously described SFC 13 internally to read out the
corresponding diagnostic data from the DP slaves and to store it in its DB 125
instance data block. The output fields in the specified operator device screens
are linked with variables from this instance data block and in this way display the
diagnostic data.
Task In addition to the TP170B, the PG is to be used for PROFIBUS diagnosis by

utilizing the WinCC flexible – Runtime. For this, you are to commission the
WinCC flexible – Station "PC RT" included in the PROFIBUS diagnostic
package along with the FB125 function block.
Notes • The diagnostic screens can be used on the HMI devices OP 7, OP 12,
OP 17, OP 27, OP 270, OP 35, OP 37,TP 170B/C, TP 27, TP 270, TP 37,
MP 170, MP 270, MP 370 and ProTool Runtime.
• The FB 125 is called in OB 1, OB 82 and OB 86.
• You can use them in the CPUs with integrated DP interfaces, in the CP 443,
C7, SINUMERIK 840D and WinAC.

Exercise 1: Integrating the WinCC flexible – Station "PC RT"

Task You are to copy the WinCC flexible station "PC RT" and the required S7 blocks
that are included in the PROFIBUS Diagnostic Package into your project. This
package is provided by Siemens Customer Support.
What to Do 1. Delete – if it exists – the project "DP_OP_21_WinCC_flexible".

2. Retrieve the project "DP_OP_21.zip" from the directory
<Drive>\:S7_Courses\Archive.
3. From the project "DP_OP_21_WinCC_flexible" copy the station "PC RT" into
your own project.
4. From the S7_program contained in the project "DP_OP_21_WinCC_flexible"
copy all blocks (except for the OBs and the system data) into your own
project.

Exercise 2: Parameterizing the Runtime Interface of "PC RT"

Task So that the symbols of the S7 program are available in the WinCC flexible
project, the runtime interface must be configured and assigned parameters with
the "HW-Config" tool.
What to Do 1. Open the Hardware Configuration of the WinCC flexible station "RT PC".
2. Configure and assign parameters to the CP5611 module as shown in the
slide.
3. Save and compile the station‘s HW-Config.

Exercise 3: Parameterizing the Connection of "PC RT"

Task So that the symbols of the S7 program are available in the WinCC flexible
project, the runtime interface must be configured and assigned parameters with
the "HW-Config" tool.
What to Do 1. Open the Hardware Configuration of the WinCC flexible station "RT PC".
2. Configure and assign parameters to the CP5611 module as shown in the
slide.
3. Save and compile the station‘s HW-Config.

Exercise 4: Integrating FB125 into the S7 Program
OB 1, OB 82, OB 86

Task So that the diagnostic data of a failed slave is stored in the DB 125 instance
data block, the FB 125 must be called in the organization blocks OB 1, OB 82
and OB 86 with the instance data block DB 125.
A parameterization, that is, the passing of actual operands to the formal
operands of the FB 125 is thereby not necessary.
What to Do 1. Program the call of FB 125 with instance DB 125 in OB 1.

2. Program the call of FB 125 with instance DB 125 in OB 82.
3. Program the call of FB 125 with instance DB 125 in OB 86.
4. Download the FB 125, the DB 125 and the modified OBs into the CPU.

Exercise 5: Testing the PROFIBUS Diagnostic Package with
WinCC flexible - Runtime

Task You are to check the function of the PROFIBUS diagnostic package.
What to Do 1. Open the WinCC flexible station "RT PC".

2. Start the runtime of WinCC flexible.
3. Provoke an ET 200S failure.
4. Check the data that is displayed in the screens "Overview Diagnostic" and
"Detail Diagnostic".

Alarm_S / SQ Procedure

Alarm_S The Alarm_S procedure is organized through message numbers which are
automatically assigned during configuration in STEP 7. The unique assignment
of the message texts takes place by means of the numbers. When a fault
occurs, the HMI system receives a message via the message number with an
associated message text.
When a fault occurs, the CPU also stores, along with the status of the message
(activated, deactivated, acknowledged), the time of day and possible process
parameters. This makes an exact diagnosis of the cause of the fault possible.
The message information is stored in the controller and is not immediately
discarded after the message is sent. That way, individual network components
(such as, HMI systems) can still log on and update after the fact.
Benefits Compared to the discrete alarm procedure, ALARM_S offers the following
benefits:
• ALARM_S is an active message procedure. If a message occurs, the CPU
actively sends an appropriate message to all logged on network participants
(no polling).
• The process values always coincide exactly with the values at the time of the
message. This is not guaranteed with the discrete alarm procedure.
• The time stamp states exactly when an event occurred, even if the HMI
system is only connected at a later point in time.
Types of Messages With the message configuration in STEP 7, there are two types of ALARM_S
messages. They differ in the mode of acknowledgement:
• Messages for which there must be an acknowledgement. These messages
are always treated as fault messages.
• Messages for which no acknowledgement is necessary. These messages
can be fault messages as well as operating messages.

Report System Error (1)

Report System Error S7 components and "DP-Normslaves" (slaves whose properties are determined
by their GSD file) can trigger the calls of organization blocks when a system
error occurs (for example, OB 82 is called when there is a diagnostic interrupt of
an analog input module).
The diagnostics-capable S7 components provide information on the system
error that occurred. The start information, that is,the local data of the associated
OB gives out general information about the location (such as logical address of
the module) and type (such as channel error or backup failure) of error.
Beyond that, the error can be specified more exactly (such as Channel 0,
wirebreak) by reading out additional diagnostic information (with SFC 13).
Alarm_S With the "Report System Error..." function, STEP 7 offers a user-friendly way to
display the diagnostic information provided by the component in the form of
messages.
The blocks necessary for this (in the slide FB 49) work internally with the
Alarm_S or Alarm_SQ procedure and are automatically generated or modified
by STEP7. The user simply has to download the generated or modified blocks
into the CPU and transfer the standard texts into the connected HMI devices.

Report System Error (2)

General In the "General" (Report System Error) tab, you specify which function block is
to be used as the diagnostic block (in the slide FB 49). Furthermore, you can
specifiy the behavior of "Report System Error" during the generation process.
OB Configuration In the "OB Configuration" (Report System Error) tab, you define which OBs are
to be supported or which OBs are to be created or are to be expanded by the
call of the block for reporting system errors (FB 49).
CPU in STOP In the "CPU in Stop" tab, you specify for which errors the CPU is to remain in
the RUN state and for which they are to go into STOP.
Messages In the "Messages" (Report System Error) tab, you define which information is to
be output as message texts and in which sequence.
User Block In the "User Block" tab, you define whether one of your own user blocks is to be
called from the diagnostic block (FB 49) and you configure its interface.

Exercise 6: Integrating "Report System Error" in the S7 Program

Task The "Report System Error" function is to be integrated in the existing S7

program.
What to Do 1. Open the hardware station of your project with HW-Config.

2. Select the CPU and activate the function "Report System Error…" in the
menu "Options".
3. Parameterize "Report System Error" with the parameters shown in the slide
and via "Generate" start the automatic creation of the message block FB 49
and the OBs to be modified.
4. Download the message block and the modified OBs into the CPU.

Exercise 7: Displaying Alarm_S Alarm Messages

Task With the "Report System Error" function, the message block FB 49 and its calls
in various OBs was generated. So that the Alarm_S messages deposited by this
message block are also brought to display on the touchpanel while the program
is running, the display of "S7 Alarms" must still be activated in the Alarm View of
the screens "Template" and "Messages".
What to Do 1. Open the WinCC flexible station "TP170B_Color".

2. Open the "Messages" screen and activate the display of S7 Alarms (see
slide).
3. Open the "Template" screen and also activate the display of S7 Alarms
there.
4. Save the modified station and load it into the touchpanel.
5. Check the new function by…
• provoking a DP slave failure
• provoking the measuring range to be exceeded by setting a voltage that
is too high (> 12V) on the simulator potentiometer.


complete a topic.

Installing PROFIBUS-DP Slaves Later On
Example of a Type File

Type Files STEP 7 requires a GSD or a type file for every DP slave, so that you can select
the DP slave from the Hardware Catalog in the HW-Configuration tool.
All properties of a DP slave are stored in a GSD file and they conform to the
PROFIBUS standard. Type files conform to the Siemens specification.
For SIEMENS AG DP slaves, there is a type file for every DP slave type.
DP slaves from other manufacters are supplied with a GSD or a type file.
Integrating DP Slaves A new DP slave can be integrated into the Hardware Catalog as follows:
1. Select the menu options Options Æ Install New GSD ....
2. In the dialog field that then appears open the drive/directory with the
appropriate GSD file.
The slave is entered in the window "Hardware Catalog" (only in the catalog
profile "Standard"!) under "Additonal Field Devices" and is then available for
the configuration.

Commissioning the MM420 with the "Starter" Software

Contents Page
Objectives .......................................................................................................................................... 2
Communication: PROFIBUS - DP .................................................................................................... 3
Integrating a Drive in the HW Config ............................................................................................... 4
Drive ES (= Engineering System) ..................................................................................................... 5
Overview of the Starter Commissioning Tool .................................................................................. 6
Configuration of a Drive with the Wizard ........................................................................................ 7
Online Operation .............................................................................................................................. 8
Diagnostics Function ........................................................................................................................ 9
Control Panel Function ..................................................................................................................... 10
Exercise 1: Integrating a Drive in the HW Config ............................................................................. 11
Exercise 2: Online Configuration of the Drive with the Wizard ........................................................ 12
Exercise 3: Changing Parameter Ramp-up and Ramp-down Times Online .................................... 13
Exercise 4: Using the Control Panel ................................................................................................. 14
Exercise 5: Controlling the Drive via the TP170B (FC 42) ............................................................... 15

Automation and Industrial Solutions Page 1 Commiss. the MM420 with the "Starter" SW
Objectives
... be able to use the "Starter" software for troubleshooting,

... be able to carry out a simple configuration of a drive,
... be familiar with the software components Drive ES.


Communication: PROFIBUS DP
PROFIBUS module

Field Bus A field bus connects distributed sensors and actuators (such as, valves, light
barriers, measuring devices, drives, operator control panels) with the central
PLC. PROFIBUS DP is a manufacturer-independent, open field bus. PROFIBUS
has been standardized and continuously further developed by the PNO
(Profibus User Organization) since 1990.
Master-Slave The master (usually a PLC with a PROFIBUS interface module, such as,
S7-315-2 DP) controls the data communication on the bus. Slaves only send
data when they are prompted by the master. That way, no collision results
between two senders.
Cyclical Range The slaves are cyclically (= one after the other) supplied with process data by
the master and their process data is scanned. In Drives, process data are, for
example,
• speed setpoint, switch-on signals from the master or
• actual speeds, error signals from the drive.
The data telegrams consist of 2 to 16 words (á 16 bit).
Cycle times lie between about 2 to 20 ms.
Event-driven Range As well, there is often the need to read or change the parameters of a drive. This
occurs (in today‘s applications) only when prompted. The cyclic operation is
then briefly interrupted and a longer data telegram with up to 117 words is sent.
Master Class 2 The "normal" master is called Master Class 1. For commissioning, you can also
connect a PC or PG (= SIMATIC programming device) as a Master Class 2.
Independent of the actual data communication, the Master Class 2 can access
the drives.
PROFIBUS Address The minimum requirement for commissioning the PROFIBUS option module is
the setting of the PROFIBUS address.

Integrating a Drive in the HW Config

General The cyclic data exchange between CPU and MM4420 via PROFIBUS must be
configured in HW Config.
Properties
Dialogs The following properties are defined in the dialogs:
PROFIBUS interface: PROFIBUS address and subnet
SINAMICS: Firmware version of the Micromaster (to be found on the nameplate
of the MM420 such as, "Issue: A06/1.17")
DP Slave: In addition to the I/O addresses for data exchange between CPU and
Micromaster, the type of communication must be defined here:
PPO Types: (Parameter Process data Object)

The structure of the user data for the cyclic data exchange is identified as the
PPO Type in the PROFIBUS profile "DVA".
The PPO types 1 to 5 have a defined number of PKW (Parameter Index Value)
and PCD (Process Data):
PPO Type 3 permits a simple data transmission with which the controlling of the
Micromaster is possible as well as the specification of the speed setpoint and
the reading out of the speed actual value.
With PPO Type 1, you can also change all drive parameters per CPU program.

Drive ES (= Engineering System)
Drive ES Basic Drive ES SIMATIC
Drive ES Graphic Drive ES PCS7

Software Drive ES is an (chargable) option software as an add-on to the SIMATIC

Manager.
Drive ES Basic Enables you to integrate the drives as objects in the SIMATIC Manager. They
then appear in the project tree, like for example, SIMATIC CPUs.
In this manner, the commissioning software of the drives is then also started.
Drive ES Graphic Exclusively for MASTERDRIVES and SIMOREG DC-MASTER.

Is used for user-friendly, graphic assignment of internal signal sequences and
available function blocks.
Drive ES SIMATIC This package contains STEP 7 Block Libraries (= Data and function blocks) for
user-friendly configuration of communication using PROFIBUS DP.
Drive ES PCS7 This package contains faceplates for user-friendly configuration of the process
control system PCS7.
Starter The "STARTER" commissioning software for drives supports the user in:
• parameter assignment
• commissioning
• diagnosis
• the service of MICROMASTER 4.
STARTER can be executed as stand alone. The tool is, however, also
integrated in the Drive ES configuration program from Totally Integrated
Automation.

Overview of the Starter Commissioning Tool

Overview STARTER is a graphic commissioning software for commissioning the Siemens

Frequency Inverter Family MICROMASTER 4.
You can make the configuration of the drive with the help of the Wizard for drive
configuration. After you have gone through the steps with the Wizard, the drive
is functional. You make special parameter assignments in the windows of the
respective drives.

Configuration of a Drive with the Wizard

Wizard For standard applications of the drive, the parameter assignment with the help of
the Wizard is sufficient. Comparable to the quick commissioning via Parameter
P3900, only the most important parameters are queried here in the dialogs.
Online Configuration Usually, the reconfiguration of the drive is done online with the Starter Wizard
since a reset to factory default is carried out at the conclusion of a
reconfiguration, similar to a quick commissioning via Parameter P3900 and
further parameters are overwritten with newly calculated values. After a
successful online configuration, the values of all parameters can then also be
stored offline.

Online Operation

Online/Offline With the "Starter" software, you can work in the OFFLINE and ONLINE mode.
Depending on the mode, you can use various functions. You can see whether
the system is in the ONLINE or the OFFLINE mode at the bottom of the work
window.
Online Mode In the ONLINE mode, you have a communication connection from the "Starter"
to the drive. You can configure the drive, carry out the drive diagnosis, control
the drive through the PC/PG and load the new parameter data into the drive.
During the switch into the ONLINE mode, the project is checked for consistency.
A check is made as to whether the drives configured in the project exist and are
connected. If the consistency check is successful, the icons of the drives have a
green background in the project navigator. If there is an error, the icons have a
red background.
You establish an ONLINE connection to the drive either with the icon or
with Project Æ Connect to target system.
Note For the ONLINE mode, the drive must be connected to the PC/PG through a
PROFIBUS cable and the interface has to be configured on the PC/PG.
Changing Parameters A parameter that is changed, first appears in the "Starter" as yellow. After
pressing the "Enter" key, the modified parameter becomes effective. Since the
parameters are first stored in the RAM memory of the Micromaster, they are lost
when you have Power OFF. To permanently store the parameters either use the
menu option Target System Æ Copy RAM to ROM or load the configuration with
Target System Æ Download Æ to target device and confirm the prompt "Do you
really want to copy RAM to ROM? ".

Diagnostics Function

Activate In the ONLINE mode, you start the function with a double-click in the left window
on "Diagnostics".
Control/Status Word In this tab you can follow how the control word is output from the CPU, for
example. The bits displayed in green have signal state "1".
Status Parameter In this tab, the most important parameters, such as, frequency setpoint or output
current are displayed.

Control Panel Function

Usage For diagnostics and maintenance, you can issue control commands to the
Micromaster from the PC/PG. As well, the most important parameters can be
monitored online.
What to Do 1. Double-click on the object "Control Panel" in the left window (Project
navigator).
2. You may have to enlarge the lower window containing the control panel.
3. Click the "Assume control priority" button.
4. Read the message "Transfer control priority to the PC? " and continue with
"Yes".
5. Take note of the messages in the follow-up screen and accept with "OK" .
6. Activate the option "Enables (bit 1 to bit 6)".
7. In the field "Setpoint", enter the setpoint frequency, for example, 10 Hz.
8. With the "I" button switch on the drive and with the "0" or the space bar
switch off the drive. The "I/0" button is for jog operation.
9. Give back the Control priority by clicking on the " Return... " button and
acknowledge the message that follows.

Exercise 1: Integrating a Drive in HW-Config

General The cyclic data exchange between CPU and MM4420 via PROFIBUS must be
configured in HW Config. Proceed as follows:
What to Do 1. Activate the HW Config tool.

2. Open the HW Catalog and set the Profile "DriveES".
3. From the SIMOVERT Æ MICROMASTER4 directory, select the
Micromaster 420 and drag this onto the PROFIBUS DP mastersystem using
drag and drop.
4. In the "Properties – PROFIBUS interface MICROMASTER_4_PROFIBUS"
screen, enter the PROFIBUS address 6, select the subnet and confirm with
"OK".
5. In the "Properties – SINAMICS" screen, choose the device version "1.0x" or
"1.1x" that fits for your training unit. You will find this version on the
MM420‘s nameplate (such as, "Issue: A06/1.17")
6. In the "DP Slave Properties" screen, in the "Configuration" tab, select PPO
Type 3 and assign the I/O address 42 for data exchange with the CPU (see
slide).
7. Save, compile and download the configuration into the CPU.
Result When the MM420 has been successfully parameterized and integrated in the
hardware configuration of the S7 Station, the LED of the MM420 PROFIBUS
interface shows a green flashing or constant light.

Exercise 2: Online Configuration of the Drive using the Wizard
online
Store
configuration offline

Task The MM420 of your training station is to be reconfigured according to the motor
data using the "Starter" tool.
What to Do 1. Open the "Micromaster_420" of the S7 station with the "Starter" tool by
double-clicking on "Micromaster_420" in the right window.
2. In Starter, open the entire project structure of the "S7_300_Station" by
clicking on the small x‘s.
3. Establish an online connection to the MM420
Project Æ Connect to target system
4. Double-click on "Configuration" and then on "Reconfigure drive ..."
5. In the follow-up screens, enter the motor rating plate data and confirm the
standard settings in the following.
In the "Command Source/Setpoint Source" tab, enter the following
parameters:
• Source of control signals? CB at COM Link (6)
(CB at COM Link (6) means P0700 = 6 means PROFIBUS)
• Source of speed setpoints?: CB at COM Link (6)
(CB at COM Link (6) means P1000 = 6 means PROFIBUS)
In the "Main Parameters" tab, enter the following parameters:
• Ramp-up time: 4.0s (means P1120 = 4.0s)
• Ramp-down time: 3.0s (means P1121 = 3.0s)
6. Save the project
Project Æ Save
7. Establish an online connection to the MM420
8. On the BOP, check whether the values specified by you were assigned to
the parameters.

Exercise 3: Changing Parameter Ramp-up and
Ramp-down Times Online

Task In order to become familiar with the possibility of also changing individual
parameters later on, you are to reparameterize the ramp-up and ramp-down
times of the ramp-function generator.
What to Do 1. Establish an online connection to the MM420

2. Open the project structure, double-click on "Limits" and switch to the
"Ramp-function generator options" tab.
3. Change the values for the ramp-up and ramp-down time, for example, to 2
seconds and confirm the values with the button "Immediately".
4. Switch the drive on with the "S1" switch on the MM420 demo case and then
off and check the set ramp-up and ramp-down time.
5. Switch off the voltage on the MM420 demo case.
6. Did the ramp-up and ramp-down time change?
7. Change the times once more and make sure that the changes are retained
even after a power failure.
Notes It is only possible to save offline; downloading the configuration is only possible
online.

Exercise 4: Using the Control Panel

Task Control the drive using the "Control Panel" of the "Starter" software.
What to Do 1. Establish an online connection to the MM420

2. In the project structure, double-click on "Control Panel" and switch to the
"Ramp-function generator options" tab.
3. Activate the control panel by clicking on "Steuerhoheit holen", read the
safety instructions provided and close the dialog to continue by pressing
"Akzeptieren".
6. Activate "Freigaben"
(causes bits 1 to 6 of the control word to be set)
7. In the "Sollwert" field, enter a value and switch the drive on and off using the
"I" and "O" keys.
9. Give back the control priority by clicking on the " ...zurückgeben" button and
read the message that follows and acknowledge it.

Exercise 5: Controlling the Drive via the TP170B (FC 42)
AI2
AI1 AO1 -15V...+15V
AO2
0
10
V
AI1 AI2
"PIW AI2" (PIW 306)

Speed 0 to 1350 rpm

Task The drive is now to be controlled via the program or via the touchpanel screen
"MM 420". The motor can be jogged via the buttons "Jog Left" and "Jog Right"
and can be switched on and off with the speed to be set on the simulator
potentiometer AI2 using the buttons "On" and "Off".
Controlling the drive is already programmed in the FC42 block that is now to be
commissioned and then expanded by you.
Task #2 In addition to the control of the MM420 via touchpanel operation, the MM420 is
now also to be controlled parallel to the conveyor model motor:
- if the conveyor model motor is jogged to the left or right via the screen
"Conv", the MM 420 is also to be controlled accordingly in parallel
- with the transport functions while in AUTO mode, the MM 420 is also to be
switched on and off automatically
What to Do 1. From the S7 program called "Chap09_MM420" in the SERV3_B project,

copy the FC 42 block into your own S7 program.
2. Commission the block.
3. Check whether the MM420 can be controlled via the touchpanel.
4. Write a program for the required expansions in FC 42.

PROFINET IO
PROFINET IO
SIMATIC NET Datum: 13.06.2007 SITRAIN Training for

Siemens AG 2007. All rights reserved. Datei: SERV3_10E.1 Automation and Industrial Solutions
Contents Page
Objectives .................................................................................................................................... 2
Objectives of PROFINET ............................................................................................................. 3
Components of the PROFINET Standard .................................................................................. 4
Real-time Data Exchange via Ethernet ….................................................................................... 5
PROFINET Real-time Communication ....................................................................................... 7
Controlling the Network Access ................................................................................................. 8
Definition of Terms ..................................................................................................................... 9
PROFINET IO Distributed Field Devices .................................................................................... 10
The Current PROFINET IO Product Line .................................................................................... 11
PROFINET Network Structures ................................................................................................. 12
Network Topologies ................................................................................................................... 13
Definition of Terms ................................................................................................................... 14
Structure of the IP Address (Internet Address) ........................................................................... 15
Switching the PG / PC Interface to Industrial Ethernet ............................................................. 16
Verifying the Required Protocols ................................................................................................. 17
Node Initialization: Assigning an Ethernet Address …................................................................. 18
Exercise 1: Assigning the IP Address for a PG ............................................................................ 20
Exercise 2: Configuring a PROFINET- IO Basic System ............................................................ 21
Exercise 3: Configuring an ET 200S as IO Device .......................................................................... 22
Exercise 4: Assigning a Device Name for the ET200S Online .................................................... 23
Exercise 5: Assigning a Device Name for the ET200S Offline .................................................... 24
Exercise 6: Downloading a Configuration in the IO Controller ..................................................... 25
Exercise 7: Total Check of the Network ...................................................................................... 26
Exercise 8: Connecting the Conveyor Model, TP170 and MM420 to the PROFINET Case ........ 27
Exercise 9: Commissioning the PROFINET Case ...................................................................... 28

Automation and Industrial Solutions Page 1 PROFINET IO
Objectives
Introduction to PROFINET
Interface definition for Industrial Ethernet
Basic configuration of a PROFINET IO system
Assigning device names and IP addresses


Objectives of PROFINET
Future requirements on performance and performance profiles lead field buses

to the performance limit
Ethernet, through continuous technical further development, offers a powerful
and future-oriented communications platform
Vertical integration offers thus far unused productivity potential through the
connection of office and automation areas
In the office area, Ethernet is the standard with reference to installation
technology and protocols
Process
Real-Time
Safety Communi-
cation
IT-Standards Distributed
& Security PROFINET Field Devices
Network Motion
Installation Control
Distributed
Intelligence

PROFINET PROFINET is the innovative automation standard of the PROFIBUS User

Organization for the implementation of a complete and consistent automation
solution based on Industrial Ethernet.
With PROFINET, simple distributed field devices as well as time-critical
applications can be integrated in the Ethernet communication just like
distributed automation systems based on components via the Component
based Automation (CBA) approach.
The PROFINET standard defines a cross-vendor communications, automation
and engineering model.
Objective The objective of PROFINET is:
• An open standard for - distributed - automation (PNO)

• A consistent communication via field bus and Ethernet
• The use of open standards such as TCP/IP, UDP and IT standards
• Real-time Ethernet communication as the basic functionality
• Future integration of drives (Motion Control) via IRT (Isochronous Real
Time)
• Integration of existing PROFIBUS installations
Automation devices that conform to the PROFINET standard must provide the
user with certain communications interfaces that are based on the Microsoft
Standard "DCOM" (Distributed Component Object Model).

Components of the PROFINET Standard
PROFINET CBA Distributed automation by means of Component based

Automation
PROFINET IO Integration of distributed field devices via Industrial Ethernet
PROFI Drive Applications profile for drives to PROFIBUS and PROFINET
PROFI Safe Integration of fail-safe technology (fail-safe controllers /

communication) in the PROFINET standard
Process
Real-Time
Safety Communi-
cation
IT-Standards Distributed
& Security PROFINET Field Devices
Network Motion
Installation Control
Distribued
Intelligence

PROFINET completely covers the requirements of automation. PROFINET brings together

the expertise of PROFIBUS and Industrial Ethernet. The utilization of the open
standard, the easy handling and the integration of existing parts of a system
(e.g. a plant) determined the definition of PROFINET right from the beginning.
Today, PROFINET is integrated in IEC 61158.
PROFINET CBA enables you to break down system parts into technological modules
(components). The representative of a technological module in system
engineering is the so-called PROFINET component. Each PROFINET
component has one interface that contains the technological variables that are
exchanged with other components. The PROFINET components are modelled
using the standardized COM technology. COM is an advancement in object-
orientation and enables the development of applications based on prefabricated
components. The components are characterized by the fact that they form self-
contained units and can be related to other components. The components can
be flexibly combined like blocks and independent of the internal implementation
can easily be reused. The access mechanisms to the component interfaces are
uniformly defined in PROFINET.
PROFINET IO With PROFINET IO, the integration of distributed field devices takes place
directly on the Ethernet. For that, the Master-Slave procedure from PROFIBUS
DP is carried over into a Provider-Consumer model. From the communication
point of view, all devices on the Ethernet have equal rights. Through the
configuration, however, the field devices are assigned to a central controller. As
a result, the familiar user view in PROFIBUS is transferred to the PROFINET
peripherals: The distributed peripheral device reads in the peripheral signals
and transfers them to the controller. The controller processes them and
transfers the outputs back to the distributed peripheral device.
Mit PROFIDrive With PROFIDrive, very fast, clocked drive controls for high performance Motion
Control applications will be implemented in the future.

Real-time Data Exchange via Ethernet (1)
Use of standard protocols (UDP/IP)

Telegram overhead enlarges frame length Æ lengthening the transmission time
Stack processing times cost processor computing time Æ lengthening the
update intervals
Net Data
Nutzdaten
Layer -4 UDP- Header
Layer -3 IP-Header Nutzdaten

Net Data
Frame- Frame- Frame- Frame-

Layer -2 Header Trailer Header Trailer
Ethernet- Ethernet-
Layer -1 Frame Frame
Layer 4alsasApplikationsschnittstelle
Layer-4 application interface Optimized Layer
Optimierter 2 access
Layer-2 -Zugri ff

Prerequisite The analysis of different TCP/IP implementations has shown that with standard
communications stacks considerable run times are required for processing data
packets. These run times can be optimized but the TCP/IP stack necessary for
this is then no longer a standard product, rather a proprietary implementation.
With the use of UDP/IP implementations you have much the same situation.
Real-time Real-time applications in manufacturing automation require update and

response times in the range of 5-10ms.
The update time is the time that elapses when a variable is formed in an
application of a device, then is sent to a partner device via the communication
system and then there is made available to the application.
It must be possible to implement the solution of a real-time communication with
standard network components, such as, switches, and standard Ethernet
controllers. For the devices, the implementation of a real-time communication
may only lead to a slight load on the processor so that the processing of the
user program continues to have priority.
Speed According to experience, the transmission speed on the line at 100 MBit
Ethernet or above can be neglected compared with the processing in the
devices.
The time it takes for the preparation of data in the application of the provider is
not influenced by the communication. This is also true for the processing of
data received in the consumer.
Hence it follows that primarily through suitable optimization of the
communication stack or removal of individual layers as of Layer 2 could result
in considerable improvements in the update rates and thus the real-time
behavior in the provider and the consumer.

Real-time Data Exchange via Ethernet (2)
Optimized Layer 2 access

Layer 3/4 do not contain any necessary functionality for real-time data exchange and
are therefore not needed Æ Routing of RT data is hereby however no longer possible
On Layer 1/2 Ethernet frame according to IEEE802.3 Æ still standard Ethernet !
No restriction of the openness !
Net Data
Nutzdaten
Layer -4 UDP- Header
Layer -3 IP-Header Nutzdaten

Net Data
Frame- Frame- Frame- Frame-

Layer -2 Header Trailer Header Trailer
Ethernet- Ethernet-
Layer -1 Frame Frame
Layer 4alsasApplikationsschnittstelle
Layer-4 application interface Optimized Layer
Optimierter 2 access
Layer-2 -Zugri ff

Definitions • Real-Time: Real-time means that a system processes external events

within a defined time.
• Determinism: Determinism means that a system reacts in a predictable
(deterministic) manner.
In industrial networks, both these requirements are important. PROFINET
meets these requirements.
ERTEC PROFINET, in so far as the network components and devices used have a
real-time ASIC switch (ERTEC), is constituted to be a deterministic real-time
network as follows:
• The transfer of time-critical data between different stations over a
network within a defined interval is guaranteed.
To achieve this, PROFINET provides an optimized communication
channel for real-time communication: Real-Time (RT).
• An exact prediction of the time at which the data transfer takes place is
possible.
• It is guaranteed that problem-free communication using other standard
protocols, for example industrial communication for PG/PC can take
place within the same network.

PROFINET Real-time Communication
Priority assignment of the RT frames according to IEEE 802.1q

Use in manufacturing automation with cycle times of typically 5ms to
10ms
1 Open TCP/IP -Channel

IT- Appli - Device parameterization
cations PROFINET- Applications z
z HTTP z Reading diagnostic data

z SNMP 1
z DHCP...
z Negotiating the
Standard- Data Real-time- Data
communication -
Real-time
TCP/UDP channel for user data
IP
2 RT 2 Real-time channel
z High performance
Ethernet transmission
z Cyclic data
z Event-driven
Messages

Real-time Channel To be able to fulfill real-time requirements in automation, an optimized real-time

communication channel, the Realtime Channel (RT Channel), was specified in
PROFINET. It uses Ethernet (Layer 2) as a base.
The addressing of the data packets does not take place in this case via an IP
address, rather by means of the MAC addresses of the participating devices.
Such a solution minimizes the throughput times in the communications stack
considerably and leads to an increase in performance with regards to the
updating rate of automation data.
Through the dropping of several protocol levels, the telegram length is reduced
on the one hand. On the other hand, the data to be transmitted is available for
sending much sooner or is available to the application for processing. At the
same time, the processor performance in the device required for
communication is significantly reduced through this.
IRT Channel Isochronous Real-time (IRT) as a further development with the following
features:
• Clocked data transmission
• Cycle times <1ms with jitter accuracy <1µs
• Typical field of application is motion control
Priority Assignment The network components control the data flow between the devices via a
priority assignment according to IEEE 802.1q. Priority 7 (Network Control) is
used as the standard priority for real-time data. A priority handling vis-à-vis
other applications, such as, Internet telephony with Priority 5 and video
transmissions with Priority 6 is thus ensured.
For real-time communication, network components and controllers available in
the market can be used. While the optimized communication channel is
negotiated, the switch modules automatically learn the Ethernet addresses of
the devices. With that, the basis for the following data exchange via the real-
time channel is created.

Controlling the Network Access
Avoidance of collisions with the CSMA/CD procedure for example,

through controlled network access according to the Master-Slave
principle
Switch technology prevents collisions, supports full-duplex transmission
and makes the parallelization of data traffic possible
Controller Controller
Device Device Device Device Device Device Device

Network Components Network components suitable for PROFINET must be designed for Fast
Ethernet (100 MBit/S) and full-duplex transmission. In full-duplex operation, a
network component receives and sends data simultaneously on the same port.
The collision detection is deactivated with full-duplex. No bandwidth is lost
through the Ethernet collision procedure.
Network configuration is significantly simplified since the check on the length of
the distance within a collision domain is not required.
Switch A switch receives data packets at its network interfaces and forwards these
with the help of the address information in the data packet. Data are only output
to the interface through which they reach their receiver. A switch can
simultaneously send and receive different data at all interfaces. PROFINET
requires a switch as "application-specific device" in the signal dispatcher.
For use in PROFINET, a switch must fulfill the following functions:
• 100 MBit/s Fast Ethernet interfaces (100BASE-TX or 100BASE-FX)
• Full-duplex operation

Definition of Terms
PROFINET IO - Controller:
Exchange of peripheral signals with associated field devices
Access to the peripheral signals via process image
PROFINET IO - Device:
Field device assigned to the IO Controller
PROFINET IO - Supervisor:
Engineering and Diagnostic Station
Diagnostics Controller PG/PC

Diagnostics
IO Controller Supervisor
Monitor/Modify
Monitor/Modify
Parameter
Parameter Assignment
Assignment
Configuration
Configuration
Peripheral
Peripheral Signals
Signals
Field Device Interrupts
Interrupts
IO Device

General With PROFINET IO, the integration of distributed field devices takes place
directly on the Ethernet. For that, the Master-Slave procedure from PROFIBUS
DP is carried over into a Provider-Consumer model. From the communication
point of view, all devices on the Ethernet have equal rights.
Through the configuration, however, the field devices are assigned to a central
controller. As a result, the familiar user view in PROFIBUS is transferred to the
PROFINET peripherals:
The distributed peripheral device reads in the peripheral signals and transfers
them to the controller. The controller processes them and transfers the outputs
back to the distributed peripheral device.
Device Types PROFINET IO makes a distinction between the three device types IO
Controller, IO Device and IO Supervisor:
z IO - Controller: Controller in which the automation program is
executed
z IO - Device: Remotely assigned field device assigned to an IO
Controller
z IO - Supervisor: Programming device / PC with commissioning and
diagnostic functions

PROFINET IO Distributed Field Devices
ET 200S with Ethernet connection and

PROFINET communication
Use existing I/O modules without changes
Device configuration
as usual
PLC user program

with familiar commands
Flexible use of distributed field devices

on PROFIBUS and Industrial Ethernet

General Distributed field devices are integrated through PROFINET IO. The familiar IO
look of PROFIBUS DP is used, in which the field devices' user data are
cyclically transferred into the controller's process image.
CPU 31x-2 P/DP The new CPU 315 / 317-2 PN/DP augments the line of PROFINET devices by
an SIMATIC S7-300 CPU in the highend range. With the two connectors for
Industrial Ethernet and PROFIBUS, it can be used as a transition between
these two networks. The CPU31x-2 PN/DP works as IO Controller, to which
various IO Devices can be connected.
ET 200S PN The ET200S distributed I/O system is a highly modular, extremely flexible DP
slave and/or IO device with IP20 degree of protection.
The ET 200S I/O system is integrated in the PROFINET IO communication as
IO device via the IM151-3 PN interface module. Directly next to the interface
module which transfers the data to the IO controller, you can slot up to 63
modules, such as, power modules, peripheral modules and motor starters in
just about any combination and number that you like.
IE/PB Link As an independent module, the IE/PB Link PN IO forms the seamless transition
between Industrial Ethernet and PROFIBUS.
By means of the IE/PB Link PN IO as proxy, existing PROFIBUS DP devices
can continue to be used and integrated into a PROFINET IO real-time
communication. In addition, it supports S7 Routing so that the connected
PROFIBUS slaves can be addressed and diagnosed across the networks via
PG/OP communication.
As a PROFIBUS master, the proxy coordinates the data exchange between the
PROFIBUS nodes. At the same time, it is an Ethernet node with PROFINET
communication. Proxies can be implemented as controllers or as pure
gateways.

The Current PROFINET IO Product Line
CPU41x
CPU317-2 PN/DP + CP443-1 Advanced STEP7 V5.3 SP2
CPU315-2 PN/DP Softnet PN IO
CP 343-1 PN
SCALANCE Switch
IE/PB Link IO
TP / OP with
WinCC Flexible
ET200S PN
Vision Sensor
PROFIBUS Devices
(DPV0 Slaves)

SCALANCE X The Ethernet Switch modules of the SCALANCE series are available in three
different versions: X100, X200, X400.
Provided that they are configured in HW Config, they can be diagnosed like a
field device so that they themselves can make a detailed diagnoses directly
available when, for example, a connected IO device fails. The X200 and the X400
Switch modules also offer the possibility of web-based diagnosis by means of
SNMP (Simple Network Management Protocol).
CP 443-1 Advanced The CP443-1 Advanced makes the system connection of S7-400 to PROFINET
possible. It has an integrated 4-port switch, a web-server and enables PROFINET
as well as standard communication. The CP443 works as IO Controller, to which
various IO Devices can be connected.
SIMATIC VS 130 SIMATIC VS 130 is a very powerful Vision Sensor for application-specific picture
processing. It adapts itself flexibly to different object interfaces and coding
procedures. Four sensor-head versions for different data-matrix code sizes are
available. With the Vision Sensor VS 130, a reliable parts identification in
production is possible (such as, type designation, serial number, batch number).
SOFTNET PN IO Using SOFTNET PN IO, PCs can be connected to field devices via Industrial
Ethernet. Here, the PC acts as IO controller.
SOFTNET PN IO is available for the interface modules CP 1612 (PCI) and CP
1512 (PC Card). It also provides the interfaces for the OPC access to IO devices
as well as a programming interface via a C-Library.

PROFINET Network Structures
Campus CD CD
Distributor
Building Building
Office Building BD BD Production
Distributor
Machine
Floor MD MD Distributor
Distributor
FD
Floor 1
FD
Floor 2 Machine 1 Machine 2

Guidelines The PROFINET Installation Guidelines describe the various network structures
in PROFINET networks.
It is common practice to segment individual control systems with their
networks. PROFINET connects these systems with higher-level switch
modules.
The attention should be given to the cascading depth of the switch modules
and to the "not real-time" traffic.
Note The basic guidelines are described in the PROFINET Installation Guidelines.
The most current version of the particular document can be downloaded from
the PROFIBUS User Organization.
• http://www.profibus.com/downloads/frameset.html

Network Topologies
Ring
Line
Tree
Star

Star Structure Through the structuring with switch modules, a star-shaped network topology
automatically results.
With this structure, unlike other structures, when a single PROFINET device
fails it does not automatically lead to the failure of the entire network. The
failure of a switch merely leads to the failure of a part of the communication
network.
Through the star structure with switch modules you achieve a high degree of
availability of the communication network right from the beginning. If you would
like to increase the availability then you configure the central switch modules as
redundant.
Applications for star structures include areas with a high device density and
short distances, such as, small production cells or a single production machine.
Tree Structure If you interconnect several switches with one another, a tree-shaped network
topology results.
It is used in the division of complex systems into smaller partial systems.
Line Structure All communication nodes are interconnected one after the other in a line. If a
coupling element (such as a switch) fails, then communication beyond the
failed coupling element is no longer possible.
The line structure is used mainly in systems with extensive structures, for
example, conveyor systems and for connecting production cells.
Note Future PROFINET IO devices will be brought to market with an integrated

switch (ERTEC chip set) , among other things. That is, the formation of line
structures as with PROFIBUS - DP can then also be implemented with
PROFINET.

Definition of Terms
IP = 192.168.111.99 IP = 192.168.111.100
1 MAC = 08-00-06-01-CA-FE 2 MAC = 08-00-06-01-AD-AC
Computer 1 would like to set up a connection to Computer 2:

1. ARP - Query to all (MAC Broadcast) from Computer 1:
"Who has the IP address 192.168.111.100?"
2. ARP - Answer from Computer 2:
"The MAC address to 192.168.111.100 is 08-00-06-01-AD-AC."
3. The connection can be set up.

ARP To determine the Ethernet address of the recipient, the IP driver makes use of
the ARP – protocol structure (Address Resolution Protocol).
In each TCP/IP-capable computer, there is such an ARP table which lists the
assignment of IP address to Ethernet address.
MAC Address Since all stations are connected to one common bus cable, it is necessary for
targeted addressing that each participant has its own address under which it is
then accessible on the network.
For this, each Ethernet Interface has been assigned a fixed and world-wide
unique address from its manufacturer. This address is termed hardware - or
MAC address (Media Access Control). It is stored on the network card and
serves as the unique identification in the local network. Cooperation between
the manuafactures guarantees that the address is unique world-wide.
DHCP DHCP ("Dynamic Host Configuration Protocol") is a protocol developed by

Microsoft for the dynamic assignment of IP addresses.
Each computer or CP on the network requires its own IP address. Provided that
a DHCP server is set up, it assigns querying computers on the network
automatically with addresses from a defined IP address pool. A computer
sends an address request and then receives its IP address from the DHCP
server. No fixed addresses must therefore be assigned, which considerably
reduces the configuration work for a network.
DNS DNS ("Domain Name Service") administers the computer names and the IP
address assignments.

Structure of the IP Address (Internet Address)
Type A Addresses (for few subnets, but many

nodes (stations) per subnet)
b31 b0
Version
0 Subnet Node address
Type B Addresses (for a medium number of subnets

and nodes)
b31 b0
Version
10 Subnet Node address
Type C Addresses (for many subnets, but few

nodes per subnet)
b31 b0
Version Node
110 Subnet
address

IP Address Each computer that is connected to the Internet has an IP address.

It is normally specified in the Dotted Quad Notation or Standard Dot
Notation.
The 32-bit long IP address is represented in 4 decimal numbers that are
separated by a dot: for example, 192.168.111.100.
Internet addresses are not assigned to a computer but to the network
interfaces that a computer has in different networks. The IP address consists
of three parts:
• the network ID and/or network class A, B or C

• network address and/or Net ID
• system address and/or local address and/or Host ID
Type A: 127 networks, 24-bit Host ID: 0 - 127.H.H.H

Type B: 16,383 networks, 16-bit Host ID: 128 - 191.N.H.H
Type C: about 2 million networks, 8-bit Host ID: 192 - 223.N.N.H
Type D: Multicast: 224-239.M.M.M
Type E: Reserved: 240-255.R.R.R
Note The network with the number 127 cannot be used (Loopback Interface of the
IP implementation: 127.0.0.1 = localhost).
Host IDs whose bits are all set to 0 or 1 are reserved for special functions,
such as, broadcasting, and may not be assigned as a result.
Carefully check the assignment of the IP addresses, if nececessary, with the
support of the DV Administration.

Switching the PG / PC Interface to Industrial Ethernet

Access Point of the Application

Here, the existing access points are displayed. With the help of the name of an
access point, the individual applications access the interfaces.
Select an entry to be able to assign an interface parameter assignment to an
access point. When you select the entry "<Add / Remove>", the dialog box
"Add / Remove Access Points" is displayed in which you can add or delete
access points.
Interface Parameter Assignment Used

Here, the interface parameter assignment is displayed which is assigned to the
access point displayed in the field "Access Point of the Application" and thus
determines the access path of an application.
Below that, all available interface parameter assignments are displayed.
Underneath the list, the description of the selected interface parameter
assignment is displayed.
Choose one of the interface parameter assignments to assign it to an access
point, to change its properties, to copy it or to delete it.
When you select an interface parameter assignment, you assign it to the
access point. That way, you establish the connection between the access point,
the interface parameter assignment and the interface.
If communication is taking place via the current access point, you can not
change(over) the "interface parameter assignment used". In the list, the
interface parameter assignment is selected as the actual access path. Possible
changes since the beginning of the program are lost.
Properties Via the "Properties" button of the Interface parameter assignment used and
"Network Properties", you get to the Network and Internet Connections
properties (Windows – Control Panel, see next page).

Verifying the Required Protocols

IP Data transmission with the Internet Protocol (IP) represents an unsecured

packet transmission (datagrams) between an IP source and an IP destination.
When the network is overloaded, datagrams can be lost. Through the 32bit
checksum of the Ethernet packet, it is very likely that errors in the packet can
be detected and eliminated. The following protocols are based on IP:
TCP The TCP/IP protocols (Transmission Control Protocol/Internet Protocol) were

developed as a result of the fact that for a long time official standards for the
integration of different computers in one network didn‘t exist.
TCP/IP guarantees an error-free, sequence-correct and complete transmission
of data from the sender to the receiver. TCP is connection-oriented. That is,
two stations build up a connection before the transmission of data blocks which
is disconnected after the transmission is completed. TCP has mechanisms for
the constant monitoring of the built-up connection.
TCP/IP has since become the basis for many public and private networks.
UDP The User Datagram Protocol (UDP) guarantees an error-free and complete
data transmission, just like TCP. Unlike TCP, however, UDP is connectionless.
That is, each data packet is treated like an individual packet and there is no
transport acknowledgement. Because time-out monitoring and connection build
up and disconnection does not take place, UDP is better suited for time-critical
applications than TCP.
Checking You should make sure that the protocols "PROFINET IO RT-Protocols" and
"DLC" are installed on the computer so that a smooth engineering and a
successful commissioning of the PROFINET - IO system can take place.
Via the Properties of the TCP/IP Protocol, an IP address is assigned to the PG
/ PC in the following.

Node Initialization: Assigning an Ethernet Address (1)
1
Look for MAC address or
enter directly
2 Select the components

based on the MAC address
or the station name / type

IP Configuration 1. First of all, use the "Browse..." button to determine the devices accessible
via the MAC addresses or enter the MAC address that you know.
2. Then, select, if necessary, from the list in the dialog which pops up after the
network search, the module with the MAC address that you know.
If the module was already assigned an IP address, it is also displayed here.
The MAC address of the component you selected is shown once more
underneath the list for verification.
3. Set up the IP configuration according to your specifications.
4. Click the button "Assign IP Configuration".
Notes If you have selected the dialog in the context of a selected module, then the IP
address is already preassigned with the values configured for the module.
Otherwise, you have to enter IP address, Subnet mask and, if necessary,
Gateway here.
DHCP Server If the IP address is to be obtained from a DHCP server, the DHCP server is
provided with the MAC address of the CP, the device name or the Client ID that
is entered here, depending on the selected option.
The Client ID is a (character) string with a maximum of 63 characters. Only the
following characters may be used: a-z, A-Z, 0-9 and - (hyphen).
If you want to specify that the DHCP server is to determine the IP address via a
device name, you must assign the device name for the device first.
Flashing On Test This function is used to check the correct assignment of a module and its
interface. When you click on this button, the transmission of a flash telegram is
triggered for the selected module. The module indicates this signal (for
example, on the Link LED).

Node Initialization: Assigning an Ethernet Address (2)
New IP address
Subnet mask – note maximum

number of network nodes!
New device name

Prerequisites So that the addressing described here can be done, the module must be
accessible online. That means:
• The connection to the Ethernet LAN must be established;
• The Ethernet interface of the PG / PC must be accessible for STEP 7
• The node must be located on the same Ethernet subnet as the computer.
• The node must support the functions "IP Configuration" and "Assign device
name". If the S7 CPU doesn‘t support this possibility, then the IP address
and the device name must be downloaded to the system via the S7
Hardware Configuration Tool.
What to Do 1. Use the "Browse..." button, to determine the devices accessible via the
MAC addresses.
2. After the network search, the module with the appropriate MAC address
can now be selected from the list that pops up.
3. Press the "Assign address" button to store the settings in the respective
device.
4. On the Ethernet subnet (PROFINET IO system), the device name must be
unique. Press the "Assign Name" button to transfer the edited device name
to the device.
Device Names If you configure a device as PROFINET IO device, you must assign a
PROFINET IO device name. Make sure, however, that the device name is
preferably setup in the Properties dialog and thereby is stored in the
configuration data.
The device name is also required if the IP address is to be determined by a
DHCP server via a device name. The device name is to be structured
according to DNS conventions.
Example: [Name from short designation].[Name of the IO system]

Exercise 1: Assigning the IP Address for a PG
The following access path(s) was (were) changed:
S7ONLINE (STEP 7) => TCP/IP(Auto) -> VIA PCI 10/100Mb Fast …
OK Cancel Help

Network Properties Through the "Network Properties..." button, you get to the Control Panel of
Windows; dialog box "Network" (taskbar Start Æ Settings Æ Control Panel Æ
Network and Internet Connections). From here, you can access the settings of
your PC‘s network components.
IP Address The following example describes how you can set the IP address. The setting
in the field "Primary Network Registration" has no effect on the intended
change of the IP address. Proceed as follows in order to change the IP
address:
1. From the list "The following network components are installed" select the
network protocol "TCP/IP".
2. Click on the "Properties" button. Reaction: The dialog field "Properties for
TCP/IP" appears.
3. Select the "General" tab and choose the option "Define following IP
address".
4. In the "IP address" field enter the desired address and the subnet.
Note In the following examples, the IP addresses

• 192.168.111.99 for the PG / PC and
• 192.168.111.100 for the CPU 31x-2 PN/DP
should be used (Subnet mask 255.255.255.0). Check the IP address ranges
suggested by STEP 7 with reference to your actual system.
Access Control If the CPU 31x-2 PN/DP is connected to the PG / PC by means of "cross-over
cables" or via the SCALANCE X208 switch, you can access the CPU via the IE
interface. Use the "Accessible Nodes" function in the SIMATIC Manager to do
so and check the contents of the Blocks folder.

Exercise 2: Configuring a PROFINET- IO Basic System
Load PLC
Control

Task You are to configure a PROFINET basic system with a CPU 31x-2 PN/DP as
PROFINET controller.
What to Do 1. Create an S7 project with the name PROFINET. Make the S7 online access
to the CPU 31x PN /DP possible via Industrial Ethernet / TCP / IP and
check this with the Ping function.
2. In the SIMATIC Manager, carry out a CPU memory reset via the menu
option PLC… . Don‘t forget to also erase the MMC memory module. If the
CPU is not accessible, then assign it an IP address as described in Point 3.
3. Provide the CPU module with an IP address. Use 192.168.111.X0 as the IP
address. X symbolizes the number of your training unit. This IP address
belongs to a Class C network with the subnet mask 255.255.255.0. Assign
the created IP configuration!
4. Read out the actual configuration using the menu options PLC Æ Upload... .
To do so, you must browse the network for accessible nodes. Complete and
specify the hardware configuration. Parameterize a clock memory byte.
5. Insert a PROFINET IO system. To do this, you must double-click on the X2
interface of the CPU. After that, you must assign a device name.
After you press "OK" to confirm this, you can insert the PROFINET IO
system with the help of the right mouse button. Load you CPU with the
modified configuration data.
6. Via the menu options PLC Æ Ethernet check the IO Controller’s device
name and, if necessary, assign it a name.
7. If necessary, create the organization blocks OB82, OB83, OB85 and OB86
and download these into your PLC.

Exercise 3: Configuring an ET 200S as IO Device

Task You are to configure a PROFINET basic system with a CPU 31x-2 PN/DP as
IO controller and an intelligent terminal ET 200S as PROFINET IO device.
What to Do 1. Start the SIMATIC Manager and open your project called "PROFINET".
2. From the Hardware Catalog, using drag & drop, insert the IM 151-3 PN
interface module from the Catalog PROFINET IO Æ I/O Æ ET 200S.
3. From the Hardware Catalog, extract the individual ET 200S modules
according to the actual design of the PROFINET IO device in the
configuration table.
4. Save and compile the hardware configuration with the menu option Station
Æ Save and compile.
5. Insert the MMC. The MMC is absolutely necessary for the operation of the
ET 200S PN !
If you want to use an MMC with unknown contents, you should first erase it
on the PG.
6. Interconnect the components (star structure with SCALANCE)
7. Switch on the power supply for the Switch module (SCALANCE X-208) and
the CPU 31x-2 PN/DP.
The Status LEDs of the CPU 31x-2 PN/DP show the following response:
DC 5V Æ lights up and SF Æ is off.
8. Switch on the power supply for the IM 151-3 PN (ET200S). You can expect
the following response: BF Æ flashes, the LEDs ON and LINK light up. In
addition, the SF LEDs of all electronic modules light up.
9. Observe the startup of all involved network components.
Note The over-all system is not yet ready for operation at this point in time.

Exercise 4: Assigning a Device Name for the ET200S Online

Task Assignment and control of IP address and device name for the intelligent
terminal ET 200S.
Prerequisite In order to assign a name for the interface module ET 200S PN, an online
connection from the PG to the IO device via a switch module is necessary.
What to Do 1. Assign a device name for the IM 151-3 PN via the menu options PLC Æ
Ethernet Æ Assign Device Name... .
2. If you are using several IO devices, then several IO devices will also be
displayed in the dialog box "Assign Device Name". In this case, compare
the MAC address of the device with the displayed MAC address, and then
select the correct IO device.
3. In the dialog box "Assign Device Name", click on the button "Assign Name"
so that the name on the inserted MMC in the interface module can be
stored.
After the name has been assigned, the device name that you assigned is
displayed in the dialog box.
4. As a check, carry out a node flashing test and observe the response of the
ET 200S. To do so, click on the "Flashing On" button.
The PING command is not possible in this case, since the IM 151-3 PN
has not yet been assigned an IP address (takes place in the next exercise).
Note If you would like to store the device name directly on the MMC, insert it in the
appropriate slot in the PG and execute the menu command PLC Æ Save
Device Name to Memory Card.
In addition to the device name, STEP 7 also assigns a device number when an
IO device is inserted. This device number begins at "1" and you can use it to
identify an IO device in the user program (for example, SFC71 "LOG_GEO").
Unlike the device number, the device name is not visible in the user program.

Exercise 5: Assigning a Device Name for the ET200S Offline

Task You are to assign a device name for the IO device ET 200S PN.
What to Do 1. In the Hardware Configuration, open the dialog “Properties - IM 151-3 PN“
and enter the device name for the IO device.
2. Via the dialog “Edit IP Addresses“, you can, if necessary, change the IP
address in the permitted range.
By default, the CPU 31x-2 PN /DP assigns additional IP addresses as of the
configured basic IP address (IO controller) numerically in ascending order,
if this option has not been switched off.
3. Save and compile the hardware configuration with the menu option Station
Æ Save and compile.
Result With that, the hardware is completely configured and can be loaded into the IO
controller and commissioned in the exercise after next.
Note Device name, IP address and MAC address are absolutely necessary so that
an IO device can be uniquely assigned to an IO controller.

Exercise 6: Downloading a Configuration in the IO Controller

Task 1 Download the over-all system via Industrial Ethernet and check the startup
activities of the IO controller.
What to Do 1. Download the compiled hardware configuration into the CPU 31x-2 PN/DP.
To do so, select the menu option PLC Æ Download... .
2. After the configuration has been downloaded, the CPU automatically
assigns the configured IP address to the IO device during the startup. If the
subnet has been correctly set up and the configuration matches the actual
set up of the IO device, then the IO device is ready for cyclic data
exchange.
3. Observe the LEDs on the various devices:
The BF2 - LED on the CPU begins to flash after the hardware configuration
is loaded. If the CPU can correctly configure and assign parameters to the
IO device on the network, the BF2 - LED on the CPU as well as the still
flashing BF - LED on the ET 200S goes out.
4. Check the accessibility with the PING command.
5. Transfer the configured clock memory byte to the output modules of the
ET 200S PN.
Task 2 If, in the course of this course, you have developed an executable program,
download it into the IO controller:
• if necessary, the hardware addresses for the conveyor have to be adapted
(rewiring or reconfiguring the hardware).

Exercise 7: Total Check of the Network

Task Control and analyze the network design you have in front of you:
• Browse through your network for the configured nodes
• Further network nodes such as the IE/PB Link and the SCALANCE X-208
switch module will be configured in the next exercises
• Get an overview of your network with the "NETPRO" Tool.

Exercise 8: Connecting the Conveyor Model, TP170 and MM420 to the
PROFINET Case
PROFIBUS DP

Task The conveyor model is now to be operated through the ET200S of the
PROFIBUS case with unchanged functionality and controlled via PROFINET.
Since the TP170B and the MM420 do not have a PROFINET interface, they
are networked with the CPU-2PN/DP via PROFIBUS DP.
What to Do 1. Connect the conveyor model to the PROFINET case (the SUB-D connector
is located on the back of the case) and turn on the conveyor model once
more using the "ON" pushbutton.
2. Connect the touchpanel and the MM420 with a PROFIBUS cable with the
CPU‘s DP interface.
3. Connect the Ethernet interface of the PG with any slot of the SCALANCE.

Exercise 9: Commissioning the PROFINET Case

Task The PROFINET case is to be inserted in the S7 project as an additional station.

In order to leave the hardware configuration of the old "S7_300_2DP Station"
unchanged, the MM420 in the hardware configuration of the new "S7_300_PN-
Station" is to be networked via the new, to be created, logical DP master
system PROFIBUS (2) (see slide).
What to Do 1. Copy the complete S7 program of the old "S7_300_2DP-Station" onto the
CPU of the new "S7_300_PN-Station" (the system data that is also copied
but does not fit will be overwritten when "Save and compile" is done on the
new station).
2. Create the hardware configuration of the new "S7_300_PN-Station" as
shown in the slide (the IE/PB Link and the SCALANCE do not have to be
configured).
3. Give the I/O modules of the ET200S the I/O addresses shown in the slide -
8 and 9 - or – if possible – via "Pack addresses" only the I/O address 8.
4. Create the DP master system "PROFIBUS (2)" and on it configure the
MM420 (since you are working with the new "DP-Mastersystem(2)", you
can adopt the address 6 of the MM420 unchanged).
5. Open the Hardware Configuration of the TP170B and logically network it
with the newly created "PROFIBUS(2)".
6. In the configuration of the TP170B, exchange in the connections the old
"S7_300_2DP-Station" for the new "S7_300_PN-Station".
7. Adapt – if necessary – the I/O conveyor addresses used in the S7 program
to the ET200S addresses using "Rewire".
8. Check all the functions of your system.
Result The system works with the new "S7_300_PN-Station" just like it did with the old
"S7_300_2DP-Station".

Maintenance

Contents Page
Objectives .......................................................................................................................................... 2
TeleService ...................................................................................................................................... 3
Product Support ................................................................................................................................. 4
Updating the CPU‘s Operating System (1) ........................................................................................ 5
Updating the CPU‘s Operating System (2) ........................................................................................ 6
STEP 7 goes Internet (1) .................................................................................................................. 7
STEP 7 goes Internet (2) .................................................................................................................. 8
Introducing the ServiceLab Software Package ................................................................................ 9
The Concept of ServiceLab .............................................................................................................. 10
Recording and Displaying Analog Signals with ServiceLab ............................................................ 11

Automation and Industrial Solutions Page 1 Maintenance
Objectives
... know how to upgrade the CPU‘s operating system,

... be familiar with Teleservice,
... know how to get information about SIMATIC from the Internet.


TeleService
SIMATIC PG/PC SIMATIC Controller SIMATIC Controller

SIEMENS
PG 740
V24 interface (port) MPI

using
TS Adapter Profibus/Ethernet
Modem Modem
Fixed or radio network

Area of Use By using SIMATIC TeleService, you can connect automation systems (S7/M7-
300/400 and C7-600) to the PG/PC using the telephone network.
By integrating the TeleService software (option package), you can have the
same STEP 7 functionality remotely as locally using the MPI connection. The
"extension of the MPI interface through the telephone network" enables you to
make error analysis, troubleshooting, startup and update/upgrade measures.
With TeleService it is possible to access a geographically distributed system.
The accessibility of further stations within an MPI subnet are supported.

Moreover, as of STEP 7 V5, stations that are connected to PROFIBUS or
Industrial Ethernet subnets can also be accessed using PG Routing.
Properties The following modems (Hayes compatible) are supported:

• analog modems (external modems with RS232 interface, internal modems
and PCMCIA cards)
• external ISDN adapter with RS232 interface
• external ISDN modems (combination device: analog modem and ISDN
adapter) with RS232 interface
• radio network with GSM technology (D1/D2).
The TeleService software carries out the configuration of the modem

connection. The interface speed can be up to 38.4kBits/sec.

Product Support

General Customer Support is there to support you in all your questions on automation
technology, SIMATIC for example.
Either call the Technical Support, or find current product information on the
Internet.
Hotline There are two types of Technical Support:

• Basic (free-of-charge, call returned according to workload, available
weekdays from 8:00 to 17:00, telephone: +49 (0) 180 5050-222) and
• Priority (charges apply, high priority response, available weekdays around
the clock, telephone: +49 (0) 180 5050 222).
Internet The Internet contains information that is divided into the following categories:
• Frequently Asked Questions (FAQs) - with the most frequently asked
questions and their answers,
• Tips and Tricks - with program examples, for example,
• Downloads - for downloading operating system updates, manuals etc., for
example,
• User information - with information on new products, module version states
etc.,
• Manuals - with a listing of the relevant manuals.
To get started use http://www.siemens.com/automation/service&support.

Updating the CPU‘s Operating System (1)

General The firmware (operating system) of the CPU can be upgraded when an update
is offered on the Internet.
Procedure • Select the homepage of Product Support on the Internet,

• navigate to Automation Systems Æ SIMATIC S7 Æ Central Modules
/ Compact Devices Æ S7-300/S7-300 Outdoor,
• in the window on the right click on "Downloads",
• select the appropriate entry for the update,
• trigger the download, by selecting the file (see 2),
• choose the directory in which the file is to be stored (see 3),
• double-click on the file that is downloaded and specify where the extracted
files are to be stored.

Updating the CPU‘s Operating System (2)
1 2

Prerequisite To produce a memory card for updating, you require:
• memory_card (2 MB Flash) with the order number 6ES7 952-1KL00-0AA0,

• STEP 7 software Version 3.1 or higher,
• PG or PC with external prommer for programming the memory card.
Memory Card • in the SIMATIC Manager, use the menu options PLC Æ Update Operating
System, (see 1)
• choose the directory in which the extracted files are to be stored (see 2),
• start the programming of the memory card by clicking the button "Öffnen"
(Open),
• wait for the message that states that the firmware update was transferred
successfully (see 3).
Carrying Out Update • switch off the rack‘s power supply in which the CPU is slotted,
• insert the memory card with the update,
• switch the power supply back on, the operating system is then transferred
from the memory card to the CPU (all LEDs on the CPU are illuminated),
• wait till the STOP LED flashes slowly,
• switch the power supply off and remove the memory card with the update
and insert (possibly) a memory card with the user program,
• switch the power supply on, carry out a memory reset and download the user
program, if no memory card exists,
• check to see whether the update was carried out by calling the "Module
Information" tool and checking the version in the "General" tab.

STEP 7 goes Internet (1)

Product Support You can display information on modules or components in the HW Config
Information directly through the Internet.
Requirements Your PG has an Internet connection and a browser to display Internet pages.
Information about the module is available (extent of information can vary
depending on the module or the time of the information search).
You have enabled the function in the settings of HW Config (menu options
Options Æ Customize) and have chosen a valid Internet page.
What to Do 1. Select the components in the Hardware Catalog or in the rack for which you
wish information.
2. Choose the menu options Help Æ Product Support Information
The Internet page you called up offers links to topics such as FAQs,
product information or manuals that are connected to the components you
selected.

STEP 7 goes Internet (2)
STEP 7 Hardware
Configuration
Internet
Symbolik
DB Parametrieren
Product Information System

Netze/Verbindungen

Hardware Update From STEP 7 V5.2 onward, you can install components for the Hardware
Catalog after the fact.
That way you have the opportunity to bring in individual components such as
new CPUs or new distributed peripheral devices in the current version of
STEP 7, without having to install a new service pack.
Concept In principle, the HW Update consists of two steps:

• Downloading the update from the Internet and/or copying from CD into the
selected folder.
• Installing the downloaded/copied HW Updates.
After that, the installed components exist in the Hardware Catalog in the Catalog
profile "Standard". If necessary, stations that were created with newer versions
of STEP 7 can be further edited in this manner.
Requirements A valid Internet address and a valid path for the local folder "HW Updates" has
to be set up. The settings can be installed in the dialog for the HW Update using
the "Settings" button.
To download HW Updates, you must have an Internet connection.
What to Do 1. Select the menu options Options Æ Install HW Updates.
2. In the follow-up dialog, you determine whether you want to download a HW
Update from the Internet or whether you want to copy a HW Update from a
CD or whether you want to install already downloaded updates (selection
possible).
3. Choose the components that are to be installed and click on the "Install"
button.

Introducing the ServiceLab Software Package
Module Function list
Module
list

Area of Application ServiceLab is a specially developed software for all users of SIMATIC S7(-300/-
400)/S5 PLCs. Through its direct connection to SIMATIC S7/S5 you have the
possibility of capturing, displaying and evaluating process data on your
programming device (PG), PC, or Notebook.
With ServiceLab, you can easily access all data that is stored in the process
images of the PLC and process, visualize and archive it.
In conjunction with TELESERVICE, ServiceLab is a powerful tool for remotely
monitoring a system and troubleshooting via modem.
With the additional AUTOSPY tool, a cycle-synchronous data recording is now

also possible.
ServiceLab can be connected to SIMATIC S7 either over the PROFIBUS / MPI

interface with a corresponding card (CP5511, CP 5611), or over the serial
interface with a corresponding transformation cable (PC-Adapter). The
connection to SIMATIC S5 can be done with a corresponding transformation
cable over the serial interface.
Its simple and intuitive user interface makes ServiceLab the ideal aid for
service, commissioning and permanent system monitoring.

The Concept of ServiceLab
ServiceLab has been designed for application in the following areas:
z Checking the operating patterns of systems and machines
z Capturing, checking, and evaluating process data from the

system/machine (troubleshooting)
z Permanent monitoring of system data
ServiceLab offers you the following features:

z Limit value monitoring of systems
z Data logging
z Time-controlled starting and stopping of measurement
z Long term measurements with easy evaluation without reams of paper
z Presentation of the transient response of regulating circuits in a diagram
z Linking of process data by mathematical or logical functions

Concept ServiceLab has been designed for application in the following areas:
• Checking the operating patterns of systems and machines
• Capturing, checking, and evaluating process data from the
system/machine(trouble shooting)
• Preparing measurement records for quality control
• Permanent monitoring of system data
ServiceLab offers you the following features:

• Monitoring limiting values of process data
• Data logging
• Time-controlled starting and stopping of measurement
• Long term measurements with easy evaluation without reams of paper
• Presentation of the transient response of regulating circuits in a diagram
• Recording of warnings
• Linking of process data by mathematical or logical functions
Additional Advantages:
• Recording, monitoring, and saving in real-time
• Various possibilities of monitoring
• Action-controlled measuring
• Quick and simple measuring arrangement with intuitive user guidance
• Various possibilities of evaluation
• Simple data exchange with EXCEL and other Windows programs
• Various archiving possibilities of process data, such as, in a ring buffer

Recording and Displaying Analog Signals with ServiceLab


Solutions

Siemens AG 2007. All rights reserved. File: SERV3_12D.1
Contents Page
Symbols .......................................................................................................................................... 2
Symbols (continuation) .................................................................................................................... 3
C3 E1: STOP Troubleshooting ....................................................................................................... 4
C3 E1-8: Commissioning user programm (OB1) ............................................................................ 5
C3 E1-8: Commissioning user programm (OB 86) ......................................................................... 6
C3 E2: Commissioning - Startup Program and Operating Mode Section (OB100) ........................ 7
C3 E2: Commissioning - Startup Program and Operating Mode Section (FC 15) .......................... 8
C3 E2: Commissioning - Startup Program and Operating Mode Section(TP-Programm) .............. 9
C3 E3: Commissioning - Checking the Weight (OB35).................................................................... 10
C3 E3: Commissioning - Checking the Weight (OB35).................................................................... 11
C3 E3: Commissioning - Checking the Weight (TP-Programm) ..................................................... 12
C3 E4: Commissioning - Controlling the Conveyor Motor (FC 16) ................................................. 13
C3 E4: Commissioning - Controlling the Conveyor Motor (TP-Programm) ..................................... 14
C3 E4: Commissioning - Controlling the Conveyor Motor (FC 16) ................................................. 15
C3 E5: Commissioning - Monitoring the Transport Functions (FC 17) ............................................ 16
C3 E5: Commissioning - Monitoring the Transport Functions (FC 17) ............................................ 17
C3 E6: Commissioning - Conveyor Model – Indicator Lights(FC 14)............................................... 18
C3 E6: Commissioning - Conveyor Model – Indicator Lights(FC 14) ............................................. 19
C3 E6: Commissioning - Conveyor Model – Indicator Lights(FC 14) .............................................. 20
C3 E7: Commissioning - Counting Parts and Statistics(FB 18) ...................................................... 21
C3 E7: Commissioning - Counting Parts and Statistics(FB 18) ....................................................... 22
C3 E7: Commissioning - Counting Parts and Statistics(FB 18) ....................................................... 23
C3 E7: Commissioning - Counting Parts and Statistics(FC 28) ....................................................... 24
C3 E7: Commissioning - Counting Parts and Statistics(FC 28) ...................................................... 25
C3 E7: Commissioning - Counting Parts and Statistics(FC 28) ...................................................... 26
C4 E1, 3: Replacing Traditional Counters with IEC Counters (FB 18) ............................................ 27
C5 E1: Part 1 - Storing Part Weight Values (FC 35) ........................................................................ 31
C7 E1: Part 2: Writing a User Message in the Diagnostic Buffer (FC 15)........................................ 32
C9 E5: Controlling the Drive via the TP170B (FC 42) ..................................................................... 33
C9 E5: Controlling the Drive via the TP170B (FC 42) .................................................................... 34
Trainings-Center ST-SERV3
for Automation and Drives Page 1 Solutions
Symbols
Symbols (continuation)
C3 E1: STOP Troubleshooting
STOP - Errors:
Error Break location Error location Correction
1 OB 1, Network 1 OB 1, Network 1 CALL FC 150 CALL FC 15
CALL FC 28 CALL FC 28
2 FB 18, Network 10 FB 18, Network 10
Thumbw: DBW 2 Thumbw: IW 2
CALL FC 105 CALL FC 105

3 OB 35, Network 1 OB 35, Network 1
IN: PIW 340 IN: PIW 304

Siemens AG 2007. All rights reserved. File: SERV3_12D.4
C3 E1-8: Commissioning user programm (OB1)
STOP-Error
CALL FC150 -> CALL FC 15
C3 E1-8: Commissioning user programm (OB 86)
C3 E2: Commissioning - Startup Program and Operating Mode Section
(OB100)
Logic- error
B#16#81 -> B#16#82
(FC 15)
Logic- error:
M 30.5 is always = 0,
Because of an error in the
TP-Progr.
(TP-Programm)
Logic-error:
Reset Bit -> set Bit
C3 E3: Commissioning - Checking the Weight (OB35)
STOP-Error
PIW 340 -> PIW 304
C3 E3: Commissioning - Checking the Weight (OB35)
Logic error
<=R -> >=R
C3 E3: Commissioning - Checking the Weight (TP-Programm)
Logic-error:
Total_Quant -> MW_Weight
C3 E4: Commissioning - Controlling the Conveyor Motor (FC 16)
Logic- error:
M 30.2 is always = 0,
Caused by an error in the
TP- Programm
C3 E4: Commissioning - Controlling the Conveyor Motor (TP-Programm)
Logical-error:
M_Conv_Jog_LEFT_HMI -> M_Conv_Jog_RIGHT_HMI
C3 E4: Commissioning - Controlling the Conveyor Motor (FC 16)
Logic- error:
O Q 4.3 -> ON Q 4.3
C3 E5: Commissioning - Monitoring the Transport Functions (FC 17)
Logic- error:
S5T#0MS -> S5T#6s
Logic- error:
M 33.3 -> M 33.1
(see the TP-Programm)
C3 E5: Commissioning - Monitoring the Transport Functions (FC 17)
Logic -error in FC 15:

MW 32, Bitnumber 1 = M 33.1 !!!
C3 E6: Commissioning - Conveyor Model – Indicator Lights(FC 14)
Logical- error:
O Q 4.3 -> ON Q 4.3
C3 E7: Commissioning - Counting Parts and Statistics(FB 18)
Logic- error:
>=1 -> &
STOP- error:
DBW 2 -> IW 2
C3 E7: Commissioning - Counting Parts and Statistics(FC 28)
C4 E1, 3: Replacing Traditional Counters with IEC Counters (FB 18)
C5 E1: Part 1 - Storing Part Weight Values (FC 35)
Logic- error:
+ 0 -> + 1
C7 E1 Part 2: Writing a User Message in the Diagnostic Buffer (FC 15)
Logic- error:
Word -> DWord
C9 E5: Controlling the Drive via the TP170B (FC 42)
C9 E5: Controlling the Drive via the TP170B (FC 42)
What´s Next?

Contents Page
Do You Still have Questions about Our Learning Offers? ............................................................. 2
... on the Internet under “www.siemens.com/sitrain“ .................................................................... 3
ST1 SIMATIC S7 Components for Totally Integrated Automation ............................................... 4
More Information on the Products ................................................................................................ 5
Product Support ........................................................................................................................... 6
Do you need service and support? .............................................................................................. 7
Access to expert know-how in the Service & Support portal ........................................................ 8
Communications in the Service & Support portal ......................................................................... 9
... just a few mouse clicks away from the required information 1/2 .............................................. 10
... just a few mouse clicks away from the required information 2/2 .............................................. 11

Automation and Industrial Solutions Page 1 What’s Next?
Do You Still have Questions about Our Learning Offers?
We‘ll help you!
... With the Infoline:

Tel 01805 23 56 11
Fax 01805 23 56 12
... On the Internet:

www.siemens.com/sitrain

General We‘ll be glad to help with any questions you may have about our course
selections.
... with the Infoline You are connected with a Training Center in your vicinity.
Tel. 01805 23 56 11
Fax 01805 23 56 12
... on the Internet www.siemens.com/sitrain
Learning Offers Through a simple Search or an extended Search, you will find the entire
spectrum of our current learning offers – from classroom courses, to distance
learning, to our online learning program.
Accessibe through the menu item "Training"
Partner Find your Training contact worldwide.
Accessible through the menu item "Partner"
Shop Ordering learning media and course registration worldwide with easy and fast
tools.
Accessible through the menu item "Shop"
Learning Paths Interactive learning paths simplify the search for the appropriate learning offer,
online tests determine your knowledge for a specific course.
Accessible through the menu item "Training" and "Learning Paths" in the left
Navigation
Learning The ordered Web-based Training are stored in the learning environment and
Environment are started from there.
Accessible through the menu item "Training" and "Learning Environment" in
the left Navigation

... on the Internet under “www.siemens.com/sitrain“
http://www.siemens.com/sitrain

... on the Internet www.siemens.com/sitrain
Simple Search Through the simple search and the expanded search, the entire spectrum of
Extended Search of our current learning offers unfolds – from classroom courses, to distance
learning, right up to the online learning program.
Learning Paths Interactive learning paths simplify the search for the appropriate learning offer,
online tests help to determine your knowledge for a particular course.
Learning In the learning environment, the web-based training you order is stored and it
Environment is started from there.
SITRAIN Campus Our portal for e-collaboration, e-communication and e-learning
Demo Versions Here you can test selected demo versions of our WBTs and refresher courses.

ST1 SIMATIC S7 Components for Totally Integrated Automation
Service Personnel and Engineers, Project Design Engineers, Decision Makers, Sales
Operators, Users Programming Engineers and Personnel and Project
Commissioning Engineers Managers, Project coworkers
SIMATIC TIA for non

PLC Basics
techician2)
ST-SSP704 2 Days ST-7TIAK 2 Days
e PLCs for Beginners e PLCs for Beginners

lin lin
On ntry1) (WBT) On ntry1) (WBT)
E st E st
Te Te
Micromaster 420 (WBT) Micromaster 420 (WBT)
SIMATIC S7 SIMATIC S7 ProductionAutomation

TIA Service Training 1 TIA Programming 1 with TIA 2)
ST-SERV1 5
ST-PRO1 5 Days ST-7TIA 4 Days
Days
e WinCC flexible (WBT)

lin
On ntry1)
E st PROFIBUS (WBT)
Te
SIMATIC S7
TIA Service Training 2
e WinCC flexible (WBT)
ST-SERV2 5 lin
On ntry1)
Days E st Micromaster 420 (WBT)
Te
SIMATIC S7
TIA Programming 2
e Industrial Ethernet
lin Further courses
On ntry1) (WBT)
ST-PRO2 5 Days
E st Theme Learning Path
Te WinCC flexible (WBT)
Communication SIMATIC S7 IK2+3
SIMATIC S7
TIA Service Training 3 SINUMERIK 810D/ NC5+10
Industrial Ethernet 840D/Positioning Modules
e
lin (WBT)
ST-SERV3 5 On ntry1) Drives SD2+3
Days E st WinCC flexible (WBT)
Te
Option Packages and Supple- ST6
SIMATIC S7 mentary Courses SIMATIC S7
Learning Path ST2
TIA Programming 3
Closed-loop Control ST8
SIMATIC S7
ST-PRO3 5 Days
SIMATIC WinCC and ST15
Learning Path ST4 SIMATIC ProTool/Pro
1) Check your entry requirements online under www.sitrain.com SIMATIC WinCC flexible
2) Course at the moment not available in English


More Information on the Products
www.siemens.com/sitrain

... on the Internet www.siemens.com/ad
You will find more information on the products on this page under "Our Offer"
Æ "Products".

Product Support

General Information Customer Support is there to help you with all your questions on Automation,
such as, SIMATIC.
Either call the hotline, or get the current product information on the Internet.
Internet On the Internet you‘ll find all the information divided into the following
categories:
• Frequently Asked Questions (FAQs) with the most frequently asked
questions and their answers,
• Tips and Tricks with program examples, for example
• Downloads, such as operating system updates, manuals, etc.,
• User information with information on new products, module versions etc.,
• Manuals with listings of relevant manuals.
As the start page use http://www.siemens.com/sitrain. After selecting "Link

Box" Æ Register "Support" Æ "Product Support" you‘ll get to the Customer
Support page.

Do you need service and support?
http://www.siemens.com/automation/service&support

Under www.siemens.com/automation/service&support the Service & Support portal offers online

access to the wide range of information and services regarding the Automation & Drives portfolio
whenever required.
Online support is divided into two principle topics:
Expertise - Product support:

Technical information and downloads for products
(manuals, FAQs, software updates, etc.)
- Applications and tools:
Automation solutions
(solution examples, system descriptions, demo versions, calculators, tools
etc.)
- Services:
Information on wide range of services offered
by Service & Support (contacts, repairs etc.)
Communications - Forum:
Direct customer - customer communications in case of technical questions
Support request:
- Technical requests are answered by experts

Access to expert know-how in the Service & Support portal
Product support
Services and information
Technical information and
downloads for products Information on range of
services offered by A&D
Applications & Tools
Information on
automation solutions

General The online support with its comprehensive information system and many types
of services is available around the clock. From product support over service
information to interactive services, online support is always your first step you
need to take for obtaining a quick solution.
Product Support Profound expertise in our products and systems and up-to-date information are
the Product Support's support know-how basis in form of FAQs, downloads of,
for example, updates / upgrades, up-to-date product information from Marketing
& Sales, manuals in electronic form in PDF format, test certificates and
characteristics
Applications & Tools Applications & Tools is the new platform for solutions and system overviews in
the Service & Support portal. Applications & Tools help you solve your
automation tasks. This support is provided in the form of programming examples
and tools, background knowledge, functional descriptions, recommendations on
possible actions, performance data etc. The focus is not on the individual
product but rather on the individual products working together.
Services Here you can find our complete range of services and detailed information on
our Service & Support processes and a database containing the contact
persons.
Information Are you looking for the latest Service & Support brochures - or do you want to
know at which trade show you can meet us personally? All of this and much
more can be found under "Information".

Communications in the Service & Support portal
Technical Forum
Discussion platform for
customers
Support Request
Online requests to the A&D
hotline

Technical Forum In addition to the comprehensive scope of services, we support the direct dialog
among experts with the help of modern web technology. The new Technical
Forum is an attractive discussion platform (English and German) where users
and experts can exchange information.
Support Request With the online Support Request you will always find direct answers to your
questions. In the online screens you can describe your requests. Through the
knowledge base you will immediately be informed about possible solutions. If
the suggested solution does not resolve your problem, you can send the web
form direct to your team of experts in Technical Support (Hotline).

... just a few mouse clicks away from the required information 1/2
A clearly structured, user-friendly navigation in a

"Product tree" or an Index
An intelligent,
comprehensive
Search function

To find the required information, you can use the intelligent Search function and a
the user-friendly navigation:
Search An intelligent and comprehensive search function provides you with the relevant
results.
- Automatic recognition of key words

- Automatic spellcheck
- Automatic sorting of the hitlist based on topicality
Navigation You can also do a targeted search in the product tree to obtain
the required information. Use the index for easy selection of the product.

... just a few mouse clicks away from the required information 2/2
Registering permits / facilitates the following functions:

Forum: You can mail forum articles to the Technical Forum
Newsletter: Always up-to-date thanks to daily news on pre-selected topics
myTree: Define your personal, more transparent product tree
Personal data is automatically filled

in forms, e.g. in the
Support Request

Registration After registering with our service "mySupport", you can utilize our complete
range of online services after entering your data only once.
You will then have exclusive access to the following functions:
Your personal newsletter

Through the Automation and Drives Newsletter system you receive daily, up-to-
date news on selected topics - sent direct to your mailbox. As a mySupport
user, you can individually adjust the mailing options.
myTree Your personal product tree. As a mySupport user, you can adjust the product
tree so that it only shows those products and services from the comprehensive
A&D range that are important to you.
Thus you can always maintain an overview and find the required information
faster.
Online Support Request

You need to enter your personal data only once and they will be automatically
entered in the Support Request forms. You don't have to repeatedly enter the
same information in every form which saves you time for more important things.
myForum Direct access to our Technical Forum. As mySupport user you also
automatically have direct access to our Technical Forum


ST-SERV3 V58 en

Uploaded by

Copyright:

Available Formats

ST-SERV3 V58 en

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ST-SERV3 V58 en

Uploaded by

Copyright:

Available Formats

1.

Training Units and Addressing

Information and Training 2. Hardware Commissioning

4. Functions, Function Blocks and

Course: from ____________ to ____________ 13. What´s Next ?

Infoline Tel: 01805 23 56 11 14.

Version V5.8 (for STEP7 V 5.3) 15.

SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

SITRAIN Training for ST-SERV3

SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

SITRAIN Training for ST-SERV3

Module --> PS CPU DI 32 DO 32 DI8/DO8 AI 2

Slot No. --> 1 2 4 5 6 7

I/O Address --> 0 4 8 304

SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

Configuration The programmable controller is configured with the following modules:

Slot 1: Power Supply 24V/5A

SITRAIN Training for ST-SERV3

Switches LEDs Thumbwheel Buttons

SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

• Binary section with 16 switches / momentary contact switches and 16 LEDs

• Digital section with 4 thumbwheel buttons and a digital display. The

Sensor / Actuator (DI32, DO32)

Analog channels PIW 304/306

SITRAIN Training for ST-SERV3

"K_Conv_RIGHT" (Q 8.5) "BAY1" "BAY2" "BAY3" "LB" "Horn"

"T_Bay1" "T_Bay2" "T_Bay3" "T_Bay-LB"

SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

SITRAIN Training for ST-SERV3

SITRAIN Training for ST-SERV3

SITRAIN Training for ST-SERV3

SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

SITRAIN Training for ST-SERV3

SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

Contents of the The training area consists of the following components:

SITRAIN Training for ST-SERV3

SIMATIC S7 Date: 13.06.2007 SITRAIN Training for

Configuration The UR 1 rack is configured with the following modules:

SITRAIN Training for ST-SERV3

SIMATIC S7 Date: 13.06.2007

SITRAIN Training for ST-SERV3

Upon completion of the chapter the participant will ...

… be able to establish an online connection to the controller

SIMATIC S7 Date: 13.06.2007

SITRAIN Training for ST-SERV3

• Perform a CPU memory reset.

• Carry out a CPU warm restart.

• Check the LEDs on the modules.

• Start the SIMATIC Manager.

• Configure the hardware.

• Check inputs using the Monitor/Modify Variable tool.

• Check outputs using Modify Outputs.

SIMATIC S7 Date: 13.06.2007

SITRAIN Training for ST-SERV3

I 1.0 I 1.1 Q4.0

SIMATIC S7 Date: 13.06.2007

Project In SIMATIC® S7 all the hardware and software requirements of an automation

SITRAIN Training for ST-SERV3

SIMATIC S7 Date: 13.06.2007

Course: from to 13. What´s Next ?