S7 1200 Manual
S7 1200 Manual
S7 1200 Manual
SIMATIC
S7-1200 Programmable controller
Product overview
Installation
PLC concepts
Device configuration
Programming concepts
Programming instructions
PROFINET
Point-to-Point (PtP)
communications
Technical specifications
Order numbers
System Manual
Product Information
Drawing number
Edition
A5E02573237-01
05/2009
6ES7298-8FA30-8BH0
05/2009
A5E02486680-01
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
with a safety alert symbol, indicates that minor personal injury can result if proper precautions are not taken.
CAUTION
without a safety alert symbol, indicates that property damage can result if proper precautions are not taken.
NOTICE
indicates that an unintended result or situation can occur if the corresponding information is not taken into
account.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The device/system may only be set up and used in conjunction with this documentation. Commissioning and
operation of a device/system may only be performed by qualified personnel. Within the context of the safety notes
in this documentation qualified persons are defined as persons who are authorized to commission, ground and
label devices, systems and circuits in accordance with established safety practices and standards.
Trademarks
All names identified by are registered trademarks of the Siemens AG. The remaining trademarks in this
publication may be trademarks whose use by third parties for their own purposes could violate the rights of the
owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
Siemens AG
Industry Sector
Postfach 48 48
90026 NRNBERG
GERMANY
A5E02486680-01
05/2009
Preface
Purpose of the manual
The S7-1200 series is a line of programmable logic controllers (PLCs) that can control a
variety of automation applications. Compact design, low cost, and a powerful instruction set
make the S7-1200 a perfect solution for controlling a wide variety of applications. The S71200 models and the Windows-based programming tool give you the flexibility you need to
solve your automation problems.
This manual provides information about installing and programming the S7-1200 PLCs and
is designed for engineers, programmers, installers, and electricians who have a general
knowledge of programmable logic controllers.
Preface
Table of contents
Preface ...................................................................................................................................................... 3
1
1.2
1.3
1.4
1.5
1.5.1
1.5.2
1.6
Display panels..............................................................................................................................17
Installation ............................................................................................................................................... 19
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2
Wiring guidelines..........................................................................................................................30
3.2
3.3
3.4
3.4.1
3.4.2
3.4.3
Inserting a CPU............................................................................................................................66
4.2
4.3
4.4
4.5
4.6
Table of contents
5.2
5.3
6.2
6.2.1
6.2.2
6.2.2.1
6.2.2.2
6.2.3
6.2.3.1
6.2.3.2
6.2.3.3
6.2.4
6.2.4.1
6.2.4.2
6.2.4.3
6.2.5
6.2.5.1
6.2.5.2
6.2.5.3
6.2.6
6.2.7
6.2.8
Table of contents
6.2.8.1
CTRL_PWM instruction..............................................................................................................179
6.3
6.3.1
6.3.1.1
6.3.1.2
6.3.1.3
6.3.1.4
6.3.1.5
6.3.1.6
6.3.2
6.3.2.1
6.3.2.2
6.3.2.3
7.2
7.2.1
HMI-to-PLC communication.......................................................................................................228
Configuring the logical network connections between an HMI and a CPU ...............................229
7.3
7.3.1
7.3.2
7.3.2.1
7.3.2.2
7.4
7.4.1
7.4.2
8.2
8.3
8.4
8.5
8.5.1
8.6
8.6.1
8.6.2
8.6.3
8.6.4
8.6.5
8.6.6
8.6.7
8.6.8
Table of contents
8.6.9
8.7
Errors......................................................................................................................................... 274
9.2
9.3
9.4
9.5
9.6
9.7
A.2
A.2.1
A.2.2
A.2.3
A.3
A.3.1
A.3.2
A.3.3
A.4
A.4.1
A.5
A.5.1
A.5.2
A.6
A.6.1
A.6.2
A.7
A.8
B.2
Product overview
1.1
PROFINET connector
The different CPU models provide a diversity of features and capabilities that help you create
effective solutions for your varied applications. For detailed information about a specific
CPU, see the technical specifications (Page 289).
Product overview
1.1 Introducing the S7-1200 PLC
Feature
CPU 1211C
90 x 100 x 75
User memory
Work memory
Load memory
Retentive memory
25 Kbytes
1 Mbyte
2 Kbytes
6 inputs/4 outputs
2 inputs
None
Signal board
Communication modules
3 (left-side expansion)
High-speed counters
Single phase
Quadrature phase
CPU 1212C
CPU 1214C
110 x 100 x 75
8 inputs/6 outputs
2 inputs
50 Kbytes
2 Mbytes
2 Kbytes
14 inputs/10 outputs
2 inputs
3 at 100 kHz
3 at 80 kHZ
3 at 100 kHz
1 at 30 kHz
3 at 80 kHz
1 at 20 kHz
Pulse outputs
Memory card
PROFINET
18 s/instruction
0.1 s/instruction
3 at 100 kHz
3 at 30 kHz
3 at 80 kHz
3 at 20 kHz
The S7-1200 family provides a variety of signal modules and signal boards for expanding the
capabilities of the CPU. You can also install additional communication modules to support
other communication protocols. For detailed information about a specific module, see the
technical specifications (Page 289).
Module
Signal module
(SM)
Digital
Analog
Signal board
(SB)
Input only
Output only
Combination in/out
8 x DC In
8 x DC Out
8 x Relay Out
8 x DC In/8 x DC Out
8 x DC In/8 x Relay Out
16 x DC In
16 x DC Out
16 x Relay Out
16 x DC In/16 x DC Out
16 x DC In/16 x Relay Out
4 x Analog In
2 x Analog Out
Digital
Analog
1 x Analog Out
2 x DC In/2 x DC Out
-
10
Product overview
1.2 Signal boards
1.2
Signal boards
A signal board (SB) allows you to add I/O to your CPU. You can add one SB with either
digital or analog I/O. A SB connects on the front of the CPU.
SB with 4 digital I/O (2 x DC inputs and 2 x DC outputs)
SB with 1 analog output
1.3
Signal modules
You can use signal modules to add additional functionality to the CPU. Signal modules
connect to the right side of the CPU.
Bus connector
11
Product overview
1.4 Communication modules
1.4
Communication modules
The S7-1200 family provides communication modules (CMs) for additional functionality to
the system. There are two communication modules: RS232 and RS485.
The CPU supports up to 3 communication modules
Each CM connects to the left side of the CPU (or to the left side of another CM that is
connected to the CPU)
1.5
Communication connector
12
Product overview
1.5 TIA Portal software
1.5.1
13
Product overview
1.5 TIA Portal software
1.5.2
Information system
The TIA portal provides a comprehensive online information and help system that describes
all of the SIMATIC TIA products that you have installed. The information system also
includes reference information and examples. To display the information system, choose
from the following access points:
From the Portal view, select the Start portal and click the "Help" command.
From the Project view, select the "Show help" command in the "Help" menu.
From a cascading tool tip, click a link to display more information about that topic.
The information system opens in a window that does not obscure the work areas.
14
Product overview
1.5 TIA Portal software
Click the "Show/hide contents" button on the information system to display the contents and
undock the help window. You can then resize the help window. Use the "Contents" or
"Index" tabs to search through the information system by topic or by key word.
Help window (default)
Note
If the TIA Portal application is maximized, clicking the "Show/hide contents" button does not
undock the help window. Click the "Restore down" button on the TIA Portal to undock the
help window. You can then move and resize the help window.
15
Product overview
1.5 TIA Portal software
The "Print" dialog allows you to select the topics to print. Make certain that the panel displays
a topic. You can then select any other topic to print. Click the "Print" button to send the
selected topics to your printer.
16
Product overview
1.6 Display panels
1.6
Display panels
As visualization becomes a standard component for most machine designs, the SIMATIC
HMI Basic Panels provide touch-screen devices for basic operator control and monitoring
tasks.
Feature
Display
Size
Resolution
Control elements
Touch screen
Protection rating
IP65
IP65
Interface
PROFINET
PROFINET
Functionality
Tags
Process screens
Alarms
Trend curves
256
50
200
25
256
50
200
25
Dimensions (mm)
Housing front (W x H x D)
Mounting cut-out (W x H)
335 x 275 x 61
310 x 248
17
Product overview
1.6 Display panels
18
Installation
The S7-1200 equipment is designed to be easy to install. You can install an S7-1200 either
on a panel or on a standard rail, and you can orient the S7-1200 either horizontally or
vertically. The small size of the S7-1200 allows you to make efficient use of space.
WARNING
The SIMATIC S7-1200 PLCs are Open Type Controllers. It is required that you install the
S7-1200 in a housing, cabinet, or electric control room. Entry to the housing, cabinet, or
electric control room should be limited to authorized personnel.
Failure to follow these installation requirements could result in death, severe personal injury
and/or property damage.
Always follow these requirements when installing S7-1200 PLCs.
Separate the S7-1200 devices from heat, high voltage, and electrical noise
As a general rule for laying out the devices of your system, always separate the devices that
generate high voltage and high electrical noise from the low-voltage, logic-type devices such
as the S7-1200.
When configuring the layout of the S7-1200 inside your panel, consider the heat-generating
devices and locate the electronic-type devices in the cooler areas of your cabinet. Reducing
the exposure to a high-temperature environment will extend the operating life of any
electronic device.
Consider also the routing of the wiring for the devices in the panel. Avoid placing low-voltage
signal wires and communications cables in the same tray with AC power wiring and highenergy, rapidly-switched DC wiring.
19
Installation
1.6 Display panels
When planning your layout for the S7-1200 system, allow enough clearance for the wiring
and communications cable connections.
PP
PP
PP
Side view
Vertical installation
Horizontal installation
Clearance area
Power budget
Your CPU has an internal power supply that provides power for the CPU, the signal
modules, signal board and communication modules and for other 24 VDC user power
requirements.
Refer to the technical specifications (Page 289) for information about the 5 VDC logic budget
supplied by your CPU and the 5 VDC power requirements of the signal modules, signal
board, and communication modules. Refer to the "Calculating a power budget" (Page 329) to
determine how much power (or current) the CPU can provide for your configuration.
The CPU provides a 24 VDC sensor supply that can supply 24 VDC for input points, for relay
coil power on the signal modules, or for other requirements. If your 24 VDC power
requirements exceed the budget of the sensor supply, then you must add an external 24
VDC power supply to your system. Refer to the technical specifications (Page 289) for the 24
VDC sensor supply power budget for your particular S7-1200 CPU.
If you require an external 24 VDC power supply, ensure that the power supply is not
connected in parallel with the sensor supply of the CPU. For improved electrical noise
protection, it is recommended that the commons (M) of the different power supplies be
connected.
20
Installation
1.6 Display panels
WARNING
Connecting an external 24 VDC power supply in parallel with the 24 VDC sensor supply
can result in a conflict between the two supplies as each seeks to establish its own
preferred output voltage level.
The result of this conflict can be shortened lifetime or immediate failure of one or both
power supplies, with consequent unpredictable operation of the PLC system. Unpredictable
operation could result in death, severe personal injury and/or property damage.
The DC sensor supply and any external power supply should provide power to different
points.
Some of the 24 VDC power input ports in the S7-1200 system are interconnected, with a
common logic circuit connecting multiple M terminals. For example, the following circuits are
interconnected when designated as "not isolated" in the data sheets: the 24 VDC power
supply of the CPU, the power input for the relay coil of an SM, or the power supply for a nonisolated analog input. All non-isolated M terminals must connect to the same external
reference potential.
WARNING
Connecting non-isolated M terminals to different reference potentials will cause unintended
current flows that may cause damage or unpredictable operation in the PLC and any
connected equipment.
Failure to comply with these guidelines could cause damage or unpredictable operation
which could result in death or serve personal injury and/or property damage.
Always ensure that all non-isolated M terminals in an S7-1200 system are connected to the
same reference potential.
21
Installation
2.1 Installation and removal procedures
2.1
%
S7-1200 Devices
CPUs:
Signal modules:
Width A
Width B
90 mm
45 mm
CPU 1214C
110 mm
55 mm
45 mm
22.5 mm
70 mm
35 mm
30 mm
15 mm
The CPUs, SMs and CMs support DIN rail mounting and panel mounting. Use the DIN rail
clips on the module to secure the device on the rail. These clips also snap into an extended
position to provide screw mounting positions to mount the unit directly on a panel. The
interior dimension of the hole for the DIN clips on the device is 4.3 mm.
A 25 mm thermal zone must be provided above and below the unit for free air circulation.
22
Installation
2.1 Installation and removal procedures
Panel installation
Before you install or remove any electrical device, ensure that the power to that equipment
has been turned off. Also, ensure that the power to any related equipment has been turned
off.
WARNING
Installation or removal of S7-1200 or related equipment with the power applied could cause
electric shock or unexpected operation of equipment.
Failure to disable all power to the S7-1200 and related equipment during installation or
removal procedures could result in death, severe personal injury and/or property damage
due to electric shock or unexpected equipment operation.
Always follow appropriate safety precautions and ensure that power to the S7-1200 is
disabled before attempting to install or remove S7-1200 CPUs or related equipment.
Always ensure that whenever you replace or install an S7-1200 device you use the correct
module or equivalent device.
WARNING
Incorrect installation of an S7-1200 module may cause the program in the S7-1200 to
function unpredictably.
Failure to replace an S7-1200 device with the same model, orientation, or order could result
in death, severe personal injury and/or property damage due to unexpected equipment
operation.
Replace an S7-1200 device with the same model, and be sure to orient and position it
correctly.
23
Installation
2.1 Installation and removal procedures
2.1.1
Installation
You can install the CPU on a panel or on a DIN rail.
Note
Attach any communication modules to the CPU and install the assembly as a unit. Install
signal modules separately after the CPU has been installed.
To mount the CPU on a panel, follow these steps:
1. Locate, drill, and tap the mounting holes (M4 or American Standard number 8), using the
dimensions shown in the mounting dimensions.
2. Extend the mounting clips from the module. Make sure the DIN rail clips on the top and
bottom of the CPU are in the extended position.
3. Secure the module to the panel, using screws placed into the clips.
Note
If your system is subject to a high vibration environment, or is mounted vertically, panel
mounting the S7-1200 will provide a greater level of protection.
1.
2.
3.
4.
5.
24
Install the DIN rail. Secure the rail to the mounting panel every 75 mm.
Hook the CPU over the top of the DIN rail.
Pull out the DIN rail clip on the bottom of the CPU to allow the CPU to fit over the rail.
Rotate the CPU down into position on the rail.
Push in the clips to latch the CPU to the rail.
Installation
2.1 Installation and removal procedures
Removal
To prepare the CPU for removal, remove power from the CPU and disconnect the I/O
connectors, wiring, and cables from the CPU. Remove the CPU and any attached
communication modules as a unit. All signal modules should remain installed.
2.1.2
Installation
Install your SM after installing the CPU.
Remove the cover for the connector from the right side of the CPU.
Insert a screwdriver into the slot above the cover.
Gently pry the cover out at its top and remove the cover. Retain the cover for reuse.
Position the SM beside the CPU.
1. Hook the SM over the top of the DIN rail.
2. Pull out the bottom DIN rail clip to allow the SM to fit
over the rail.
3. Rotate the SM down into position beside the CPU
and push the bottom clip in to latch the SM onto the
rail.
25
Installation
2.1 Installation and removal procedures
Extend the bus connector.
1. Place a screwdriver beside the tab on the top of the
SM.
2. Slide the tab fully to the left to extend the bus
connector into the CPU.
Extending the bus connector makes both mechanical
and electrical connections for the SM.
Removal
You can remove any SM without removing the CPU or other SMs in place. To prepare for
removing the SM, remove power from the CPU and remove the I/O connectors and wiring
from the SM.
Retract the bus connector.
1. Place a screwdriver beside the tab
on the top of the SM.
2. Press down to disengage the
connector from the CPU.
3. Slide the tab fully to the right.
If there is another SM to the right, repeat this procedure for that SM.
Remove the SM:
1. Pull out the bottom DIN rail clip to release the SM
from the rail.
2. Rotate the SM up and off the rail. Remove the SM
from the system.
3. If required, cover the bus connector on the CPU to
avoid contamination.
26
Installation
2.1 Installation and removal procedures
2.1.3
Installation
Attach the CM to the CPU before installing the assembly as a unit to the DIN rail or panel.
Remove the bus cover from the left side of the CPU:
1. Insert a screwdriver into
the slot above the bus
cover.
2. Gently pry out the cover
at its top.
27
Installation
2.1 Installation and removal procedures
Removal
Remove the CPU and CM as a unit from the DIN rail or panel.
Prepare for CM removal.
1. Remove power from the CPU.
2. Remove the IO connectors and all wiring and cables
from the CPU and CMs.
3. For DIN rail mounting, move the lower DIN rail clips
on the CPU and CMs to the extended position.
4. Remove the CPU and CMs from the DIN rail or
panel.
Remove the CM.
1. Grasp the CPU and CMs firmly.
2. Pull them apart.
Do not use a tool to separate the modules because this
will damage the units.
2.1.4
Installation
Prepare the CPU for installation of the SB by removing the power from the CPU and
removing the top and bottom terminal block covers from the CPU.
To install the SB, follow these steps:
1. Place a screwdriver into the slot
on top of the CPU at the rear of
the cover.
2. Gently pry the cover up and
remove it from the CPU.
3. Place the SB straight down into its
mounting position in the top of the
CPU.
4. Firmly press the SB into position
until it snaps into place.
5. Replace the terminal block covers.
28
Installation
2.1 Installation and removal procedures
Removal
Prepare the CPU for removal of the SB by removing power from the CPU and removing the
top and bottom terminal block covers from the CPU.
To remove the SB, follow these
steps:
1. Place a screwdriver into the slot
on top of the SB.
2. Gently pry the SB up to disengage
it from the CPU.
3. Remove the SB straight up from
its mounting position in the top of
the CPU.
4. Replace the SB cover.
5. Replace the terminal block covers.
2.1.5
29
Installation
2.2 Wiring guidelines
2.2
Wiring guidelines
Proper grounding and wiring of all electrical equipment is important to help ensure the
optimum operation of your system and to provide additional electrical noise protection for
your application and the S7-1200. Refer to the technical specifications (Page 289) for the
S7-1200 wiring diagrams.
Prerequisites
Before you ground or install wiring to any electrical device, ensure that the power to that
equipment has been turned off. Also, ensure that the power to any related equipment has
been turned off.
Ensure that you follow all applicable electrical codes when wiring the S7-1200 and related
equipment. Install and operate all equipment according to all applicable national and local
standards. Contact your local authorities to determine which codes and standards apply to
your specific case.
WARNING
Installation or wiring the S7-1200 or related equipment with power applied could cause
electric shock or unexpected operation of equipment. Failure to disable all power to the S71200 and related equipment during installation or removal procedures could result in death,
severe personal injury, and/or damage due to electric shock or unexpected equipment
operation.
Always follow appropriate safety precautions and ensure that power to the S7-1200 is
disabled before attempting to install or remove the S7-1200 or related equipment.
Always take safety into consideration as you design the grounding and wiring of your S71200 system. Electronic control devices, such as the S7-1200, can fail and can cause
unexpected operation of the equipment that is being controlled or monitored. For this reason,
you should implement safeguards that are independent of the S7-1200 to protect against
possible personal injury or equipment damage.
30
Installation
2.2 Wiring guidelines
WARNING
Control devices can fail in an unsafe condition, resulting in unexpected operation of
controlled equipment. Such unexpected operations could result in death, severe personal
injury and/or property damage.
Use an emergency stop function, electromechanical overrides, or other redundant
safeguards that are independent of the S7-1200.
31
Installation
2.2 Wiring guidelines
32
Installation
2.2 Wiring guidelines
Output point
Be sure to size your Zener diode properly for the amount of current in your output circuit.
Relay outputs that control AC loads
When you use a relay output to switch 115 V/230
VAC loads, place resistor/capacitor networks
across the AC load as shown in this figure. You
can also use a metal oxide varistor (MOV) to limit
peak voltage. Ensure that the working voltage of
the MOV is at least 20% greater than the nominal
line voltage.
MOV
0.1 F
100 to 120
Output point
33
Installation
2.2 Wiring guidelines
34
PLC concepts
3.1
35
PLC concepts
3.1 Execution of the user program
Hardware interrupt OBs execute when the relevant hardware event occurs, including
rising and falling edges on built-in digital inputs and HSC events. A hardware interrupt OB
will interrupt normal cyclic program execution in reaction to a signal from a hardware
event. You define the events in the properties of the hardware configuration. One OB is
allowed for each configured hardware event. The OB must be OB 200 or greater.
Time-error interrupt OBs execute when a time error is detected. A time error interrupt OB
will interrupt normal cyclic program execution if the maximum cycle time has been
exceeded. The maximum cycle time is defined in the properties of the PLC. OB 80 is the
only OB number supported for the time error event. You can configure the action to take
when no OB 80 is present: either ignore the error or change to STOP.
Diagnostic error interrupt OBs execute when a diagnostic error is detected and reported.
A diagnostic OB interrupts the normal cyclic program execution if a diagnostics-capable
module recognizes an error (if the diagnostic error interrupt has been enabled for the
module). OB 82 is the only OB number supported for the diagnostic error event. If there is
no diagnostic OB in the program, you can configure the CPU to either ignore the error or
to change to STOP.
36
PLC concepts
3.1 Execution of the user program
The CPU performs the following tasks:
The CPU reads the physical inputs just prior to the execution of the user program and
stores the input values in the process image input area. This ensures that these values
remain consistent throughout the execution of the user instructions.
The CPU executes the logic of the user instructions and updates the output values in the
process image output area instead of writing to the actual physical outputs.
After executing the user program, the CPU writes the resulting outputs from the process
image output area to the physical outputs.
This process provides consistent logic through the execution of the user instructions for a
given cycle and prevents the flickering of physical output points that might change state
multiple times in the process image output area.
You can change the default behavior for a module by removing it from this automatic update
of I/O. You can also immediately read and write digital and analog I/O values to the modules
when an instruction executes. Immediate reads of physical inputs do not update the process
image input area. Immediate writes to physical outputs update both the process image
output area and the physical output point.
The CPU performs a warm restart before going to RUN mode. Warm restart resets all nonretentive memory to the default start vales, but retains the current values stored in the
retentive memory.
Note
The CPU always performs a cold restart after a download
Whenever you download an element of your project (such as a program block, data block, or
hardware configuration), the CPU performs a cold restart on the next transition to RUN
mode. In addition to clearing the inputs, initializing the outputs and clearing the non-retentive
memory, the cold restart also clears the retentive memory areas.
After the cold restart that follows a download, all subsequent STOP-to-RUN transitions
perform a warm restart (that does not clear the retentive memory).
37
PLC concepts
3.1 Execution of the user program
3.1.1
You can change the current operating mode using the "STOP" or "RUN" commands from the
online tools of the programming software. You can also include a STP instruction in your
program to change the CPU to STOP mode. This allows you to stop the execution of your
program based on the program logic.
In STOP mode, the CPU handles any communication requests (as
appropriate) and performs self-diagnostics.
In STOP mode, the CPU does not execute the user program, and the
automatic updates of the process image do not occur.
You can download your project only when the CPU is in STOP mode.
In RUN mode, the CPU performs the tasks shown in the following figure.
38
PLC concepts
3.1 Execution of the user program
&
'
STARTUP
RUN
STARTUP processing
Whenever the operating state changes from STOP to RUN, the CPU clears the process
image inputs, initializes the process image outputs, and processes the startup OBs.
(Therefore, any read accesses to the process-image inputs by instructions in the startup OBs
will read zero rather than the current physical input value.) To read the current state of a
physical input during the startup mode, you must perform an immediate read. The startup
OBs and any associated FCs and FBs are executed next. If more than one startup OB
exists, each is executed in order according to the OB number, with the lowest OB number
executing first.
The CPU also performs the following tasks during the startup processing.
Interrupts are queued but not processed during the startup phase
No cycle time monitoring is performed during the startup phase
Configuration changes to HSC (high-speed counter), PWM (pulse-width modulation), and
PtP (point-to-point communication) modules can be made in startup
Actual operation of HSC, PWM and point-to-point communication modules only occurs in
RUN
After the execution of the startup OBs finishes, the CPU goes to RUN mode and processes
the control tasks in a continuous scan cycle.
39
PLC concepts
3.1 Execution of the user program
Each scan cycle begins by retrieving the current values of the digital and analog outputs
from the process image and then writing them to the physical outputs of the CPU, SB, and
SM modules configured for synchronous update (default configuration).
If a CPU, SB, or SM module has been excluded from the automatic I/O update, then its
outputs are not copied from the process image. Outputs that are selectively excluded from
the I/O update may be accessed during execution of the user program using immediate
addressing to access the physical outputs. When a physical output is accessed by an
instruction, both the output process image and the physical output itself are updated.
The scan cycle continues by reading the current values of the digital and analog inputs from
the CPU, SB, and SMs configured for synchronous update (default configuration), and then
writing these values to the process image.
If a CPU, SB, or SM module has been excluded from the synchronous update, then its inputs
are not copied into the process image. Inputs that are selectively excluded from the I/O
update may be accessed using immediate addressing to access the physical inputs. When a
physical input is accessed by an instruction, the value of the physical input is accessed by
the instruction, but the input process image is not updated.
After reading the inputs, the user program is executed from the first instruction through the
end instruction. This includes all the program cycle OBs plus all their associated FCs and
FBs. The program cycle OBs are executed in order according to the OB number with the
lowest OB number executing first.
During the communications processing step of the scan cycle, messages that have been
received are processed. Completed responses are set aside for transfer to the
communications requester at the appropriate time.
Self-diagnostic checks include periodic checks of the firmware and the user program
memory as well as I/O module status checks.
Interrupts can occur during any part of the scan cycle, and are event-driven. When an event
occurs, the CPU interrupts scanning and calls the OB that was configured to process that
event. After the OB finishes processing the event, the CPU resumes execution of the user
program at the point of interruption.
3.1.2
40
PLC concepts
3.1 Execution of the user program
Each CPU event has an associated priority, and the event priorities are classified into priority
groups. The following table summarizes the queue depths, priority groups and priorities for
the supported CPU events.
Note
You cannot change the priority or the priority group assignments or the queue depths.
In general, events are serviced in order of priority (highest priority first). Events of the same
priority are serviced on a "first-come, first-served" basis.
Event Type (OB)
Quantity
Valid OB
Numbers
Queue
Depth
Priority
Group
1
Priority
Program Cycle
1 (default)
200 or greater
Startup
1 startup event 1
Multiple OBs allowed
100 (default)
200 or greater
Time Delay
200 or greater
Cyclic
4 cyclic events
1 OB per event
200 or greater
Edges
200 or greater
32
HSC
6 CV = PV events
6 direction changed events
6 external reset events
1 OB per event
200 or greater
16
Diagnostic Error
82 only
Time Error
80 only
1
2
9
3
26
27
After the execution of an OB has started, processing of the OB cannot be interrupted by the
occurrence of another event from the same or lower priority group. Such events are queued
for later processing, allowing the current OB to finish.
However, an event from a higher priority group will interrupt the current OB, and the CPU
then executes the OB for the higher-priority event. After the higher-priority OB finishes, the
CPU executes the OBs for any other events queued in this higher priority group, based on
the priority within that group. When no other events are pending (queued) in this higher
priority group, the CPU then returns to the lower priority group and resumes the processing
of the pre-empted OB at the point where the processing of that OB had been interrupted.
41
PLC concepts
3.1 Execution of the user program
Interrupt latency
The interrupt event latency (the time from notification of the CPU that an event has occurred
until the CPU begins execution of the first instruction in the OB that services the event) is
175 sec or less, provided that a program cycle OB is the only event service routine active at
the time of the event.
Data type
Description
fault_id
BYTE
csg_OBnr
OB_ANY
csg_prio
UINT
No time error interrupt OB 80 is present when you create a new project. If desired, you add a
time error interrupt OB 80 to your project by double-clicking "Add new block" under "Program
blocks" in the tree, then choose "Organization block", and then "Time error interrupt".
42
PLC concepts
3.1 Execution of the user program
Data type
Description
IO_state
WORD
laddr
HW_ANY
channel
UINT
multi_error
BOOL
No diagnostic error interrupt OB 82 is present when you create a new project. If desired, you
add a diagnostic error interrupt OB 82 to your project by double-clicking "Add new block"
under "Program blocks" in the tree, then choose "Organization block", and then "Diagnostic
error interrupt".
43
PLC concepts
3.1 Execution of the user program
If the maximum scan cycle time is exceeded twice within the same program cycle, with no
RE_TRIGR instruction execution between the two, then the CPU transitions to STOP
immediately.
An endless loop or very long scan can potentially be created using repeated executions of
the RE_TRIGR instruction. In order to prevent the CPU from being locked up in a scan, a
communication time slice will be allocated every 100ms. The length of this time slice will be
the percentage specified in the Communications load configuration parameter under Device
configuration for the CPU. This provides the opportunity to regain control of the CPU and
command it to STOP, if required.
Ordinarily the scan cycle executes as fast as it can be executed and the next scan cycle
begins as soon as the current one completes. Depending upon the user program and
communication tasks, the time period for a scan cycle can vary from scan to scan. To
eliminate this variation, the CPU supports an optional fixed minimum scan cycle time (also
called fixed scan cycle). When this optional feature is enabled and a fixed minimum scan
cycle time is provided in ms, the CPU will maintain the minimum cycle time within 1ms for
the completion of each CPU scan.
In the event that the CPU completes the normal scan cycle in less time than the specified
minimum cycle time, the CPU spends the additional time of the scan cycle performing
runtime diagnostics and/or processing communication requests. In this way the CPU always
takes a fixed amount of time to complete a scan cycle.
In the event that the CPU does not complete the scan cycle in the specified minimum cycle
time, the CPU completes the scan normally (including communication processing) and does
not create any system reaction as a result of exceeding the minimum scan time.
The following table defines the ranges and defaults for the cycle time monitoring functions.
Cycle time
Range (ms)
Default
1 - 6000
150 ms
Disabled
The maximum scan cycle time is always enabled, and the user must choose a cycle time
between the allowed range of 1 ms to 6000 ms. The default is 150 ms.
The fixed minimum scan cycle time is optional , and is disabled by default. If used, a
cycle time between 1 ms and the maximum scan cycle time must be chosen.
44
PLC concepts
3.1 Execution of the user program
Communications load: You can configure a percentage of the scan time to be dedicated
for communication tasks.
For more information about the scan cycle, see "Monitoring the cycle time". (Page 40)
3.1.3
CPU memory
Memory management
The CPU provides the following memory areas to store the user program, data, and
configuration:
Load memory is non-volatile storage for the user program, data and configuration. When
a project is downloaded to the CPU, it is first stored in the Load memory area. This area
is located either in a memory card (if present) or in the CPU. This non-volatile memory
area is maintained through a power loss. The memory card supports a larger storage
space than that built-in to the CPU.
Work memory RAM is volatile storage for some elements of the user project while
executing the user program. To improve system performance, the CPU copies some
elements of the project from load memory into work memory. This volatile area is lost
when power is removed, and is restored by the CPU when power is restored.
Retentive memory is non-volatile storage for a limited quantity of work memory values.
The retentive memory area is used to store the values of selected user memory locations
during power loss. When a power down occurs, the CPU by design has enough hold-up
time to retain the values of a limited number of specified locations. These retentive values
are then restored upon power up.
To view the memory usage for the current project, right-click the PLC of interest in the tree or
one of its blocks, and then choose "Resources". To view the memory usage for the current
PLC, double-click "Online and diagnostics" in the tree, expand "Diagnostics", and choose
"Memory".
45
PLC concepts
3.1 Execution of the user program
Retentive memory
The CPU provides for storage of 2048 bytes of retentive data. You can specify work memory
data values, such as data in a DB or bit memory (M), that are to be saved permanently each
time power is removed.
When power is removed, the work memory values selected as retentive are copied to a
block of 2048 consecutive bytes. The checksum is then computed, and retentive values
followed by the checksum are written to non-volatile memory. The checksum and any other
retentive values needed by the operating system of the CPU are provided without consuming
any of the 2048 bytes provided for the user.
At the time power is restored, the system retrieves the retentive data and restores the
corresponding work memory locations to their value prior to power loss.
Any attempt to select more than 2048 bytes of retentive data is rejected.
Diagnostics buffer
The CPU supports a diagnostic buffer which contains an entry for each diagnostic event.
Each entry includes a date and time the event occurred, an event category, and an event
description. The entries are displayed in chronological order with the most recent event at
the top. While the CPU maintains power, up to 50 most recent events are available in this
log. When the log is full, a new event replaces the oldest event in the log. When power is
lost, the ten most recent events are saved.
The following types of events are recorded in the diagnostics buffer:
Each system diagnostic event; for example, CPU errors and module errors
Each state change of the CPU (each power up, each transition to STOP, each transition
to RUN)
Each change to a configured object except changes issued by the CPU and the user
program
To access the diagnostic buffer, you must be online. Locate the log under "Online &
diagnostics / Diagnostics / Diagnostics buffer". For more information regarding
troubleshooting and debugging, refer to the "Online and diagnostics" chapter.
46
PLC concepts
3.1 Execution of the user program
47
PLC concepts
3.1 Execution of the user program
3.1.4
48
PLC concepts
3.2 Data storage, memory areas and addressing
Each level allows certain functions to be accessible without a password. The default
condition for the CPU is to have no restriction and no password-protection. To restrict access
to a CPU, you configure the properties of the CPU and enter the password.
Entering the password over a network does not compromise the password protection for the
CPU. A password-protected CPU allows only one user unrestricted access at a time.
PLC-to-PLC communications (using communication instructions in the code blocks) are not
restricted by the security level in the CPU. HMI functionality is also not restricted. Entering
the correct password provides access to all of the functions.
Security level
Access restrictions
No protection
Write protection
Read/write protection
With password protection, you can use instructions for process control, monitoring, and
communications without restrictions. Some functions, such as the "Set time of day/date"
instruction, should not be locked with a password. For example: To modify the tags in a CPU
that was configured for read/write protection, you must enter the configured password
because this function requires write access.
3.2
49
PLC concepts
3.2 Data storage, memory areas and addressing
Each different memory location has a unique address. Your user program uses these
addresses to access the information in the memory location.
Memory area
Description
Force
Retentive
I
Process image input
Yes
No
I_:P
(Physical input)
No
No
Q
Process image output
Yes
No
Q_:P
(Physical output)
No
No
M
Bit memory
No
Yes
L
Temp memory
No
No
DB
Data block
No
Yes
To access a bit in a memory area, you specify the address, which includes the memory area
identifier, the byte address, and the bit number. An example of accessing a bit (which is also
called "byte.bit" addressing) is shown below. In this example, the memory area and byte
address (I = input, and 3 = byte 3) are followed by a period (".") to separate the bit address
(bit 4).
0
You can access data in most memory areas (I, Q, M, DB, and L) as bytes, words, or double
words by using the "byte address" format. To access a byte, word, or double word of data in
the memory, you must specify the address in a way similar to specifying the address for a
bit. This includes an area identifier, data size designation, and the starting byte address of
the byte, word, or double word value. Size designators are B (byte), W (word) and D (doubleword). (Examples: IB0, MW20, QD8)
To immediately access the physical inputs and physical outputs, append a ":P" to the
address or tag (such as I0.3:P, Q1.7:P, or "Stop:P").
50
PLC concepts
3.2 Data storage, memory areas and addressing
I0.1
By appending a ":P" to the address, you can immediately read the digital and analog inputs
of the CPU, SB or SM. The difference between an access using I_:P instead of I is that the
data comes directly from the points being accessed rather than from the input process
image. This I_:P access is referred to as an "immediate read" access because the data is
retrieved immediately from the source instead of from a copy that was made the last time the
input process image was updated.
Because the physical input points receive their values directly from the field devices
connected to these points, writing to these points is prohibited. That is, I_:P accesses are
read-only, as opposed to I accesses which can be read or write.
I_:P accesses are also restricted to the size of inputs supported by a single CPU, SB, or SM,
rounded up to the nearest byte. For example, if the inputs of a 2 DI / 2 DQ SB are configured
to start at I4.0, then the input points can be accessed as I4.0:P and I4.1:P or as IB4:P.
Accesses to I4.2:P through I4.7:P are not rejected, but make no sense since these points are
not used. Accesses to IW4:P and ID4:P are prohibited since they exceed the byte offset
associated with the SB.
Accesses using I_:P do not affect the corresponding value stored in the input process image.
Bit
I0.1:P
Q (process image output): The CPU copies the values stored in the output process image to
the physical output points. You can access the output process image in bits, bytes, words, or
double words. Both read and write access is permitted for process image outputs.
Bit
Q1.1
By appending a ":P" to the address, you can immediately write to the physical digital and
analog outputs of the CPU, SB or SM. The difference between an access using Q_:P instead
S7-1200 Programmable controller
System Manual, 05/2009, A5E02486680-01
51
PLC concepts
3.2 Data storage, memory areas and addressing
of Q is that the data goes directly to the points being accessed in addition to the output
process image (writes to both places). This Q_:P access is sometimes referred to as an
"immediate write" access because the data is sent immediately to the target point; the target
point does not have to wait for the next update from the output process image.
Because the physical output points directly control field devices that are connected to these
points, reading from these points is prohibited. That is, Q_:P accesses are write-only, as
opposed to Q accesses which can be read or write.
Q_:P accesses are also restricted to the size of outputs supported by a single CPU, SB, or
SM, rounded up to the nearest byte. For example, if the outputs of a 2 DI / 2 DQ SB are
configured to start at Q4.0, then the output points can be accessed as Q4.0:P and Q4.1:P or
as QB4:P. Accesses to Q4.2:P through Q4.7:P are not rejected, but make no sense since
these points are not used. Accesses to QW4:P and QD4:P are prohibited since they exceed
the byte offset associated with the SB.
Accesses using Q_:P affect both the physical output as well as the corresponding value
stored in the output process image.
Bit
Q1.1:P
M (bit memory area): Use the bit memory area (M memory) for both control relays and data
to store the intermediate status of an operation or other control information. You can access
the bit memory area in bits, bytes, words, or double words. Both read and write access is
permitted for M memory.
Bit
M26.7
Temp (temporary memory): The CPU provides temp (local) memory for each of the three OB
priority groups: 16 Kbytes for startup and program cycle, including associated FBs and FCs;
4 Kbytes for standard interrupt events including FBs and FCs; and 4 Kbytes for error
interrupt events including FBs and FCs.
Temp memory is similar to M memory with one major exception: M memory has a "global"
scope, and temp memory has a "local" scope:
M memory: Any OB, FC, or FB can access the data in M memory, meaning that the data
is available globally for all of the elements of the user program.
Temp memory: Access to the data in temp memory is restricted to the OB, FC, or FB that
created or declared the temp memory location. Temp memory locations remain local and
are not share by different code blocks, even when the code block calls another code
block. For example: When an OB calls an FC, the FC cannot access the temp memory of
the OB that called it.
The CPU allocates the temp memory on an as-needed basis. The CPU allocates the temp
memory for the code block at the time when the code block is started (for an OB) or is called
(for an FC or FB). The allocation of temp memory for a code block might reuse the same
temp memory locations previously used by a different OB, FC or FB. The CPU does not
initialize the temp memory at the time of allocation and might contain any value.
You access temp memory by symbolic addressing only.
52
PLC concepts
3.2 Data storage, memory areas and addressing
DB (data block): Use the DB memory for storing various types of data, including intermediate
status of an operation or other control information parameters for FBs, and data structures
required for many instructions such as timers and counters. You can specify a data block to
be either read/write or read only. You can access data block memory in bits, bytes, words, or
double words. Both read and write access is permitted for read/write data blocks. Only read
access is permitted for read-only data blocks.
Bit
DB1.DBX2.3
DB1.DBB4, DB10.DBW2,
DB20.DBD8
53
PLC concepts
3.3 Data types
3.3
Data types
Data types are used to specify both the size of a data element as well as how the data are to
be interpreted. Each instruction parameter supports at least one data type, and some
parameters support multiple data types. Hold the cursor over the parameter field of an
instruction to see which data types are supported for a given parameter.
A formal parameter is the identifier on an instruction that marks the location of data to be
used by that instruction (example: the IN1 input of an ADD instruction). An actual parameter
is the memory location or constant containing the data to be used by the instruction
(example %MD400 "Number_of_Widgets"). The data type of the actual parameter specified
by you must match one of the supported data types of the formal parameter specified by the
instruction.
When specifying an actual parameter, you must specify either a tag (symbol) or an absolute
memory address. Tags associate a symbolic name (tag name) with a data type, memory
area, memory offset, and comment, and can be created either in the PLC tags editor or in
the Interface editor for a block (OB, FC, FB, or DB). If you enter an absolute address that
has no associated tag, you must use an appropriate size that matches a supported data
type, and a default tag will be created upon entry.
You can also enter a constant value for many of the input parameters. The following table
describes the supported elementary data types including examples of constant entry. All
except String are available in the PLC tags editor and the block Interface editors. String is
available only in the block Interface editors. The following table defines the elementary data
types.
Data
type
Size
(bits)
Range
Bool
0 to 1
TRUE, FALSE, 0, 1
Byte
16#00 to 16#FF
16#12, 16#AB
Word
16
16#0000 to 16#FFFF
16#ABCD, 16#0001
DWord
32
16#00000000 to 16#FFFFFFFF
16#02468ACE
Char
16#00 to 16#FF
Sint
-128 to 127
123, -123
Int
16
-32,768 to 32,767
123, -123
Dint
32
-2,147,483,648 to 2,147,483,647
123, -123
USInt
0 to 255
123
UInt
16
0 to 65,535
123
UDInt
32
0 to 4,294,967,295
Real
32
+/-1.18 x 10
-38 to
123
+/-3.40 x 10
38
LREAL
64
+/-2.2250738585072020
to +/-1.7976931348623157 10308
12345.123456789.
-1.2E+40
Time
32
T#-24d_20h_31m_23s_648ms to
T#5m_30s
T#24d_20h_31m_23s_647ms stored as
5#-2d
String
Variable
10308
-2,147,483,648`ms to +2,147,483,647ms
T#1d_2h_15m_30x_45ms
'ABC'
Although not available as data types, the following BCD numeric format is supported by the
conversion instructions.
54
PLC concepts
3.3 Data types
Format
Size (bits)
Numeric Range
Bool
16
-999 to 999
123, -123
Byte
32
-9999999 to 9999999
1234567, -1234567
Format
Value range
Example
64
Floating-point numbers to
IEEE 754 standard
-1.7976931348623158e+308 to
-2.2250738585072014e-308
1.0e-5
Floating-point numbers
1.0
+2.2250738585072014e-308 to
+1.7976931348623158e+308
Tags of the LREAL data type have a length of 64 bits and are used to display floating-point
numbers. A tag of the LREAL data type consists of the following three components:
Sign: The sign is determined by the signal state of bit 63. Bit 63 assumes the value "0"
(positive) or "1" (negative).
11-bit exponents to basis 2: The exponent is increased by one constant (basis, +1023),
so that it has a range of 2047.
52-bit mantissa: Only the broken part of the mantissa is shown. The integer part of the
mantissa is not stored, as it is always equal to "1" within the valid value range.
Sign (1 bit)
55
PLC concepts
3.3 Data types
56
Operation
Instruction
Description
Compare
CMP ==
CMP <>
CMP >=
CMP <=
Query if the first comparison value is less than or equal to the second
comparison value.
CMP >
CMP <
-|OK|-
-|NOT_OK|-
Move
MOVE
Copies the content of input IN to the output OUT when the signal
state is "1" at the EN enable input.
Math
ADD
Adds the value at the IN1 input to the value at the IN2 input and
outputs the sum at the OUT output (OUT = IN1+IN2).
SUB
Subtracts the value at the IN2 input from the value at the IN1 input
and outputs the difference at the OUT output (OUT = IN1-IN2).
MUL
Multiplies the value at the IN1 input by the value at the IN2 input and
outputs the product at the OUT output (OUT = IN1*IN2).
DIV
Divides the value at the IN1 input by the value at the IN2 input and
outputs the quotient at the OUT output (OUT = IN1/IN2).
NEG
Changes the sign of the value at the IN input and outputs the result
at the OUT output.
ABS
SQR
SQRT
LN
EXP
SIN
COS
TAN
ASIN
ACOS
ATAN
PLC concepts
3.3 Data types
Operation
Convert
Instruction
Description
FRAC
EXPT
Exponentiates the value at the IN1 input by the value at the IN2
input.
CONVERT
ROUND
Rounds the value at the IN input to the nearest integer and stores the
result at the OUT output.
CEIL
Rounds the value at the IN input to the next greater integer and
stores the result at the OUT output.
FLOOR
Rounds the value at the IN input to the next smaller integer and
stores the result at the OUT output.
TRUNC
Current Character
Count
...
Character
10
10
'C' (16#43)
'A' (16#41)
'T' (16#54)
...
Byte 0
Byte 1
Byte 2
Byte 3
Byte 4
...
Byte 11
Arrays
You can create an array that contains multiple elements of an elementary type. Arrays can
be created in the block interface editors for OB, FC, FB, and DB. You cannot create an array
in the PLC tags editor.
57
PLC concepts
3.4 Saving and restoring memory
To create an array from the block interface editor, choose data type "Array [lo .. hi] of type",
then edit "lo", "hi", and "type" as follows:
lo - the starting (lowest) index for your array
hi - the ending (highest) index for your array
type - one of the elementary data types, such as BOOL, SINT, UDINT
Negative indices are supported. You can name the array in the Name column of the block
interface editor. The following table shows examples of arrays as they might appear in the
block interface editor:
Name
Data type
Comment
My_Bits
My_Data
You reference elements of arrays in your program using the following syntax:
Array_name[i], where i is the desired index.
Examples as they might appear in the program editor as a parameter input:
#My_Bits[3] - references the third bit of array "My_Bits"
#My_Data[-2] - references the fourth SINT of array "My_Data"
The # symbol is inserted automatically by the program editor.
3.4
3.4.1
58
PLC concepts
3.4 Saving and restoring memory
WARNING
If you place a memory card (whether configured as a "Program" or "Transfer" card) in a
running CPU, the CPU will go to STOP. Control devices can fail in an unsafe condition,
resulting in unexpected operation of controlled equipment. Such unexpected operations
could result in death or serious injury to personnel, and/or damage to equipment.
3.4.2
59
PLC concepts
3.4 Saving and restoring memory
CAUTION
Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap when
you handle the memory card. Store the memory card in a conductive container.
To create a "Program" card using a CPU, follow these steps:
1. Insert a blank memory card into the memory card reader.
2. In the STEP 7 Basic programming device, in the "Project tree," make the following menu
selections:
(Right-click) SIMATIC Card Reader
"Properties"
In the dropdown menu for "Card Type," select "Program."
60
PLC concepts
3.4 Saving and restoring memory
3.4.3
61
PLC concepts
3.4 Saving and restoring memory
If a program block was transferred from the memory card, the program block in
permanent memory is replaced.
If a data block was transferred from the memory card, the data block in permanent
memory is replaced and all of M memory is cleared.
If a system block was transferred from the memory card, the system block and force
values in the permanent memory are replaced and all retentive memory is cleared.
62
PLC concepts
3.4 Saving and restoring memory
63
PLC concepts
3.4 Saving and restoring memory
64
Device configuration
You create the device configuration for your PLC by adding a CPU and additional modules to
your project.
CPU: Slot 1
Signal module (SM) for digital or analog I/O: up to 8, inserted in slots 2 through 9
(CPU 1214C allows 8, CPU 1212C allows 2, CPU 1211C does not allow any)
65
Device configuration
4.1 Inserting a CPU
4.1
Inserting a CPU
You create your device configuration by inserting a CPU into your project. Selecting the CPU
from the "Add a new device" dialog creates the rack and CPU.
"Add a new device" dialog
Note
The CPU does not have a pre-configured IP address. You must manually assign an IP
address for the CPU during the device configuration. If your CPU is connected to a router on
the network, you also enter the IP address for a router.
66
Device configuration
4.2 Configuring the operation of the CPU
4.2
67
Device configuration
4.3 Adding modules to the configuration
4.3
Result
SM
SB
CM
68
Device configuration
4.4 Configuring the parameters of the modules
4.4
69
Device configuration
4.4 Configuring the parameters of the modules
70
Device configuration
4.5 Creating a network connection
4.5
Result
71
Device configuration
4.6 Configuring a permanent IP address
4.6
PROFINET port
72
Device configuration
4.6 Configuring a permanent IP address
IP router: Routers are the link between LANs. Using a router, a computer in a LAN can send
messages to any other networks, which might have other LANs behind them. If the
destination of the data is not within the LAN, the router forwards the data to another network
or group of networks where it can be delivered to its destination.
Routers rely on IP addresses to deliver and receive data packets.
IP addresses
properties: In the
Properties window,
select the "Ethernet
address" configuration
entry. The TIA Portal
displays the Ethernet
address configuration
dialog, which
associates the
software project with
the IP address of the
CPU that will receive
that project.
Note
The CPU does not have a pre-configured IP address. You must manually assign an IP
address for the CPU. If your CPU is connected to a router on a network, you must also enter
the router's IP address. All IP addresses are configured when you download the project.
Refer to "Assigning IP addresses to programming and network devices (Page 216)" for more
information.
The following table defines the parameters for the IP address:
Parameter
Description
Subnet
Name of the Subnet to which the device is connected. Click the "Add new subnet"
button to create a new subnet. "Not connected" is the default.
Two connection types are possible:
The "Not connected" default provides a local connection.
A subnet is required when your network has two or more devices.
IP protocol
IP address
Subnet mask
Use IP router
Router address
73
Device configuration
4.6 Configuring a permanent IP address
74
Programming concepts
5.1
Recommended steps
Tasks
Divide your process or machine into sections that have a level of independence from each other.
These partitions determine the boundaries between controllers and influence the functional
description specifications and the assignment of resources.
Write the descriptions of operation for each section of the process or machine, such as the I/O
points, the functional description of the operation, the states that must be achieved before
allowing action for each actuator (such as a solenoid, a motor, or a drive), a description of the
operator interface, and any interfaces with other sections of the process or machine.
Identify any equipment that might require hard-wired logic for safety. Remember that control
devices can fail in an unsafe manner, which can produce unexpected startup or change in the
operation of machinery. Where unexpected or incorrect operation of the machinery could result in
physical injury to people or significant property damage, consider the implementation of
electromechanical overrides (which operate independently of the PLC) to prevent unsafe
operations. The following tasks should be included in the design of safety circuits:
Identify any improper or unexpected operation of actuators that could be hazardous.
Identify the conditions that would assure the operation is not hazardous, and determine how
to detect these conditions independently of the PLC.
Identify how the PLC affects the process when power is applied and removed, and also
identify how and when errors are detected. Use this information only for designing the normal
and expected abnormal operation. You should not rely on this "best case" scenario for safety
purposes.
Design the manual or electromechanical safety overrides that block the hazardous operation
independent of the PLC.
Provide the appropriate status information from the independent circuits to the PLC so that
the program and any operator interfaces have necessary information.
Identify any other safety-related requirements for safe operation of the process.
Based on the requirements of the functional specifications, create the following drawings of the
operator stations:
Overview drawing that shows the location of each operator station in relation to the process
or machine.
Mechanical layout drawing of the devices for the operator station, such as display, switches,
and lights.
Electrical drawings with the associated I/O of the PLC and signal modules.
75
Programming concepts
5.1 Guidelines for program design
Recommended steps
Tasks
Create the
configuration drawings
Based on the requirements of the functional specification, create configuration drawings of the
control equipment:
Overview drawing that shows the location of each PLC in relation to the process or machine.
Mechanical layout drawing of each PLC and any I/O modules, including any cabinets and
other equipment.
Electrical drawings for each PLC and any I/O modules, including the device model numbers,
communications addresses, and I/O addresses.
Create a list of
symbolic names
Create a list of symbolic names for the absolute addresses. Include not only the physical I/O
signals, but also the other elements (such as tag names) to be used in your program.
5.1.1
76
Programming concepts
5.1 Guidelines for program design
Linear structure:
Modular structure:
2%
2%
)%
)&
By creating generic code blocks that can be reused within the user program, you can simplify
the design and implementation of the user program. Using generic code blocks has a
number of benefits:
You can create reusable blocks of code for standard tasks, such as for controlling a pump
or a motor. You can also store these generic code blocks in a library that can be used by
different applications or solutions.
When you structure the user program into modular components that relate to functional
tasks, the design of your program can be easier to understand and to manage. The
modular components not only help to standardize the program design, but can also help
to make updating or modifying the program code quicker and easier.
Creating modular components simplifies the debugging of your program. By structuring
the complete program as a set of modular program segments, you can test the
functionality of each code block as it is developed.
Creating modular components that relate to specific technological functions can help to
simplify and reduce the time involved with commissioning the completed application.
5.1.2
Calling block
Program execution
Program execution
2%)%)&
2%)%)&
When a code block calls another code block, the CPU executes the program code in the
called block. After execution of the called block is complete, the CPU resumes the execution
of the calling block.
77
Programming concepts
5.1 Guidelines for program design
Start of cycle
Nesting depth
2%
)%
)&
'%
)%
)%
)&
'%
'%
)&
'%
5.1.2.1
78
Programming concepts
5.1 Guidelines for program design
After finishing the processing of the cyclic OBs, the CPU immediately executes the cyclic OB
again. This cyclic processing is the "normal" type of processing used for programmable logic
controllers. For many applications, the entire user program is located in a single cyclic OB.
You can create other OBs to perform specific functions, such as startup tasks, for handling
interrupts and errors, or for executing specific program code at specific time intervals. These
OBs interrupt the execution of the program cycle OBs.
Use the "Add new block" dialog to
create new OBs in your user
program.
Depending on their respective
priority levels, one OB can interrupt
another OB. Interrupt handling is
always event-driven. When such an
event occurs, the CPU interrupts
the scanning of the user program
and calls the OB that was
configured to handle that event.
After finishing the execution of the
interrupting OB, the CPU resumes
the execution of the user program
at the point of interruption.
The CPU determines the order for
handling interrupt events by a
priority assigned to each OB.
Each event has a particular servicing priority. Several interrupt events can be combined into
priority classes. For more information, refer to the PLC concepts chapter section on
execution of the user program (Page 35).
79
Programming concepts
5.1 Guidelines for program design
5.1.2.2
Function (FC)
A function (FC) is a fast-executing code block that typically performs a specific operation on
a set of input values. The FC stores the results of this operation in memory locations.
Use FCs to perform the following tasks:
To perform standard and reusable operations, such as for mathematical calculations.
To perform technological functions, such as for individual controls using bit logic
operations.
An FC can also be called several times at different points in a program. This reuse simplifies
the programming of frequently recurring tasks.
Unlike a function block (FB), an FC does not have an associated instance data block (DB).
The FC uses the local data stack for the temporary data used to calculate the operation. The
temporary data is not saved. To store data permanently, assign the output value to a global
memory location, such as M memory or to a global DB.
5.1.2.3
80
Programming concepts
5.1 Guidelines for program design
By designing the FB for generic control tasks, you can reuse the FB for multiple devices by
selecting different instance DBs for different calls of the FB.
An FB stores the input (IN), output (OUT), and in/out (IN_OUT) parameters in an instance
DB.
2%
)%
)%'%
'%
)%'%
)%'%
'%
5.1.2.4
81
Programming concepts
5.1 Guidelines for program design
The data stored in a DB is not deleted when the data block is closed or the execution of the
associated code block comes to an end. There are two types of DBs:
A global DB stores data for the code blocks in your program. Any OB, FB, or FC can
access the data in a global DB.
An instance DB stores the data for a specific FB. The structure of the data in an instance
DB reflects the parameters (Input, Output, and InOut) and the static data for the FB. (The
Temp memory for the FB is not stored in the instance DB.)
Note
Although the instance DB reflects the data for a specific FB, any code block can access
the data in an instance DB.
5.1.3
82
Programming concepts
5.1 Guidelines for program design
You cannot create a branch that could result in a power flow in the reverse direction.
$
&
'
&
Inputs/outputs
Operands
Data type
LAD
EN, ENO
Power flow
BOOL
EN
BOOL
ENO
Power Flow
BOOL
FBD
83
Programming concepts
5.2 Copy protection
5.2
Copy protection
Copy or "know-how" protection allows
you to prevent one or more code
blocks (OB, FB, or FC) in your
program from unauthorized access.
You create a password to limit
access to the code block.
When you configure a block for
"know-how" protection, the code
within the block cannot be accessed
except after entering the password.
To copy-protect the block, select the
"Know how protection" command
from the "Edit" menu. You then enter
a password that allows access to the
block.
The password-protection prevents unauthorized reading or modification of the code block.
Without the password, you can read only the following information about the code block:
Block title, block comment, and block properties
Transfer parameters (IN, OUT, IN_OUT, Return)
Call structure of the program
Global tags in the cross references (without information on the point of use), but local
tags are hidden
84
Programming concepts
5.3 Debugging and testing the program
5.3
85
Programming concepts
5.3 Debugging and testing the program
86
Programming instructions
6.1
Basic instructions
6.1.1
Bit logic
LAD contacts
You can connect contacts to other contacts and create your own combination logic. If the
input bit you specify uses memory identifier I (input) or Q (output), then the bit value is read
from the process-image register. The physical contact signals in your control process are
wired to I terminals on the PLC. The PLC system scans the wired input signals and
continuously updates the corresponding state values in the process-image input register.
You can specify an immediate read of a physical input using ":P" following the I offset
(example: "%I3.4:P"). For an immediate read, the bit data values are read directly from the
physical input instead of the process image. An immediate read does not update the process
image.
Normally Open
Normally Closed
Parameter
Data type
Description
IN
BOOL
Assigned bit
The Normally Open contact is closed (ON) when the assigned bit value is equal to 1.
The Normally Closed contact is closed (ON) when the assigned bit value is equal to 0.
Contacts connected in series create AND logic networks.
Contacts connected in parallel create OR logic networks.
87
Programming instructions
6.1 Basic instructions
AND logic
OR logic
XOR logic
Parameter
Data type
Description
IN1, IN2
BOOL
Input bit
All inputs of an AND box must be TRUE for the output to be TRUE.
Any input of an OR box must be TRUE for the output to be TRUE.
An odd number of the inputs of an XOR box must be TRUE for the output to be TRUE.
The LAD NOT contact inverts the logical state of power flow input.
If there is no power flow into the NOT contact, then there is power flow out.
If there is power flow into the NOT contact, then there is no power flow out.
88
Programming instructions
6.1 Basic instructions
Output coil
Parameter
Data type
Description
OUT
BOOL
Assigned bit
If there is power flow through an output coil, then the output bit is set to 1.
If there is no power flow through an output coil, then the output coil bit is set to 0.
If there is power flow through an inverted output coil, then the output bit is set to 0.
If there is no power flow through an inverted output coil, then the output bit is set to 1.
Output assignment
Inverted output
assignment
Output assignment
with inverted output
Parameter
Data type
Description
OUT
BOOL
Assigned bit
6.1.1.1
89
Programming instructions
6.1 Basic instructions
LAD: Set
LAD: Reset
FBD: Set
FBD: Reset
Parameter
Data type
Description
BOOL
OUT
BOOL
LAD: RESET_BF
FBD: SET_BF
FBD: RESET_BF
Parameter
Data type
Description
Constant
OUT
BOOL
When SET_BF is activated, a data value of 1 is assigned to "n" bits starting at address
OUT. When SET_BF is not activated, OUT is not changed.
RESET_BF writes a data value of 0 to "n" bits starting at address OUT. When RESET_BF
is not activated, OUT is not changed.
These instructions must be the right-most instruction in a branch.
90
LAD/FBD: SR
Parameter
Data type
Description
S, S1
BOOL
R, R1
BOOL
Programming instructions
6.1 Basic instructions
Parameter
Data type
Description
OUT
BOOL
BOOL
RS is a set dominant latch where the set dominates. If the set (S1) and reset (R) signals
are both true, the output address OUT will be 1.
SR is a reset dominant latch where the reset dominates. If the set (S) and reset (R1)
signals are both true, the output address OUT will be 0.
The OUT parameter specifies the bit address that is set or reset. The optional OUT
output Q reflects the signal state of the "OUT" address.
Instruction
RS
SR
6.1.1.2
S1
"OUT" bit
Previous state
1
1
R1
Previous state
N contact: LAD
P box: FBD
N box: FBD
P coil: LAD
N coil: LAD
P= box: FBD
N= box: FBD
P_TRIG: LAD\FBD
N_TRIG: LAD\FBD
91
Programming instructions
6.1 Basic instructions
92
Parameter
Data type
Description
M_BIT
BOOL
IN
BOOL
OUT
BOOL
CLK
BOOL
BOOL
P contact:
LAD
N contact:
LAD
P box:
FBD
N box:
FBD
P coil:
LAD
N coil:
LAD
P= box:
FBD
N= box:
FBD
Programming instructions
6.1 Basic instructions
P_TRIG:
LAD/FBD
The Q output power flow or logic state is TRUE when a positive transition
(OFF-to-ON) is detected on the CLK input state (FBD) or CLK power flow in
(LAD). In LAD, the P_TRIG instruction cannot be located at the beginning or
end of a network. In FBD, the P_TRIG instruction can be located anywhere
except the end of a branch.
N_TRIG
(LAD/FBD)
The Q output power flow or logic state is TRUE when a negative transition
(ON-to-OFF) is detected on the CLK input state (FBD) or CLK power flow in
(LAD). In LAD, the N_TRIG instruction cannot be located at the beginning or
end of a network. In FBD, the P_TRIG instruction can be located anywhere
except the end of a branch.
All edge instructions use a memory bit (M_BIT) to store the previous state of the input signal
being monitored. An edge is detected by comparing the state of the input with the state of
the memory bit. If the states indicate a change of the input in the direction of interest, then an
edge is reported by writing the output TRUE. Otherwise, the output is written FALSE.
Note
Edge instructions evaluate the input and memory-bit values each time they are executed,
including the first execution. You must account for the initial states of the input and memory
bit in your program design either to allow or to avoid edge detection on the first scan.
Because the memory bit must be maintained from one execution to the next, you should use
a unique bit for each edge instruction, and you should not use this bit any other place in your
program. You should also avoid temporary memory and memory that can be affected by
other system functions, such as an I/O update. Use only M, global DB, or Static memory for
the M_BIT.
6.1.2
Timers
You use the timer instructions to create programmed time delays:
TP: The Pulse timer generates a pulse with a preset width time.
TON: The ON-delay timer output Q is set to ON after a preset time delay.
TOF: The OFF-delay timer output Q is reset to OFF after a preset time delay.
TONR: The ON-delay Retentive timer output is set to ON after a preset time delay.
Elapsed time is accumulated over multiple timing periods until the R input is used to reset
the elapsed time.
RT: Reset a timer by clearing the time data stored in the specified timer instance data
block.
Each timer uses a structure stored in a data block to maintain timer data. You assign the
data block when the timer instruction is placed in the editor.
93
Programming instructions
6.1 Basic instructions
When you place timer instructions in a function block, you can select the Multi-instance data
block option, the timer structure names can be different with separate data structures, but
the timer data is contained in a single data block and does not require a separate data block
for each timer. This reduces the processing time and data storage necessary for handling
the timers. There is no interaction between the timer data structures in the shared Multiinstance data block.
Note
Although not typical, you can assign the same Single-instance timer structure name to
multiple timer instructions, thus sharing the structure data among the multiple timer
instructions. You must account for any interaction resulting from a shared structure in your
program design.
LAD
TP, TON, and TOF timers have the same input and output
parameters.
"Timer name"
The RT instruction resets the timer data for the specified timer.
----[ RT ]---Parameter
Data type
Description
IN
BOOL
BOOL
PT
TIME
BOOL
Timer output
ET
TIME
DB
94
Programming instructions
6.1 Basic instructions
Effect of value changes in the PT and IN parameters:
TP:
Changing PT has no effect while the timer runs
Changing IN has no effect while the timer runs
TON:
Changing PT has no effect while the timer runs
Changing IN to FALSE, while the timer runs, resets and stops the timer
TOF:
Changing PT has no effect while the timer runs
Changing IN to TRUE, while the timer runs, resets and stops the timer
TONR:
Changing PT has no effect while the timer runs, but has an effect when the timer
resumes.
Changing IN to FALSE, while the timer runs, stops the timer but does not reset the
timer. Changing IN back to TRUE will cause the timer to start timing from the
accumulated time value.
TIME values
PT (preset time) and ET (elapsed time) values are stored in memory as signed double
integers that represent milliseconds of time. TIME data uses the T# identifier and can be
entered as a simple time unit "T#200ms" or as compound time units "T#2s_200ms".
Data type
TIME
Size
32 bits
Stored as
4
37
37
37
(7
37
95
Programming instructions
6.1 Basic instructions
TON: ON-delay timing diagram
,1
37
37
(7
37
37
37
(7
37
37
(7
96
Programming instructions
6.1 Basic instructions
6.1.3
Counters
6.1.3.1
Counters
You use the counter instructions to count internal program events and external process
events:
CTU is a count up counter.
CTD is a count down counter.
CTUD is a count up and down counter.
Each counter uses a structure stored in a data block to maintain counter data. You assign
the data block when the counter instruction is placed in the editor. These instructions use
software counters whose maximum counting rate is limited by the execution rate of the OB
they are placed in. For faster external counting operations, see the CTRL_HSC instruction.
When you place counter instructions in a function block, you can select the Multi-instance
data block option, the counter structure names can be different with separate data
structures, but the counter data is contained in a single data block and does not require a
separate data block for each counter. This reduces the processing time and data storage
necessary for the counters. There is no interaction between the counter data structures in
the shared Multi-instance data block.
Note
Although not typical, you can assign the same Single-instance counter structure name to
multiple counter instructions of the same size, thus sharing the structure data among the
multiple counter instructions. You must account for any interaction resulting from a shared
structure in your program design.
LAD/FBD
Select the count value data type from the drop-down list under the box
name.
Create your own "Counter name" that names the counter Data Block and
describes the purpose of this counter in your process.
97
Programming instructions
6.1 Basic instructions
Parameter
Data type
Description
CU, CD
BOOL
R (CTU, CTUD)
BOOL
BOOL
PV
Q, QU
BOOL
True if CV >= PV
QD
BOOL
True if CV <= 0
CV
The numerical range of count values depends on the data type you select. If the count value
is an unsigned integer type, you can count down to zero or count up to the range limit. If the
count value is a signed integer, you can count down to the negative integer limit and count
up to the positive integer limit.
CTU: CTU counts up by 1 when the value of parameter CU changes from 0 to 1. If the value
of parameter CV (Current count value) is greater than or equal to the value of parameter PV
(Preset count value), then the counter output parameter Q = 1.
If the value of the reset parameter R changes from 0 to 1, then the current count value is
reset to 0.
The following figure shows a CTU timing diagram with an unsigned integer count value
(where PV = 3).
&8
5
&9
CTD: CTD counts down by 1 when the value of parameter CD changes from 0 to 1. If the
value of parameter CV (Current count value) is equal to or less than 0, the counter output
parameter Q = 1.
If the value of parameter LOAD changes from 0 to 1, the value at parameter PV (Preset
value) is loaded to the counter as the new CV (Current count value).
The following figure shows a CTD timing diagram with an unsigned integer count value
(where PV = 3).
98
Programming instructions
6.1 Basic instructions
&8
/2$'
&9
CTUD: CTUD counts up or down by 1 on the 0 to 1 transition of the Count up (CU) or Count
down (CD) inputs. If the value of parameter CV (Current count value) is equal to or greater
than the value of parameter PV (Preset value), then the counter output parameter QU = 1. If
the value of parameter CV is less than or equal to zero, then the counter output parameter
QD = 1.
If the value of parameter LOAD changes from 0 to 1, then the value at parameter PV (Preset
value) is loaded to the counter as the new CV (Current count value). If the value of the reset
parameter R is changes from 0 to 1, the current count value is reset to 0.
The following figure shows a CTUD timing diagram with an unsigned integer count value
(where PV = 4).
&8
&'
/2$'
&9
48
4'
6.1.3.2
CTRL_HSC instruction
The CTRL_HSC instruction controls the high-speed counters that are used to count events
that occur faster than the CPU scan rate. The counting rate of the CTU, CTD, and CTUD
counter instructions is limited by the CPU scan rate. The high-speed counters operate
asynchronously to the CPU scan and allow counting events up to a 100 kHz count rate (for
HSC 1, 2, or 3 and onboard CPU count input configuration). A typical use for high-speed
counters is to count pulses generated by a motion control shaft encoder.
Each CTRL_HSC instruction uses a structure stored in a data block to maintain data. You
assign the data block when the CTRL_HSC instruction is placed in the editor.
99
Programming instructions
6.1 Basic instructions
LAD/FBD
Create you own "Counter name" that names the counter
Data Block and describes the purpose of this counter in
your process.
Parameter
Parameter
type
Data type
Description
HSC
IN
HW_HSC
HSC identifier
DIR
IN
BOOL
CV
IN
BOOL
RV
IN
BOOL
PERIOD
IN
BOOL
NEW_DIR
IN
INT
New direction:
1= forward
-1= backward
NEW_CV
IN
DINT
NEW_RV
IN
DINT
NEW_PERIOD
IN
INT
BUSY
OUT
BOOL
Function busy
STATUS
OUT
WORD
Operation
You must configure the high-speed counters in the project settings PLC device configuration
before you can use high-speed counters in your program. The HSC device configuration
settings select counting modes, I/O connections, interrupt assignment, and operation as a
high-speed counter or as a device to measure pulse frequency. You can operate the highspeed counter with no program control or with program control.
Many high-speed counter configuration parameters are set only in the project device
configuration. Some high-speed counter parameters are initialized in the project device
configuration, but can be modified later under program control.
The CTRL_HSC instruction parameters provide program control of the counting process:
Set the counting direction to a NEW_DIR value
Set the current count value to a NEW_CV value
100
Programming instructions
6.1 Basic instructions
Set the reference value to a NEW_RV value
Set the Period value (for frequency measurement mode) to a NEW_PERIOD value
If the following boolean flag values are set to 1 when the CTRL_HSC instruction is executed,
the corresponding NEW_xxx value is loaded to the counter. Multiple requests (more than
one flag is set at the same time) are processed in a single execution of the CTRL_HSC
instruction.
DIR = 1 is a request to load a NEW_DIR value, 0 = no change
CV = 1 is a request to load a NEW_CV value, 0 = no change
RV = 1 is a request to load a NEW_RV value, 0 = no change
PERIOD = 1 is a request to load a NEW_PERIOD value, 0 = no change
The CTRL_HSC instruction is usually placed in a hardware interrupt OB that is executed
when the counter hardware interrupt event is triggered. For example, if a CV=RV event
triggers the counter interrupt, then a hardware interrupt OB code block executes the
CTRL_HSC instruction and can change the reference value by loading a NEW_RV value.
The current count value is not available in the CTRL_HSC parameters. The Process Image
address that stores the current count value is assigned during the high-speed counter
hardware configuration. You may use program logic to directly read the count value and the
value returned to your program will be a correct count for the instant in which the counter
was read, but the counter will continue to count high-speed events. The actual count value
could change before your program completes a process using an old count value.
CTRL_HSC parameter details:
If an update of a parameter value is not requested, then the corresponding input values
are ignored.
The DIR parameter is only valid if the counting direction is set by program control and not
by hardware input. You determine how to use this parameter in the HSC device
configuration.
For a S7-1200 HSC on the CPU or on the Signal Board, the BUSY parameter always has
a value of 0.
Condition codes
In the case of an error, ENO is set to 0, and the STATUS output contains a condition code.
STATUS value
(W#16#...)
0
Description
No error
80A1
80B1
80B2
80B3
80B4
101
Programming instructions
6.1 Basic instructions
6.1.3.3
102
Programming instructions
6.1 Basic instructions
Description
HSC
HSC1:
Built In I0.0
or Signal Board I4.0
or monitor PTO 01 PTO 0 Pulse
I0.1
I4.1
PTO 0 Direction
I0.3
-
HSC2:
Built In I0.2
or monitor PTO 11 PTO 1 Pulse
I0.3
PTO 1 Direction
I0.1
-
HSC3:2
Mode
2
3
4
5
Function
Built In I0.4
I0.5
I0.7
HSC4:3
Built In I0.6
I0.7
I0.5
HSC5:4
Built In I1.0
or Signal Board I4.0
I1.1
I4.1
I1.2
-
HSC6:5
Built In I1.3
I1.4
I1.5
Clock
Clock
Direction
Clock up
Phase A
Clock
Count or Frequency
Reset
Count
Count or Frequency
Reset
Count
Count or Frequency
Reset
Count
Phase B
Count or Frequency
Phase Z
Count
Direction
Count
Clock down
Pulse train output monitoring always uses clock and direction. If the corresponding PTO output is configured for pulse
only, then the direction output should generally be set for positive counting.
HSC3 with a reset input is not possible for the CPU 1211C which supports only 6 built-in inputs.
HSC4 is not possible for the CPU 1211C which supports only 6 built-in inputs.
HSC5 is only supported by the CPU 1211C and CPU 1212C when a 2 DI/2DQ SB is installed.
HSC6 is not supported by the CPU 1211C or the CPU 1212C.
Data type
Default address
HSC1
DINT
ID1000
HSC2
DINT
ID1004
HSC3
DINT
ID1008
HSC4
DINT
ID1012
HSC5
DINT
ID1016
HSC6
DINT
ID1020
103
Programming instructions
6.1 Basic instructions
Digital I/O points assigned to HSC, PWM, and PTO cannot be forced
The digital I/O points used by the high-speed counter (HSC), pulse-width modulation (PWM),
and pulse-train output (PTO) devices are assigned during device configuration. When digital
I/O point addresses are assigned to these devices, the values of the assigned I/O point
addresses cannot be modified by the Watch table force function.
6.1.3.4
104
Programming instructions
6.1 Basic instructions
6.1.4
Compare
You use the compare instructions to compare two values of the same data type. When the
LAD contact comparison is TRUE, then the contact is activated. When the FBD box
comparison is TRUE, then the box output is TRUE.
Relation type
==
<>
>=
<=
>
<
105
Programming instructions
6.1 Basic instructions
LAD
FBD
After you click on the instruction in the
program editor, you can select the
comparison type and data type from the
drop-down menus.
Parameter
Data type
Description
IN1, IN2
Values to compare
IN_RANGE
OUT_RANGE
LAD
FBD
After you click on the instruction in the
program editor, you can select the data type
from the dropdown menus.
Parameter
Data type
Description
Comparator inputs
The input parameters MIN, VAL, and MAX must be the same data type.
106
Programming instructions
6.1 Basic instructions
OK
NOT_OK
LAD
FBD
.
6.1.5
Parameter
Data type
Description
IN
REAL, LREAL
Input data
Math
FBD
Click below the box name and select a data
type from the drop-down menu.
107
Programming instructions
6.1 Basic instructions
Note
The basic math instruction parameters IN1, IN2, and OUT must be the same data type.
Parameter
Data type
Description
IN1, IN2
OUT
When enabled (EN = 1), the math instruction performs the specified operation on the input
values (IN1 and IN2) and stores the result in the memory address specified by the output
parameter (OUT). After the successful completion of the operation, the instruction sets ENO
= 1.
Condition codes
ENO status
6.1.5.1
Description
No error
Result value is outside the valid number range of the data type selected
Division by 0 (IN2 = 0)
REAL: If one of the input values is NAN (not a number) or the result is INF (infinity),
NAN is returned.
ADD REAL: If both IN values are INF with different signs, this is an illegal operation
and NAN is returned.
SUB REAL: If both IN values are INF with the same sign, this is an illegal operation
and NAN is returned.
MUL REAL: If one IN value is zero and the other is INF, this is an illegal operation
and NAN is returned.
DIV REAL: If both IN values are zero or INF, this is an illegal operation and NAN is
returned.
MOD instruction
You use a MOD (modulo) instruction for the IN1 modulo IN2 math operation. The operation
IN1 MOD IN2 = IN1 - (IN1 / IN2) * IN2 = parameter OUT.
LAD
FBD
Click below the box name and select a data
type from the drop-down menu.
108
Programming instructions
6.1 Basic instructions
Note
The IN1, IN2, and OUT parameters must be the same data type.
Parameter
Data type
Description
Modulo inputs
OUT
Modulo output
Condition codes
ENO status
Description
No error
NEG instruction
You use the NEG (negation) instruction to invert the arithmetic sign of the value at parameter
IN and store the result in parameter OUT.
LAD
FBD
Click below the box name and select a data
type from the drop-down menu.
Note
The IN and OUT parameters must be the same data type.
Parameter
Data type
Description
IN
OUT
109
Programming instructions
6.1 Basic instructions
Condition codes
ENO status
Description
No error
The resulting value is outside the valid number range of the selected data type.
Example for SINT: NEG (-128) results in +128 which exceeds the data type
maximum.
FBD
Click below the box name and select a data
type from the drop-down menu.
Parameter
Data type
Description
IN/OUT
110
Description
No error
The resulting value is outside the valid number range of the selected data type.
Example for SINT: INC (127) results in -128 which exceeds the data type
maximum.
Programming instructions
6.1 Basic instructions
FBD
Click below the box name and select a data
type from the drop-down menu.
Note
The IN and OUT parameters must be the same data type.
Parameter
Data type
Description
IN
OUT
Condition codes
ENO status
Description
No error
The result value is outside the valid number range of the selected data type.
Example for SINT: ABS (-128) results in +128 which exceeds the data type maximum.
111
Programming instructions
6.1 Basic instructions
LAD
FBD
Click below the box name and select a data
type from the drop-down menu.
Note
The IN1, IN2, and OUT parameters must be the same data type.
Parameter
Data type
Description
IN1, IN2
OUT
Condition codes
ENO status
Description
No error
Limit instruction
You use the Limit instruction to test if the value of parameter IN is inside the value range
specified by parameters MIN and MAX. The OUT value is clamped at the MIN or MAX value,
if the IN value is outside this range.
If the value of parameter IN is inside specified range, then the value of IN is stored in
parameter OUT.
If the value of parameter IN is outside of the specified range, then the OUT value is the
value of parameter MIN (if the IN value is less than the MIN value) or the value of
parameter MAX (if the IN value is greater than the MAX value).
112
Programming instructions
6.1 Basic instructions
LAD
FBD
Click below the box name and select a data
type from the drop-down menu.
Note
The MIN, IN, MAX, and OUT parameters must be the same data type.
Parameter
Data type
Description
OUT
Condition codes
ENO status
Description
No error
REAL: If one or more of the values for MIN, IN and MAX is not a number (NAN),
then NAN is returned.
113
Programming instructions
6.1 Basic instructions
FRAC: Fraction (fractional part of floating point number IN = OUT)
EXPT: General exponential (IN1 IN2 = OUT)
LAD
FBD
Click below the box name and select a data
type from the drop-down menu. EXPT
parameters IN1 and OUT are always Real.
You can select the data type for the
exponent parameter IN2.
Parameter
Data type
Description
IN, IN1
Inputs
IN2
OUT
REAL, LREAL
Outputs
Condition codes
ENO
status
Instruction
Condition
Result (OUT)
All
No error
Valid result
SQR
SQRT
LN
EXP
114
+INF
+NAN
IN is negative
-NAN
-NAN
IN is +INF or +NAN
+INF or +NAN
+INF
IN is +/- NAN
+/- NAN
ASIN, ACOS
+NAN
IN is +/- NAN
+/- NAN
ATAN
IN is +/- NAN
+/- NAN
FRAC
+NAN
EXPT
+INF
+NAN
+NAN
Programming instructions
6.1 Basic instructions
6.1.6
Move
LAD
FBD
115
Programming instructions
6.1 Basic instructions
MOVE
Parameter
Data type
Description
IN
Source address
OUT
Destination address
MOVE_BLK, UMOVE_BLK
Parameter
Data type
Description
IN
COUNT
UINT
OUT
The MOVE instruction copies a single data element from the source address specified by the
IN parameter to the destination address specified by the OUT parameter.
The MOVE_BLK and UMOVE_BLK instructions have an additional COUNT parameter. The
COUNT specifies how many data elements are copied. The number of bytes per element
copied depends on the data type assigned to the IN and OUT parameter tag names in the
PLC tag table.
MOVE_BLK and UMOVE_BLK instructions differ in how interrupts are handled:
Interrupt events are queued and processed during MOVE_BLK execution. Use the
MOVE_BLK instruction when the data at the move destination address is not used within
an interrupt OB subprogram or, if used, the destination data does not have to be
consistent. If a MOVE_BLK operation is interrupted, then the last data element moved is
complete and consistent at the destination address. The MOVE_BLK operation is
resumed after the interrupt execution is complete.
Interrupt events are queued but not processed until UMOVE_BLK execution is complete.
Use the UMOVE_BLK instruction when the move operation must be completed and the
destination data consistent, before the execution of an interrupt OB subprogram.
Condition codes
ENO is always true following execution of the MOVE instruction.
116
ENO status
Condition
Result
No error
Programming instructions
6.1 Basic instructions
Fill instructions
You use the FILL_BLK and UFILL_BLK instructions as follows:
FILL_BLK: The interruptible fill instruction fills an address range with copies of a specified
data element.
UFILL_BLK: The uninterruptible fill instruction fills an address range with copies of a
specified data element.
Note
Rules for data fill operations
To fill with the BOOL data type, use SET_BF, RESET_BF, R, S, or output coil (LAD)
To fill with a single elementary data type, use MOVE
To fill an array with an elementary data type, use FILL_BLK or UFILL_BLK
To fill a single character in a string, use MOVE
The FILL_BLK and UFILL_BLK instructions cannot be used to fill arrays in the I, Q, or
M memory areas.
LAD
FBD
Parameter
Data type
Description
IN
COUNT
USINT, UINT
OUT
The FILL_BLK and UFILL_BLK instructions copy the source data element IN to the
destination where the initial address is specified by the parameter OUT. The copy process
repeats and a block of adjacent addresses is filled until the number of copies is equal to the
COUNT parameter.
117
Programming instructions
6.1 Basic instructions
FILL_BLK and UFILL_BLK instructions differ in how interrupts are handled:
Interrupt events are queued and processed during FILL_BLK execution. Use the
FILL_BLK instruction when the data at the move destination address is not used within an
interrupt OB subprogram or, if used, the destination data does not have to be consistent.
Interrupt events are queued but not processed until UFILL_BLK execution is complete.
Use the UFILL_BLK instruction when the move operation must be completed and the
destination data consistent, before the execution of an interrupt OB subprogram.
Condition codes
6.1.6.1
ENO status
Condition
Result
No error
Swap instruction
You use the SWAP instruction to reverse the byte order for two-byte and four-byte data
elements. No change is made to the bit order within each byte. ENO is always TRUE
following execution of the SWAP instruction.
LAD
FBD
Click below the box name and select a data
type from the drop menu.
118
Parameter
Data type
Description
IN
WORD, DWORD
OUT
WORD, DWORD
Address
MB0
MB1
MB4 MB5
W#16#1234
12
34
34
WORD
MSB
LSB
MSB LSB
Address
MB0
DW#16#
12345678
12
34
78
78
DWORD
MSB
LSB
MSB
56
12
56
34
12
LSB
Programming instructions
6.1 Basic instructions
6.1.7
Convert
Convert instruction
You use the CONVERT instruction to convert a data element from one data type to another
data type. Click below the box name and then select IN and OUT data types from the
dropdown list. After you select the (convert from) data type, a list of possible conversions is
shown in the (convert to) dropdown list. Conversions from and to BCD16 are restricted to the
INT data type. Conversions from and to BCD32 are restricted to the DINT data type.
LAD
FBD
Click below the box name and select data
types from the drop-down menus.
Parameter
Data type
Description
IN
IN value
OUT
Condition codes
ENO status
Description
Result OUT
No error
Valid result
119
Programming instructions
6.1 Basic instructions
LAD
FBD
Parameter
Data type
Description
IN
REAL, LREAL
OUT
Condition codes
ENO status
Description
Result OUT
No error
Valid result
120
FBD
Programming instructions
6.1 Basic instructions
Parameter
Data type
Description
IN
REAL, LREAL
OUT
Converted output
Condition codes
6.1.7.1
ENO status
Description
Result OUT
No error
Valid result
FBD
Click below the box name and select a data
type from the drop-down menu.
Parameter
Data type
Description
MIN
VALUE
SCALE_X: REAL
121
Programming instructions
6.1 Basic instructions
Parameter
Data type
Description
MAX
OUT
NORM_X: REAL
Note
SCALE_X parameter VALUE should be restricted to ( 0.0 <= VALUE <= 1.0 )
If parameter VALUE is less than 0.0 or greater than 1.0:
The linear scaling operation can produce OUT values that are less than the parameter
MIN value or above the parameter MAX value for OUT values that fit within the value
range of the OUT data type. SCALE_X execution sets ENO = TRUE for these cases.
It is possible to generate scaled numbers that are not within the range of the OUT data
type. For these cases, the parameter OUT value is set to an intermediate value equal to
the least-significant portion of the scaled real number prior to final conversion to the OUT
data type. SCALE_X execution sets ENO = FALSE in this case.
NORM_X parameter VALUE should be restricted to ( MIN <= VALUE <= MAX )
If parameter VALUE is less than MIN or greater than MAX, the linear scaling operation can
produce normalized OUT values that are less than 0.0 or greater than 1.0. NORM_X
execution sets ENO = TRUE in this case.
Condition codes
ENO status
Condition
Result OUT
No error
Valid result
122
Programming instructions
6.1 Basic instructions
6.1.8
Program control
FBD
Parameter
Data type
Description
Label_name
Label identifier
You create your label names by typing in the LABEL instruction directly. The available label
names for the JMP and JMPN label name field can be selected using the parameter helper
icon. You can also type a label name directly into the JMP or JMPN instruction.
FBD
Parameter
Data type
Description
Return_Value
BOOL
123
Programming instructions
6.1 Basic instructions
The optional RET instruction is used to terminate the execution of the current block. If and
only if there is power flow to the RET coil (LAD) or if the RET box input is true (FBD), then
program execution of the current block will end at that point and instructions beyond the RET
instruction will not be executed. If the current block is an OB, the "Return_Value" parameter
is ignored. If the current block is a FC or FB, the value of the "Return_Value " parameter is
passed back to the calling routine as the ENO value of the calling box.
You are not required to use a RET instruction as the last instruction in a block; this is done
automatically for you. You can have multiple RET instructions within a single block.
Sample steps for using the RET instruction inside an FC code block:
1. Create a new project and add an FC:
2. Edit the FC:
Add instructions from the instruction tree.
Add a RET instruction, including one of the following for the "Return_Value"
parameter:
TRUE, FALSE, or a memory location that specifies the required return value.
Add more instructions.
3. Call the FC from MAIN [OB1].
The EN input on the FC box in the MAIN code block must be true to begin execution of the
FC.
The value specified by the RET instruction in the FC will be present on the ENO output of the
FC box in the MAIN code block following execution of the FC for which power flow to the
RET instruction is true.
6.1.9
Logical operations
FBD
Click below the box name and select a data
type from the drop menu.
124
Programming instructions
6.1 Basic instructions
Parameter
Data type
Description
IN1, IN2
Logical inputs
OUT
Logical output
The data type selection sets parameters IN1, IN2, and OUT to the same data type. The
corresponding bit values of IN1 and IN2 are combined to produce a binary logic result, at
parameter OUT. ENO is always TRUE following the execution of these instructions.
Invert instruction
You use the INV instruction to get the binary one's complement of the parameter IN. The
one's complement is formed by inverting each bit value of the IN parameter (changing each
0 to 1 and each 1 to 0). ENO is always TRUE following the execution of this instruction.
LAD
FBD
Click below the box name and select a data
type from the drop-down menu.
Parameter
Data type
Description
IN
OUT
Inverted output
FBD
Click below the box name and select a data
type from the drop-down menu.
125
Programming instructions
6.1 Basic instructions
Parameter
Data type
Description
IN
DECO: UINT
OUT
ENCO: INT
The ENCO instruction converts parameter IN to the binary number corresponding to the bit
position of the least-significant set bit of parameter IN and returns the result to parameter
OUT. If parameter IN is either 0000 0001 or 0000 0000, then a value of 0 is returned to OUT.
If the parameter IN value is 0000 0000, then ENO is set to FALSE.
The DECO instruction decodes a binary number from parameter IN, by setting the
corresponding bit position in parameter OUT to a 1 (all other bits are set to 0). ENO is
always TRUE following execution of the DECO instruction.
The DECO parameter OUT data type selection of a BYTE, WORD, or DWORD restricts the
useful range of parameter IN. If the value of parameter IN exceeds the useful range, then a
modulo operation is performed to extract the least significant bits shown below.
DECO parameter IN range:
3 bits (values 0-7) IN are used to set 1 bit position in a byte OUT
4-bits (values 0-15) IN are used to set 1 bit position in a word OUT
5 bits (values 0-31) IN are used to set 1 bit position in a double word OUT
DECO IN value
Min. IN
00000001
Max. IN
10000000
Min. IN
0000000000000001
Max. IN
15
1000000000000000
00000000000000000000000000000001
Max. IN
31
10000000000000000000000000000000
126
ENO status
Condition
Result (OUT)
No error
IN is zero
Programming instructions
6.1 Basic instructions
FBD
Click below the box name and select a data
type from the drop-down menu.
Data type
Description
BOOL
Selector switch:
FALSE for IN0
TRUE for IN1
IN0, IN1
Inputs
OUT
Output
Data type
Description
UINT
Selector value:
0 for IN0
1 for IN1
...
Inputs
127
Programming instructions
6.1 Basic instructions
Parameter
Data type
Description
ELSE
OUT
Output
Input variables and the output variable must be of the same data type.
The SEL instruction always selects between two IN values.
The MUX instruction has two IN parameters when first placed in the program editor, but it
can be expanded to add more IN parameters.
Use the following methods to add and remove input parameters for the MUX instruction:
To add an input, right-click on an input stub for one of the existing IN parameters and
select the "Insert input" command.
To remove an input, right-click on an input stub for one of the existing IN parameters
(when there are more than the original two inputs) and select the "Delete" command.
Condition codes
ENO is always TRUE following execution of the SEL instruction.
ENO status (MUX)
MUX condition
No error
No ELSE provided:
OUT is unchanged
ELSE provided:
ELSE value assigned to OUT
6.1.10
Shift instruction
You use the shift instructions to shift the bit pattern of parameter IN. The result is assigned to
parameter OUT. Parameter N specifies the number of bit positions shifted:
SHR: Shift bit pattern right.
SHL: Shift bit pattern left.
LAD
FBD
Click below the box name and select a data
type from the drop-down list.
128
Programming instructions
6.1 Basic instructions
Parameter
Data type
Description
IN
UINT
OUT
Rotate instruction
You use the rotate instructions to rotate the bit pattern of parameter IN. The result is
assigned to parameter OUT. Parameter N defines the number of bit positions rotated.
ROR: Rotate bit pattern right
ROL: Rotate bit pattern left
LAD
FBD
Click below the box name and select a data
type from the drop-down menu.
Parameter
Data type
Description
IN
UINT
OUT
129
Programming instructions
6.2 Extended instructions
If the number of bit positions to rotate (N) exceeds the number of bits in the target value
(8 for BYTE, 16 for WORD, 32 for DWORD), then the rotation is still performed.
ENO is always TRUE following execution of the rotate instructions.
ROR example for WORD size data: Rotate bits out the right -side into the left -side
IN
6.2
Extended instructions
6.2.1
Size (bits)
32
Stored as
Valid ranges
T#-24d_20h_31m_23s_648ms to
T#24d_20h_31m_23s_647ms
-2,147,483,648 ms to +2,147,483,647 ms
130
Year: UINT
16
1970 to 2554
Month: USINT
1 to 12
Day: USINT
1 to 31
Weekday: USINT
1=Sunday to 7=Saturday
Hour: USINT
0 to 23
Minute: USINT
0 to 59
Second: USINT
0 to 59
Nanoseconds: UDINT
32
0 to 999,999,999
Programming instructions
6.2 Extended instructions
LAD
FBD
Select the IN and OUT data types from the
drop-down lists available below the
instruction name.
Parameter
Parameter
type
Data type
Description
IN
IN
DINT, TIME
OUT
OUT
DINT, TIME
T_CONV (Time Convert) converts a TIME data type to a DINT data type, or the reverse
conversion from DINT data type to TIME data type.
LAD
FBD
Select the IN1 data type from the drop-down
list available below the instruction name.
The IN1 data type selection also sets the
data type of parameter OUT.
Parameter
Parameter
type
Data type
Description
IN1
IN
DTL, TIME
IN2
IN
TIME
OUT
OUT
DTL, TIME
T_ADD (Time Add) adds the input IN1 value (DTL or TIME data types) with the input IN2
TIME value. Parameter OUT provides the DTL or TIME value result. Two data type
operations are possible, as shown below:
TIME + TIME = TIME
DTL + TIME = DTL
LAD
FBD
Select the IN1 data type from the drop-down
list available below the instruction name.
The IN1 data type selection also sets the
data type of parameter OUT.
131
Programming instructions
6.2 Extended instructions
Parameter
Parameter
type
Data type
Description
IN1
IN
DTL, TIME
IN2
IN
TIME
OUT
OUT
DTL, TIME
T_SUB (Time Subtract) subtracts the IN2 TIME value from IN1 (DTL or Time value).
Parameter OUT provides the difference value as a DTL or TIME data type. Two data type
operations are possible:
TIME - TIME = TIME
DTL - TIME = DTL
LAD
FBD
Parameter
Parameter
type
Data type
Description
IN1
IN
DTL
DTL value
IN2
IN
DTL
OUT
OUT
TIME
TIME difference
T_DIFF (Time Difference) subtracts the IN2 DTL value from IN1 DTL value. Parameter OUT
provides the difference value as a TIME data type.
DTL - DTL = TIME.
Condition codes
ENO = 1 means no error occurred.
ENO = 0 and parameter OUT = 0 errors:
Invalid DTL value
Invalid TIME value
Clock instructions
You use the clock instructions to set and read the PLC system clock. The data type DTL is
used to provide date and time values.
DTL structure
132
Size
Valid ranges
Year: UINT
16 bits
1970 to 2554
Month: USINT
8 bits
1 to 12
Programming instructions
6.2 Extended instructions
DTL structure
Size
Valid ranges
Day: USINT
8 bits
1 to 31
Weekday: USINT
8 bits
1=Sunday to 7=Saturday
Hour: USINT
8 bits
0 to 23
Minute: USINT
8 bits
0 to 59
Second: USINT
8 bits
0 to 59
Nanoseconds: UDINT
32 bits
0 to 999,999,999
LAD
FBD
Parameter
Parameter
type
Data type
Description
IN
IN
DTL
RET_VAL
OUT
INT
WR_SYS_T (Write System Time) sets the PLC time of day clock with a DTL value at
parameter IN. This time value does not include local time zone or daylight saving time
offsets.
LAD
Parameter
FBD
Parameter
type
Data type
Description
RET_VAL
OUT
INT
OUT
OUT
DTL
RD_SYS_T (Read System Time) reads the current system time from the PLC. This time
value does not include local time zone or daylight saving time offsets.
133
Programming instructions
6.2 Extended instructions
LAD
FBD
Parameter
Parameter
type
Data type
Description
RET_VAL
OUT
INT
OUT
OUT
DTL
Local time
RD_LOC_T (Read Local Time) provides the current local time of the PLC as a DTL data
type.
The local time is calculated by using the time zone and daylight saving time offsets that
you set in the CPU Clock device configuration.
Time zone configuration is an offset to Coordinated Universal Time (UTC) system time.
Daylight saving time configuration specifies the month, week, day, and hour when
daylight saving time begins.
Standard time configuration also specifies the month, week, day, and hour when standard
time begins.
The time zone offset is always applied to the system time value. The daylight saving time
offset is only applied when daylight saving time is in effect.
Condition codes
ENO = 1 means no error occurred. ENO = 0 means an execution error occurred, and a
condition code is provided at the RET_VAL output.
134
RET_VAL (W#16#....)
Description
0000
No error
8080
8081
8082
8083
8084
8085
8086
8087
80B0
Programming instructions
6.2 Extended instructions
6.2.2
6.2.2.1
FBD
Select the parameter data types from the
drop-down lists.
S_CONV (String Convert) converts a character string to the corresponding value, or a value
to the corresponding character string. The S_CONV instruction has no output formatting
options. This makes the S_CONV instruction simpler, but less flexible, than the STRG_VAL
and VAL_STRG instructions.
Parameter
type
Data type
Description
IN
IN
STRING
OUT
OUT
Conversion of the string parameter IN starts at the first character and continues until the end
of the string, or until the first character is encountered that is not "0" through "9", "+", "-", or
".". The result value is provided at the location specified in parameter OUT. If the output
number value does not fit in the range of the OUT data type, then parameter OUT is set to 0
and ENO is set to FALSE. Otherwise, parameter OUT contains a valid result and ENO is set
to TRUE.
Input string format rules:
If a decimal point is used in the IN string, you must use the "." character.
Comma characters "," used as a thousands separator to the left of the decimal point are
allowed and ignored.
135
Programming instructions
6.2 Extended instructions
Leading spaces are ignored.
Only fixed-point representation is supported. The characters "e" and "E" are not
recognized as exponential notation.
Parameter
type
Data type
Description
IN
IN
OUT
OUT
STRING
Example
USINT
255
SINT
-128
UINT
65535
INT
-32768
UDINT
10
4294967295
12
DINT
11
-2147483648
13
136
Programming instructions
6.2 Extended instructions
STRG_VAL instruction
LAD
FBD
Parameter
Parameter
type
Data type
Description
IN
IN
STRING
FORMAT
IN
WORD
IN_OUT
UINT
OUT
OUT
Bit 8 Bit 7
0
Bit 0
0
f = Notation format
1= Exponential notation
0 = Fixed point notation
137
Programming instructions
6.2 Extended instructions
FORMAT (W#16#)
Notation format
0000 (default)
Fixed point
"."
0001
","
0002
Exponential
0003
"."
","
0004 to FFFF
Illegal values
VAL_STRG instruction
LAD
FBD
Parameter
Parameter
type
Data type
Description
IN
IN
Value to convert
SIZE
IN
USINT
PREC
IN
USINT
FORMAT
IN
WORD
IN_OUT
UINT
OUT
138
OUT
STRING
Programming instructions
6.2 Extended instructions
VAL_STRG (Value to String) converts an integer, unsigned integer, or floating point value to
the corresponding character string representation. The value represented by parameter IN is
converted to a string referenced by parameter OUT. The parameter OUT must be a valid
string before the conversion is executed. The converted string will replace characters in the
OUT string starting at character offset count P to the number of characters specified by
parameter SIZE. The number of characters in SIZE must fit within the OUT string length,
counting from character position P. This instruction is useful for embedding number
characters into a text string. For example, you can put the numbers "120" into the string
"Pump pressure = 120 psi".
Parameter PREC specifies the precision or number of digits for the fractional part of the
string. If the parameter IN value is an integer, then PREC specifies the location of the
decimal point. For example, if the data value is 123 and PREC = 1, then the result is "12.3".
The maximum supported precision for the REAL data type is 7 digits.
If parameter P is greater than the current size of the OUT string, then spaces are added, up
to position P, and the result is appended to the end of the string. The conversion ends if the
maximum OUT string length is reached.
Bit 8 Bit 7
0
Bit 0
0
f = Notation format
1= Exponential notation
0 = Fixed point notation
FORMAT (WORD)
Notation format
W#16#0000
"-" only
Fixed point
W#16#0001
Exponential
W#16#0003
"+" and "-"
Fixed Point
W#16#0007
Decimal point
representation
"."
"."
"."
","
Exponential
W#16#0006
","
W#16#0005
W#16#0008 to
W#16#FFFF
","
W#16#0002
W#16#0004
"."
","
Illegal values
139
Programming instructions
6.2 Extended instructions
Parameter OUT string format rules:
Leading space characters are added to the leftmost part of the string when the converted
string is smaller than the specified size.
When the FORMAT parameter sign bit is FALSE, unsigned and signed integer data type
values are written to the output buffer without the leading "+" sign. The "-" sign is used if
required.
<leading spaces><digits without leading zeroes>'.'<PREC digits>
When the sign bit is TRUE, unsigned and signed integer data type values are written to
the output buffer always with a leading sign character.
<leading spaces><sign><digits without leading zeroes>'.'<PREC digits>
When the FORMAT is set to exponential notation, REAL data type values are written to
the output buffer as:
<leading spaces><sign><digit> '.' <PREC digits>'E' <sign><digits without leading zero>
When the FORMAT is set to fixed point notation, integer, unsigned integer, and real data
type values are written to the output buffer as:
<leading spaces><sign><digits without leading zeroes>'.'<PREC digits>
Leading zeros to the left of the decimal point (except the digit adjacent to the decimal
point) are suppressed.
Values to the right of the decimal point are rounded to fit in the number of digits to the
right of the decimal point specified by the PREC parameter.
The size of the output string must be a minimum of three bytes more than the number of
digits to the right of the decimal point.
Values are right-justified in the output string.
140
Description
No error
Illegal or invalid parameter; for example, an access to a DB that does not exist
Illegal string where the current length is greater than the maximum length
The converted number value is too large for the specified OUT data type
The OUT parameter maximum string size must be large enough to accept the number
of characters specified by parameter SIZE, starting at the character position
parameter P
Illegal P value where P=0 or P is greater than the current string length
Programming instructions
6.2 Extended instructions
OUT value
ENO
"123"
INT/DINT
123
TRUE
"-00456"
INT/DINT
-456
TRUE
"123.45"
INT/DINT
123
TRUE
"+2345"
INT/DINT
2345
TRUE
"00123AB"
INT/DINT
123
TRUE
"123"
REAL
123.0
TRUE
"123.45"
REAL
123.45
TRUE
"1.23e-4"
REAL
1.23
TRUE
"1.23E-4"
REAL
1.23
TRUE
"12,345.67"
REAL
12345.67
TRUE
"3.4e39"
REAL
3.4
TRUE
"-3.4e39"
REAL
-3.4
TRUE
"1.17549e-38"
REAL
1.17549
TRUE
"12345"
SINT
FALSE
"A123"
N/A
FALSE
""
N/A
FALSE
"++123"
N/A
FALSE
"+-123"
N/A
FALSE
IN value
OUT string
ENO
UINT
123
"123"
TRUE
UINT
"0"
TRUE
UDINT
12345678
"12345678"
TRUE
REAL
-INF
"INF"
FALSE
REAL
+INF
"INF"
FALSE
REAL
NaN
"NaN"
FALSE
FORMAT
(W#16#....)
OUT value
ENO
"123"
0000
INT/DINT
123
TRUE
"-00456"
0000
INT/DINT
-456
TRUE
"123.45"
0000
INT/DINT
123
TRUE
"+2345"
0000
INT/DINT
2345
TRUE
141
Programming instructions
6.2 Extended instructions
IN string
FORMAT
(W#16#....)
OUT value
ENO
"00123AB"
0000
INT/DINT
123
TRUE
"123"
0000
REAL
123.0
TRUE
"-00456"
0001
REAL
-456.0
TRUE
"+00456"
0001
REAL
456.0
TRUE
"123.45"
0000
REAL
123.45
TRUE
"123.45"
0001
REAL
12345.0
TRUE
"123,45"
0000
REAL
12345.0
TRUE
"123,45"
0001
REAL
123.45
TRUE
".00123AB"
0001
REAL
123.0
TRUE
"1.23e-4"
0000
REAL
1.23
TRUE
"1.23E-4"
0000
REAL
1.23
TRUE
"1.23E-4"
0002
REAL
1.23E-4
TRUE
"12,345.67"
0000
REAL
12345.67
TRUE
"12,345.67"
0001
REAL
12.345
TRUE
"3.4e39"
0002
REAL
+INF
TRUE
"-3.4e39"
0002
REAL
-INF
TRUE
"1.1754943e-38"
(and smaller)
0002
REAL
0.0
TRUE
"12345"
N/A
SINT
FALSE
"A123"
N/A
N/A
FALSE
""
N/A
N/A
FALSE
"++123"
N/A
N/A
FALSE
"+-123"
N/A
N/A
FALSE
142
Data
type
IN value
SIZE
FORMAT
(W#16#....)
PREC
UINT
123
16
10
0000
UINT
16
10
0000
UDINT
12345678
16
10
0000
UDINT
12345678
16
10
0001
INT
123
16
10
0004
INT
-123
16
10
0004
REAL
-0.00123
16
10
0004
OUT string
Current Temp
xxxxxxx123 C
Current Temp
xxxxxx0.00 C
Current Temp
x12345.678 C
Current Temp
x12345,678 C
Current Temp
xxxxxx+123 C
Current Temp
xxxxxx-123 C
Current Temp
xxx-0.0012 C
ENO
=
TRUE
TRUE
TRUE
TRUE
TRUE
TRUE
TRUE
Programming instructions
6.2 Extended instructions
6.2.2.2
Data
type
IN value
SIZE
FORMAT
(W#16#....)
PREC
REAL
-0.00123
16
10
0006
REAL
-INF
16
10
N/A
REAL
+INF
16
10
N/A
REAL
NaN
16
10
N/A
UDINT
12345678
16
N/A
OUT string
Current Temp
-1.2300E-3 C
Current Temp
xxxxxx-INF C
Current Temp
xxxxxx+INF C
Current Temp
xxxxxxxNaN C
Current Temp
xxxxxxxxxx C
ENO
=
TRUE
FALSE
FALSE
FALSE
FALSE
CONCAT
LEFT
RIGHT
MID
DELETE
143
Programming instructions
6.2 Extended instructions
INSERT
REPLACE
FIND
LEN
Parameter
Parameter
type
Data type
Description
IN
IN
STRING
Input string
OUT
OUT
UINT
LEN (Length of string) gives the current length of the string IN at output OUT. An empty
string has a length of zero.
144
Programming instructions
6.2 Extended instructions
CONCAT
Parameter
Parameter
type
Data type
Description
IN1
IN
STRING
Input string 1
IN2
IN
STRING
Input string 2
OUT
OUT
STRING
CONCAT (Concatenate strings) joins STRING parameters IN1 and IN2 to form one string
provided at OUT. After concatenation, String IN1 is the left part and String IN2 is the right
part of the combined string. If the combined string is longer than the maximum allowed
length, the result string is limited to the maximum length and ENO is set to 0.
LEFT
Parameter
Parameter
type
Data type
Description
IN
IN
STRING
Input string
IN
INT
Length of the substring to be created, using the leftmost L characters of the IN string
OUT
OUT
STRING
Output string
LEFT (Left substring) provides a substring made of the first L characters of string parameter
IN.
If L is greater than the current length of the IN string, then the entire IN string is returned
in OUT.
If an empty string is the input, then an empty string is returned in OUT.
If L is negative or zero, then an empty string is returned and ENO is set to 0.
RIGHT
Parameter
Parameter
type
Data type
Description
IN
IN
STRING
Input string
IN
INT
Length of the substring to be created, using the rightmost L characters of the IN string
OUT
OUT
STRING
Output string
145
Programming instructions
6.2 Extended instructions
MID
Parameter
Parameter
type
Data type
Description
IN
IN
STRING
Input string
IN
INT
IN
INT
OUT
OUT
STRING
Output string
MID (Middle substring) provides the middle part of a string. The middle substring is L
characters long and starts at character position P (inclusive).
If the sum of L and P exceeds the current length of the STRING parameter IN, then a
substring is returned that starts at character position P and continues to the end of the IN
string.
If character position P is outside the current IN string length, then an empty string is
returned at OUT and ENO is set to 0.
If parameters P or L are equal to zero or negative, then an empty string is returned at
OUT and ENO is set to 0.
DELETE
Parameter
Parameter
type
Data type
Description
IN
IN
STRING
Input string
IN
INT
IN
INT
OUT
OUT
STRING
Output string
DELETE (Delete substring) deletes L characters from string IN. Character deletion starts at
character position P (inclusive), and the remaining substring is provided at parameter OUT.
If L is equal to zero, then the input string is returned in OUT and ENO = TRUE.
If P is greater than the current length of the string IN, then the input string is returned in
OUT and ENO = FALSE.
If the sum of L and P is greater than the length of the input string, then the string is
deleted to the end.
If L is negative, or if P is equal to 0 or negative, then an empty string is returned and ENO
= FALSE.
STRING data must be initialized before execution as a valid string in memory.
146
Programming instructions
6.2 Extended instructions
INSERT
Parameter
Parameter
type
Data type
Description
IN1
IN
STRING
Input string 1
IN2
IN
STRING
Input string 2
IN
INT
OUT
OUT
STRING
Result string
INSERT (Insert substring) inserts string IN2 into string IN1. Insertion begins after the
character at position P.
If P is greater than the current length of the IN1 string, then the IN2 string is appended to
IN1 and ENO = FALSE.
If P is negative or zero, then parameter OUT is an empty string and ENO = FALSE.
If the new string length after insertion is longer than the maximum allowed for string OUT,
then the result string is limited to the maximum length of parameter OUT and ENO =
FALSE.
REPLACE
Parameter
Parameter
type
Data type
Description
IN1
IN
STRING
Input string
IN2
IN
STRING
IN
INT
IN
INT
OUT
OUT
STRING
Result string
147
Programming instructions
6.2 Extended instructions
FIND
Parameter
Parameter
type
Data type
Description
IN1
IN
STRING
IN2
IN
STRING
OUT
OUT
INT
FIND (Find substring) provides the character position of the substring or character specified
by IN2 within the string IN1. The search starts on the left. The character position of the first
occurrence of IN2 string is returned at OUT. If the string IN2 is not found in the string IN1,
then zero is returned.
Condition
OUT
ENO
Condition
OUT
No errors detected
Valid characters
CONCAT
Condition
OUT
No errors detected
Valid characters
LEFT
ENO
148
Programming instructions
6.2 Extended instructions
ENO
Condition
OUT
ENO
Condition
OUT
No errors detected
Valid characters
RIGHT
Condition
OUT
No errors detected
Valid characters
MID
ENO
Condition
OUT
No errors detected
Valid characters
DELETE
ENO
149
Programming instructions
6.2 Extended instructions
ENO
Condition
OUT
Condition
OUT
No errors detected
Valid characters
INSERT
ENO
ENO
Condition
OUT
No errors detected
Valid characters
REPLACE
150
Programming instructions
6.2 Extended instructions
ENO
Condition
OUT
FIND
ENO
Condition
OUT
No errors detected
6.2.3
6.2.3.1
The RE_TRIGR instruction is used to re-start the scan cycle timer during a single scan cycle.
This has the effect of extending the allowed maximum scan cycle time by one maximum
cycle time period, from the last execution of the RE_TRIGR function.
The S7-1200 CPUs restrict the use of the RE_TRIGR instruction to the program cycle, for
example, OB1 and functions that are called from the program cycle. This means that the
watchdog timer is reset, and ENO = EN, if RE_TRIGR is called from any OB of the program
cycle OB list.
ENO = FALSE and the watchdog timer is not reset if RE_TRIGR is executed from a start up
OB, an interrupt OB, or an error OB.
151
Programming instructions
6.2 Extended instructions
Minimum value
Maximum value
Default value
1 ms
6000 ms
150 ms
Watchdog timeout
If the maximum scan cycle timer expires before the scan cycle has been completed, an error
is generated. If the error handling code block OB80 is included in the user program, the PLC
executes OB 80 where you may add program logic to create a special reaction. If OB80 is
not included, the first timeout condition is ignored.
If a second maximum scan time timeout occurs in the same program scan (2 times the
maximum cycle time value), an error is triggered that causes the PLC to transition to STOP
mode.
In STOP mode, your program execution stops while PLC system communications and
system diagnostics continue.
6.2.3.2
STP (Stop PLC scan cycle) puts the PLC in Stop mode. When the PLC is in Stop mode, the
execution of your program and output Q address updates from the process image are
stopped.
Stop transition output safe states for integrated, signal board, and signal module outputs
(digital or analog) are set in the PLC device configuration properties tab. You have the option
to freeze outputs in the last state or set up (digital or analog) output safe states. The default
state for digital outputs is FALSE and the default value for analog outputs is 0.
If EN = TRUE, then the PLC will enter STOP mode, program execution stops, and the ENO
state is meaningless. Otherwise, EN = ENO = 0.
6.2.3.3
152
Programming instructions
6.2 Extended instructions
GET_ERROR
LAD
FBD
Parameter
Data type
Description
ERROR
ErrorStruct
Data
type
Description
ERROR_ID
FLAGS
BYTE
REACTION
BYTE
BLOCK_TYPE
BYTE
PAD_0
BYTE
CODE_BLOCK_NUMBER
UINT
ADDRESS
UDINT
MODE
BYTE
(A)
(B)
(C)
(D)
(E)
0
1
Offset
2
3
Location
Scope
Number
Area
Area
DB no.
Offset
Area
DB no.
Offset
Area
PtrNo./Acc
Offset
153
Programming instructions
6.2 Extended instructions
ErrorStruct data element
Data
type
Description
7
PtrNo./Acc
Slot No./
Scope
Area
DB no.
Offset
PAD_1
BYTE
OPERAND_NUMBER
UINT
POINTER_NUMBER_
LOCATION
UINT
SLOT_NUMBER_SCOPE
UINT
AREA
BYTE
PAD_2
BYTE
DB_NUMBER
UINT
OFFSET
UDINT
GET_ERR_ID
LAD
FBD
Parameter
Data type
Description
ID
WORD
Error identifier
Parameter ID: Error identifier values for the ErrorStruct ERROR_ID member
154
ERROR_ID
Hexadecimal
ERROR_ID
Decimal
2503
9475
2522
9506
2523
9507
2524
9508
2525
9509
2528
9512
2529
9513
2530
9520
DB Write Error
Programming instructions
6.2 Extended instructions
ERROR_ID
Hexadecimal
ERROR_ID
Decimal
253A
9530
253C
9532
253D
9533
253E
9534
253F
9535
2575
9589
2576
9590
2942
10562
2943
10563
Operation
By default, the PLC will respond to a block execution error by logging an error in the
diagnostic buffer and transitioning to STOP mode. However, if you place one or more
GET_ERROR or ERR_ID instructions within a code block, this block is now set to handle
errors within the block. In this case, the PLC does not transition to STOP and does not log
an error in the diagnostics buffer. Instead, the error information is reported in the output of
the GET_ERROR or GET_ERR_ID instruction. You can read the detailed error information
with the GET_ERROR instruction, or read just the error identifier with GET_ERR_ID
instruction. Normally the first error is the most important, with the following errors only
consequences of the first error.
The first execution of a GET_ERROR or GET_ERR_ID instruction within a block returns the
first error detected during block execution. This error could have occurred anywhere
between the start of the block and the execution of either GET_ERROR or GET_ERR_ID.
Subsequent executions of either GET_ERROR or GET_ERR_ID return the first error since
the previous execution of GET_ERROR or GET_ERR_ID. The history of errors is not saved,
and execution of either instruction will re-arm the PLC system to catch the next error.
The ErrorStruct data type used by the GET_ERROR instruction can be added in the Data
block editor and block interface editors, so your program logic can access these values.
Select ErrorStruct from the data type drop-down list to add this structure. You can create
multiple ErrorStructs by using unique names. The members of an ErrorStruct cannot be
renamed.
155
Programming instructions
6.2 Extended instructions
6.2.4
Communications instructions
6.2.4.1
LEN and DATA as send parameters for TSEND, TSEND_C, and PTP_SEND
You may use all data types except BOOL and arrays of BOOL for the DATA parameter. The
LEN parameter defines the count of transferred bytes.
LEN = 0
The complete data is sent as defined at the DATA parameter. You do not need to specify the number
of transmitted bytes when LEN = 0.
DATA reference to
send
LEN > 0
The LEN value must contain the byte count of this data type. Otherwise,
nothing is transferred and the error 8088H is returned.
The LEN value may contain a byte count less than the complete byte length
of the structure. In this case, only the first LEN bytes are transferred.
The LEN value may contain a byte count that is less than the complete byte
length of the array. In this case, only array elements which fit completely in
LEN bytes are transferred.
The LEN value must be a multiple of the data element byte count.
Otherwise, STATUS = 8088H, ERROR = 1, and no transmit occurs.
The complete memory layout of the string format is transferred. The LEN
value must include bytes for maximum length, actual length, and the string
characters.
For the STRING data type, all lengths and characters have a byte size.
If a string is used as actual parameter at the DATA parameter, the LEN
value must also include two bytes for the two length fields.
LEN and DATA as receive parameters for TRCV, TRCV_C, and PTP_RCV
You may use all data types except BOOL and arrays of BOOL for the DATA parameter. The
received data is interpreted as if the sender had used the same data type referenced by the
receiver DATA parameter.
LEN = 0
Data which fits in the DATA reference can be received. You do not need to specify the number of
received bytes when LEN = 0. The actual count of received bytes is returned by the RCVD_LEN
parameter.
156
Programming instructions
6.2 Extended instructions
DATA reference
for received data
LEN > 0
Elementary data
type:
The LEN value must contain the byte count of this data type. Otherwise, the
STATUS parameter is set to 8088H, ERROR is set to 1, and nothing can be
received.
Structure data type The LEN value may contain a byte count less than the complete byte length of
in DB created with the structure. In this case only, the first LEN bytes of the structure are received.
"Symbolic access
only" disabled
Structure data type The LEN value must be equal to zero. Otherwise, the data are not transferred,
in DB created with STATUS is set to 8088H, and ERROR is set to 1.
"Symbolic access
only" enabled
Array data type
The LEN value may be a byte count less than the complete byte length of the
array.
6.2.4.2
TSEND_C function
To establish a connection, execute TSEND_C with CONT = 1.
After successful establishing of the connection, TSEND_C sets the DONE parameter for
one cycle.
157
Programming instructions
6.2 Extended instructions
To terminate the communication connection, execute TSEND_C with CONT = 0. The
connection will be aborted immediately. This also affects the receiving station. The
connection will be closed there and data inside the receive buffer could be lost.
To send data over an established connection, execute TSEND_C with a rising edge on
REQ. After a successful send operation, TSEND_C sets the DONE parameter for one
cycle.
To establish a connection and send data, execute TSEND_C with CONT =1 and REQ =
1. After a successful send operation, TSEND_C sets the DONE parameter for one cycle.
TRCV_C description
TRCV_C establishes a TCP or ISO on TCP communication connection to a partner CPU,
receives data, and can terminate the connection. After the connection is set up and
established, it is automatically maintained and monitored by the CPU. The TRCV_C
instruction combines the functions of the TCON, TDISCON, and TRCV instructions.
TRCV_C function
1. Establish a connection: Execute TRCV_C with parameter CONT = 1.
2. Receive data: Execute TRCV_C with parameter EN_R = 1. Receive data continuously
when parameters EN_R = 1 and CONT = 1.
3. Terminate the connection: execute TRCV_C with parameter CONT = 0. The connection
will be aborted immediately and data could be lost.
Receive modes
TRCV_C handles the same receive modes as the TRCV instruction.
The following table shows how data is entered in the receive area.
Protocol
variant
Parameter"
connection_type"
TCP
Ad hoc mode
B#16#11
TCP
B#16#11
<> 0
ISO on TCP
protocol-controlled
B#16#12
0 (recommended) or <> 0
158
Programming instructions
6.2 Extended instructions
DONE
ERROR
Description
TRUE
irrelevant
irrelevant
FALSE
TRUE
FALSE
FALSE
FALSE
TRUE
The job was ended with an error. The cause of the error can be
found in the STATUS parameter.
FALSE
FALSE
FALSE
TSEND_C parameters
LAD
FBD
159
Programming instructions
6.2 Extended instructions
Parameter
Parameter
type
Data type
Description
REQ
INPUT
BOOL
CONT
INPUT
BOOL
LEN
INPUT
INT
CONNECT
IN_OUT
ANY
DATA
IN_OUT
ANY
COM_RST
IN_OUT
BOOL
COM_RST parameter:
1: Complete restart of the function block, existing
connection will be terminated.
DONE
OUTPUT
BOOL
BUSY
OUTPUT
BOOL
ERROR
OUTPUT
BOOL
STATUS
OUTPUT
WORD
TRCV_C parameters
LAD
160
FBD
Programming instructions
6.2 Extended instructions
Parameter
Parameter
type
Data type
Description
EN_R
IN
BOOL
CONT
IN
BOOL
LEN
IN
INT
CONNECT
IN_OUT
ANY
DATA
IN_OUT
ANY
COM_RST
IN_OUT
BOOL
COM_RST parameter:
1: Complete restart of the function block; existing
connection will be terminated.
DONE
OUT
BOOL
BUSY
OUT
BOOL
ERROR
OUT
BOOL
STATUS
OUT
WORD
RCVD_LEN
OUT
INT
STATUS
(W#16#...)
Description
0000
7000
7001
7002
7003
7004
161
Programming instructions
6.2 Extended instructions
ERROR
STATUS
(W#16#...)
Description
8085
LEN parameter has the value 0 or is greater than the largest permitted value
8086
8087
8088
LEN parameter is larger than the memory area specified in DATA; receiving
memory area is too small
8089
8091
809A
The CONNECT parameter points to a field that does not match the length of
the connection description.
809B
The local_device_id in the connection description does not match the CPU.
80A1
Communications error:
The specified connection was not yet established
The specified connection is currently being terminated; transmission
over this connection is not possible
The interface is being reinitialized
80A3
80A4
80A7
80B2
80B3
Inconsistent parameters:
Error in the connection description
Local port (parameter local_tsap_id) is already present in another
connection description
ID in the connection description different from the ID specified as
parameter
80B4
162
80C3
Programming instructions
6.2 Extended instructions
ERROR
STATUS
(W#16#...)
Description
80C4
8722
873A
877F
Functional description
TCON, TDISCON, TSEND, and TRCV operate asynchronously, which means that the job
processing extends over multiple instruction executions.
For example, you start a job for setting up and establishing a connection by executing an
instruction TCON with parameter REQ = 1. Then you use additional TCON executions to
monitor the job progress and test for job completion with parameter DONE.
The following table shows the relationships between BUSY, DONE, and ERROR. Use the
table to determine the current job status.
163
Programming instructions
6.2 Extended instructions
TCON, TDISCON, TSEND, and TRCV job status parameters:
BUSY
DONE
ERROR
Description
TRUE
irrelevant
irrelevant
FALSE
TRUE
FALSE
FALSE
FALSE
TRUE
The job was ended with an error. The cause of the error can be
found in the STATUS parameter.
FALSE
FALSE
FALSE
TCON
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
ID
IN
CONN_OUC
(WORD)
CONNECT
IN_OUT
TCON-Param
DONE
OUT
BOOL
BUSY
OUT
BOOL
ERROR
OUT
BOOL
164
OUT
WORD
Programming instructions
6.2 Extended instructions
TDISCON
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
ID
IN
CONN_OUC
(WORD)
DONE
OUT
BOOL
BUSY
OUT
BOOL
ERROR
OUT
BOOL
STATUS
OUT
WORD
Error code
165
Programming instructions
6.2 Extended instructions
TSEND
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
ID
IN
CONN_OUC
(WORD)
LEN
IN
INT
DATA
IN_OUT
VARIANT
DONE
OUT
BOOL
BUSY
OUT
BOOL
ERROR
OUT
BOOL
STATUS
166
OUT
WORD
Programming instructions
6.2 Extended instructions
Note
Due to the asynchronous processing of TSEND, you must keep the data in the sender area
consistent until the DONE parameter or the ERROR parameter assumes the value TRUE.
TRCV
LAD
FBD
Parameter
Parameter
type
Data type
Description
EN_R
IN
BOOL
ID
IN
CONN_OUC
(WORD)
LEN
IN
INT
IN_OUT
VARIANT
NDR
OUT
BOOL
BUSY
OUT
BOOL
167
Programming instructions
6.2 Extended instructions
Parameter
Parameter
type
Data type
Description
ERROR
OUT
BOOL
STATUS
OUT
WORD
RCVD_LEN
OUT
INT
Note
Due to the asynchronous processing of TRCV, the data in the receive area are only
consistent when the NDR parameter assumes the value TRUE.
Receive area
This is the area in which TRCV writes the received data.
The receive area is specified by the following two variables:
Pointer to the start of the area
Length of the area
The length of the area is specified depending on the protocol variant being used by the LEN
parameter (if LEN <> 0), or the length information of the DATA parameter (if LEN = 0).
Parameter
connection type
TCP
Ad hoc mode
B#16#11
TCP
B#16#11
<> 0
ISO on TCP
protocol-controlled
B#16#12
0 (recommended) or <> 0
168
Programming instructions
6.2 Extended instructions
STATUS
(W#16#...)
Explanation
0000
7000
7001
7002
8086
8087
809B
The local_device_id in the connection description does not match the CPU.
80A1
80A2
80A3
80A4
IP address of the remote connection end point is invalid; it may match the
local IP address
80A7
80B3
169
Programming instructions
6.2 Extended instructions
ERROR
STATUS
(W#16#...)
Explanation
80B4
80B5
80B6
80B7
80B8
80C3
80C4
170
STATUS
(W#16#...)
Explanation
0000
7000
7001
7002
8086
80A3
80C4
Programming instructions
6.2 Extended instructions
STATUS
(W#16#...)
Explanation
7000
7001
Start of job processing, data being sent: During this processing the operating
system accesses the data in the DATA send area.
7002
Follow-on call (REQ irrelevant), job being processed: The operating system
accesses the data in the DATA send area during this processing.
8085
LEN parameter has the value 0 or is greater than the largest permitted value.
8086
8088
80A1
Communications error:
The specified connection was not yet established
The specified connection is currently being terminated. Transmission over
this connection is not possible.
The interface is being reinitialized.
80C3
80C4
ERROR
STATUS
(W#16#...)
Explanation
0000
New data accepted: The current length of the received data is shown in
RCVD_LEN.
7000
7001
7002
Follow-on call, receive job being processed: Data is written to the receive
area during this processing For this reason, an error could result in
inconsistent data in the receive area.
8085
The LEN parameter is greater than the largest permitted value, or you
changed the LEN or DATA parameter since the first call.
8086
8088
Receive area is too small: The Value LEN is greater than the receive area
specified by DATA.
171
Programming instructions
6.2 Extended instructions
6.2.4.3
ERROR
STATUS
(W#16#...)
Explanation
80A1
Communications error:
The specified connection has not yet been established
The specified connection is currently being terminated. A receive job over
this connection is not possible.
The interface is receiving new parameters.
80C3
80C4
Point-to-Point instructions
The Point-to-Point (PtP) chapter (Page 245) provides detailed information about the PtP
instructions and the communication modules.
6.2.5
Interrupt instructions
6.2.5.1
172
Programming instructions
6.2 Extended instructions
Parameter
Parameter
type
Data type
Description
OB_NR
IN
INT
EVENT
IN
DWORD
Event identifier:
Select from the available hardware interrupt events
that were enabled in PLC device configuration for
digital inputs or high-speed counters. Double-click
on the parameter field, then click on the helper icon
to see the available events.
ADD
(ATTACH only)
IN
BOOL
RET_VAL
OUT
INT
173
Programming instructions
6.2 Extended instructions
Check box options within the PLC device configuration:
Digital input
Enable rising edge detection
Enable falling edge detection
High-speed counter (HSC)
Enable this high-speed counter for use
Generate interrupt for counter value equals reference value count
Generate interrupt for external reset event
Generate interrupt for direction change event
OB_NR parameter
All existing hardware-interrupt OB names appear in the device configuration "HW interrupt:"
drop-down list and in the ATTACH / DETACH parameter OB_NR drop-list.
EVENT parameter
When a hardware interrupt event is enabled, a unique default event name is assigned to this
particular event. You can change this event name by editing the "Event name:" edit box, but
it must be a unique name. These event names become tag names in the "Constants" tag
table, and appear on the EVENT parameter drop-down list for the ATTACH and DETACH
instruction boxes. The value of the tag is an internal number used to identify the event.
General operation
Each hardware event can be attached to a hardware-interrupt OB which will be queued for
execution when the hardware interrupt event occurs. The OB-event attachment can occur at
configuration time or at run time.
You have the option to attach or detach an OB to an enabled event at configuration time. To
attach an OB to an event at configuration time, you must use the "HW interrupt:" drop-down
list (click on the down arrow on the right) and select an OB from the list of available
174
Programming instructions
6.2 Extended instructions
hardware-interrupt OBs. Select the appropriate OB name from this list, or select "<not
connected>" to remove the attachment.
You can also attach or detach an enabled hardware interrupt event during run time. Use the
ATTACH or DETACH program instructions during run time (multiple times if you wish) to
attach or detach an enabled interrupt event to the appropriate OB. If no OB is currently
attached (either from a "<not connected>" selection in device configuration, or as a result of
executing a DETACH instruction), the enabled hardware interrupt event is ignored.
DETACH operation
Use the DETACH instruction to detach either a particular event or all events from a particular
OB. If an EVENT is specified, then only this one event is detached from the specified
OB_NR; any other events currently attached to this OB_NR will remain attached. If no
EVENT is specified, then all events currently attached to OB_NR will be detached.
Condition codes
RET_VAL
(W#16#....)
6.2.5.2
0000
No error
0001
8090
8091
OB is wrong type
8093
FBD
175
Programming instructions
6.2 Extended instructions
SRT_DINT parameters
Parameter
Parameter
type
Data type
Description
OB_NR
IN
INT
DTIME
IN
TIME
SIGN
IN
WORD
RET_VAL
OUT
INT
Parameter
Parameter
type
Data type
Description
OB_NR
IN
INT
RET_VAL
OUT
INT
CAN_DINT parameters
Operation
The SRT_DINT instruction specifies a time delay, starts the internal time delay timer, and
associates a time delay interrupt OB subprogram with the time delay timeout event. When
the specified time delay has elapsed, a program interrupt is generated that triggers the
execution of the associated time delay interrupt OB. You can cancel an in-process time
delay interrupt before the specified time delay occurs by executing the CAN_DINT
instruction. The total number of active time delay and time cyclic interrupt events must not
exceed four.
176
Programming instructions
6.2 Extended instructions
3. Edit the time delay interrupt OB subprogram and create programmed reaction that you
want to execute when the time delay timeout event occurs. You can call other FC and FB
code blocks from the time delay interrupt OB, with a maximum nesting depth of four.
4. The newly assigned time delay interrupt OB names will be available when you edit the
OB_NR parameter of the SRT_DINT and CAN_DINT instructions.
Condition codes
6.2.5.3
RET_VAL
(W#16#...)
Description
0000
No error occurred
8090
8091
80A0
Parameter
Parameter
Parameter
type
Data type
Description
RET_VAL
OUT
INT
Operation
DIS_AIRT delays the processing of new interrupt events. You can execute DIS_AIRT more
than once in an OB. The DIS_AIRT executions are counted by the operating system. Each of
these remains in effect until it is cancelled again specifically by an EN_AIRT instruction, or
until the current OB has been completely processed.
Once they are enabled again, the interrupts that occurred while DIS_AIRT was in effect are
processed, or the interrupts are processed as soon as the current OB has been executed.
177
Programming instructions
6.2 Extended instructions
EN_AIRT enables the processing of interrupt events that you previously disabled with the
DIS_AIRT instruction. Each DIS_AIRT execution must be cancelled by an EN_AIRT
execution. If, for example, you have disabled interrupts five times with five DIS_AIRT
executions, you must cancel these with five EN_AIRT executions. The EN_AIRT executions
must occur within the same OB, or any FC or FB called from the same OB, before interrupts
are enabled again for this OB.
Parameter RET_VAL indicates the number of times that interrupt processing was disabled,
which is the number of queued DIS_AIRT executions. Interrupt processing is only enabled
again when parameter RET_VAL = 0.
6.2.6
PID control
The "PID_Compact" statement makes a PID controller with
optimizing self tuning for automatic and manual mode
available.
For information about the PID_Compact instruction, refer
to the online help of the TIA portal.
6.2.7
178
Programming instructions
6.2 Extended instructions
MC_MoveAbsolute starts
motion to an absolute position.
The job ends when the target
position is reached.
MC_MoveRelative starts a
positioning motion relative
to the start position.
6.2.8
Pulse instruction
6.2.8.1
CTRL_PWM instruction
The CTRL_PWM Pulse Width Modulation (PWM)
instruction provides a fixed cycle time output with a
variable duty cycle. The PWM output runs
continuously after being started at the specified
frequency (cycle time).
The pulse width is varied as required to effect the
desired control.
MC_MoveVelocity causes
the axis to travel with the
specified speed.
Cycle time
Duty cycle can be expressed as a percentage of the cycle time (0 100%), as thousandths
(0 1000), as ten thousandths (0 10000), or as S7 analog format. The pulse width can
vary from 0 (no pulse, always off) to full scale (no pulse, always on).
179
Programming instructions
6.2 Extended instructions
Since the PWM output can be varied from 0 to full scale, it provides a digital output that in
many ways is the same as an analog output. For example, the PWM output can be used to
control the speed of a motor from stop to full speed, or it can be used to control position of a
valve from closed to fully opened.
Two pulse generators are available for controlling high-speed pulse output functions: PWM
and Pulse train output (PTO). PTO is used by the motion control instructions. You can assign
each pulse generator to either PWM or PTO, but not both at the same time.
The two pulse generators are mapped to specific digital outputs as shown in the following
table. You can use onboard CPU outputs, or you can use the optional signal board outputs.
The output point numbers are shown in the following table (assuming the default output
configuration). If you have changed the output point numbering, then the output point
numbers will be those you assigned. Regardless, PTO1/PWM1 uses the first two digital
outputs, and PTO2/PWM2 uses the next two digital outputs, either on the CPU or on the
attached signal board. Note that PWM requires only one output, while PTO can optionally
use two outputs per channel. If an output is not required for a pulse function, it is available
for other uses.
Description
Direction
Onboard CPU
Q0.0
Q0.1
Signal board
Q4.0
Q4.1
Onboard CPU
Q0.0
--
Signal board
Q4.0
--
PTO 2
Onboard CPU
Q0.2
Q0.3
Signal board
Q4.2
Q4.3
PWM 2
Onboard CPU
Q0.2
--
Signal board
Q4.2
--
PTO 1
PWM 1
180
Programming instructions
6.2 Extended instructions
Pulse width format:
Percent (0 100)
Thousandths (0 1000)
Ten-thousandths (0 10000)
S7 analog format (0 27648)
Cycle time: Enter your cycle time value. This value can only be changed here.
Initial pulse width: Enter your initial pulse width value. The pulse width value can be
changed during runtime.
Output addresses
Start address: Enter the Q word address where you want to locate the pulse width value.
The default location is QW1000 for PWM1, and QW1002 for PWM2. The value at this
location controls the width of the pulse and is initialized to the "Initial pulse width:" value
specified above each time the PLC transitions from STOP to RUN mode. You change this Qword value during run time to cause a change in the pulse width.
LAD
FBD
Parameter
Parameter
type
Data
type
Initial value
Description
PWM
IN
WORD
PWM identifier:
Names of enabled pulse generators will
become tags in the "constant" tag table, and
will be available for use as the PWM
parameter.
ENABLE
IN
BOOL
BUSY
OUT
BOOL
Function busy
STATUS
OUT
WORD
Operation
A data block (DB) is used by the CTRL_PWM instruction to store parameter information.
When placing a CTRL_PWM instruction into the program editor, a DB will be assigned. The
data block parameters are not separately changed by the user, but are controlled by the
CTRL_PWM instruction.
Specify the enabled pulse generator to use, by using its tag name for the PWM parameter.
181
Programming instructions
6.3 Global library instructions
When the EN input is TRUE, the PWM_CTRL instruction starts or stops the identified PWM
based on the value at the ENABLE input. Pulse width is specified by the value in the
associated Q word output address.
Because the S7-1200 processes the request when the CTRL_PWM instruction is executed,
parameter BUSY will always report FALSE on S7-1200 CPU models.
If an error is detected, then ENO is set to FALSE, and parameter STATUS contains a
condition code.
The pulse width will be set to the initial value configured in device configuration when the
PLC first enters the RUN mode. You write values to the Q-word location specified in device
configuration ("Output addresses" / "Start address:") as needed to change the pulse width.
You use an instruction such as a move, convert, math, or PID box to write the desired pulse
width to the appropriate Q word. You must use the valid range for the Q-word value (percent,
thousandths, ten-thousandths, or S7 analog format).
Condition codes
STATUS value
Description
No error
80A1
Digital I/O points assigned to HSC, PWM, and PTO cannot be forced
The digital I/O points used by the high-speed counter (HSC), pulse-width modulation (PWM),
and pulse-train output (PTO) devices are assigned during device configuration. When digital
I/O point addresses are assigned to these devices, the values of the assigned I/O point
addresses cannot be modified by the Watch table force function.
6.3
6.3.1
USS
The USS Protocol library makes controlling Siemens drives which support USS protocol. The
instructions include functions that are specifically designed for using the USS protocol to
communicate with the drive. The CM1241RS485 module communicates with the drives on
RS485 ports. You can control the physical drive and the read/write drive parameters with the
USS library.
6.3.1.1
182
Programming instructions
6.3 Global library instructions
A single Instance Data Block contains temporary storage and buffers for all drives on the
USS network connected to each PtP communication module you install. The USS functions
for these drives share the information in this data block.
866B3257
7KH866B'59B'%GDWDEORFNLVD
EXIIHUWKDW\RXRQO\DFFHVV
LQGLUHFWO\YLDWKH866LQVWUXFWLRQV
866B'%
866B'59B'%
866B'59B'%
5HUVHUYHGIRU
373
&20GDWD
E\WHV
'ULYHGDWD
866B'59B'%
&056
866B'59
'5,9(
7KHFRPPXQLFDWLRQV
PRGXOHVXSSRUWVXSWR
GULYHV8VHWR
DVWKH'ULYHSDUDPHWHU
ER[LQSXW
866B530
'5,9(
'ULYH
'ULYH
866B:30
'5,9(
The USS_PORT function handles actual communication between the CPU and the drives via
the PtP communication module. Each call to this function handles at most one
communication with one drive. Your program must call this function fast enough to prevent a
communication timeout, by the drives. You may call this function in the Main or any interrupt
OB.
The USS_DRV function block provides your program access to a specified drive on the USS
network. Its inputs and outputs are the status and controls for the drive. If there are 16 drives
on the network, your program must have at least 16 USS_DRV calls, one for each drive.
These blocks should be called at the rate that is required to control the functions of the drive.
You may only call the USS_DRV function block from the main OB.
CAUTION
Only call USS_DRV, USS_RPM, USS_WPM from the Main OB. The USS_PORT function
can be called from any OB, usually from a Time delay interrupt.
Failure to prevent interruption of USS_PORT may produce unexpected errors.
183
Programming instructions
6.3 Global library instructions
The USS_RPM and USS_WPM functions read and write the remote drive operating
parameters. These parameters control the internal operation of the drive. See the drive
manual for the definition of these parameters. Your program can contain as many of these
functions as necessary, but only one read or write request can be active per drive, at any
given time. You may only call the USS_RPM and USS_WPM functions from a Main OB.
6.3.1.2
Baud rate
1200
790
2370
2400
405
1215
4800
212.5
638
9600
116.3
349
19200
68.2
205
38400
44.1
133
57600
36.1
109
115200
28.1
85
USS_DRV instruction
The USS_DRV instruction exchanges data with the drive, by creating request messages and
interpreting the drive response messages. A separate function block should be used for each
drive, but all USS functions associated with one USS network and PtP communication
module must use the same Instance Data Block. You must create the DB name when you
place the first USS_DRV instruction and you reuse that DB that was created by the initial
instruction usage.
When the initial USS_DRV execution is made, the drive indicated by the USS address
(parameter DRIVE) is initialized in the Instance DB. After this initialization, subsequent
executions of USS_PORT can then begin communication to the drive, at this drive number.
Changing the Drive number requires a PLC stop to run mode transition that initializes the
Instance DB. Input parameters are configured into the USS TX message buffer and outputs
are read from a "previous" valid response buffer if any exists. There is no data transmission
during USS_DRV execution. Drives are communicated with when USS_PORT is executed.
USS_DRV only configures the messages to be sent and interprets data that might have been
received from a previous request.
184
Programming instructions
6.3 Global library instructions
Parameter
Parameter
type
Data type
Description
RUN
IN
BOOL
Drive start bit: When true, this input enables the drive to
run at the preset speed.
OFF2
IN
BOOL
Electrical stop bit: When true, this bit cause the drive to
coast to a stop with no braking.
OFF3
IN
BOOL
Fast stop bit When true this bit causes a fast stop by
causing braking the drive rather than just allowing the
drive to coast to a stop.
F_ACK
IN
BOOL
DIR
IN
BOOL
DRIVE
IN
USINT
PZD_LEN
IN
USINT
SPEED_SP
IN
REAL
CTRL3
IN
UINT
CTRL4
IN
UINT
CTRL5
IN
UINT
185
Programming instructions
6.3 Global library instructions
186
Parameter
Parameter
type
Data type
Description
CTRL6
IN
UINT
CTRL7
IN
UINT
CTRL8
IN
UINT
NDR
OUT
BOOL
New data ready When true the bit indicates that the
outputs contain data from a new communication request.
ERROR
OUT
BOOL
STATUS
OUT
UINT
RUN_EN
OUT
BOOL
D_DIR
OUT
BOOL
INHIBIT
OUT
BOOL
FAULT
OUT
BOOL
SPEED
OUT
REAL
STATUS1
OUT
UINT
STATUS3
OUT
UINT
Drive Status Word 3 This value contains a userconfigurable status word on the drive.
STATUS4
OUT
UINT
Drive Status Word 4 This value contains a userconfigurable status word on the drive.
STATUS5
OUT
UINT
Drive Status Word 5 This value contains a userconfigurable status word on the drive.
STATUS6
OUT
UINT
Drive Status Word 6 This value contains a userconfigurable status word on the drive.
STATUS7
OUT
UINT
Drive Status Word 7 This value contains a userconfigurable status word on the drive.
STATUS8
OUT
UINT
Drive Status Word 8 This value contains a userconfigurable status word on the drive.
Programming instructions
6.3 Global library instructions
6.3.1.3
USS_PORT instruction
The USS_PORT instruction handles communication over the USS network. Typically there is
only one USS_PORT function per PtP communication module in the program, and each call
of this function handles a transmission to or from a single drive. Your program must execute
the USS_PORT function often enough to prevent drive timeouts. All USS functions
associated with one USS network and PtP communication module must use the same
Instance Data Block. USS_PORT is usually called from a time delay interrupt OB to prevent
drive timeouts and keep the most recent USS data updates available for USS_DRV calls.
LAD
6.3.1.4
FBD
Parameter
Parameter
type
Data type
Description
PORT
IN
PORT
BAUD
IN
DINT
USS_DB
IN
DINT
ERROR
OUT
BOOL
When true, this pin indicates that an error has occurred and
the STATUS output is valid.
STATUS
OUT
UINT
USS_RPM instruction
The USS_RPM instruction reads a parameter from the drive. All USS functions associated
with one USS network and PtP communication module must use the same data block.
USS_RPM must be called from the main OB.
LAD
FBD
187
Programming instructions
6.3 Global library instructions
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
DRIVE
IN
USINT
PARAM
IN
UINT
INDEX
IN
UINT
USS_DB
IN
VARIANT
VALUE
IN
WORD,
INT, UINT,
DWORD,
DINT,
UDINT,
REAL
This is the value of the parameter that was read and is valid
only when the DONE bit is true.
DONE
OUT
BOOL
188
ERROR
OUT
BOOL
STATUS
OUT
UINT
Programming instructions
6.3 Global library instructions
6.3.1.5
USS_WPM instruction
The USS_WPM instruction modifies a parameter in the drive. All USS functions associated
with one USS network and PtP communication module must use the same data block.
USS_WPM must be called from the main OB.
Note
EEPROM write operations
Beware of overusing the EEPROM permanent write operation. Minimize the number of
EEPROM write operations to extend the EEPROM life.
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
DRIVE
IN
USINT
PARAM
IN
UINT
INDEX
IN
UINT
EEPROM
IN
BOOL
VALUE
IN
WORD,
INT, UINT,
DWORD,
DINT,
UDINT,
REAL
189
Programming instructions
6.3 Global library instructions
Parameter
Parameter
type
Data type
Description
USS_DB
IN
VARIANT
DONE
OUT
BOOL
6.3.1.6
ERROR
OUT
BOOL
STATUS
OUT
UINT
STATUS value
(W#16#....)
Description
0000
No error
8180
The length of the drive response did not match the characters received from the drive
8181
8182
User supplied a Word for a parameter value and received a DWord or Real from the drive in the
response
8183
User supplied a DWord or Real for a parameter value and received a Word from the drive in the
response
8184
8185
8186
Speed set point out of valid range (valid speed SP range: -200% to 200%)
8187
8188
8189
818A
818B
818C
Drive returned an extended error on a parameter request operation. See the extended error description
below this table.
818D
Drive returned an illegal access error on a Parameter request operation. See your drive manual for
information of why parameter access may be limited
190
Programming instructions
6.3 Global library instructions
STATUS value
(W#16#....)
Description
818E
Drive has not been initialized: This error code is returned to USS_RPM or USS_WPM when USS_DRV
for that drive has not been called at least once. This keeps the initialization of first scan of USS_DRV
from overwriting a pending Parameter Read or Write request since it initializes the Drive as a new entry.
To fix this error, call USS_DRV for this drive number.
80Ax-80Fx
Specific errors returned from PtP (Point-to-Point) communication FBs called by the USS Library: These
error code values are not modified by the USS library and are defined in the PtP instruction descriptions.
6.3.2
MODBUS
6.3.2.1
MB_COMM_LOAD
Description
The MB_COMM_LOAD instruction configures a port on the Point-to-Point (PtP) CM 1241
RS485 or CM 1241 RS232 module for Modbus RTU protocol communications.
LAD
FBD
191
Programming instructions
6.3 Global library instructions
Parameter
Parameter
type
Data type
Description
PORT
IN
UINT
BAUD
IN
UDINT
PARITY
IN
UINT
Parity selection:
0 None
Transmit: and receive: 1 start bit, 8 data bits, no parity 1 stop bit
1 Odd
2 Even
FLOW_CTRL
IN
UINT
RTS_ON_DLY
IN
UINT
RTS_OFF_DLY
IN
UINT
RESP_TO
IN
UINT
Response Timeout:
Time in milliseconds allowed by MB_MASTER for the slave to respond. If
the slave does not respond in this time period, MB_MASTER will retry the
request or terminate the request with an error, if the specified number of
retries has been sent.
5 ms to 65535 ms (default value = 1000ms).
MB_DB
192
IN
VARIANT
Programming instructions
6.3 Global library instructions
Parameter
Parameter
type
Data type
Description
ERROR
OUT
BOOL
Error:
0 No error detected
1 Indicates that an error was detected and the error code at
parameter STATUS is valid
STATUS
OUT
WORD
Operation
MB_COMM_LOAD is executed to configure a port for the Modbus RTU protocol. After the
port is configured, you communicate on the Modbus by executing either MB_SLAVE or
MB_MASTER instructions.
One instance of the MB_COMM_LOAD must be used to configure each port of each
communication module that is used for Modbus communication. You must assign a unique
MB_COMM_LOAD Instance Data Block for each port that you use. The S7-1200 CPU is
limited to 3 communication modules.
An Instance Data Block is assigned when you place the MB_MASTER or MB_SLAVE
instructions. This Instance Data Block is referenced when you specify the MB_DB parameter
on the MB_COMM_LOAD instruction.
193
Programming instructions
6.3 Global library instructions
Condition codes
STATUS value
(W#16#....)
6.3.2.2
Description
0000
No error
8180
8181
8182
8183
8184
8185
MB_MASTER
Description
The MB_MASTER instruction allows your program to communicate as a Modbus master
using a port on the Point-to-Point (PtP) CM 1241 RS485 or CM 1241 RS232 module. You
can access data in one or more Modbus slave devices.
An Instance Data Block is assigned when you place the MB_MASTER instruction in your
program. This MB_MASTER Instance Data Block name is used when you specify the
MB_DB parameter on the MB_COMM_LOAD instruction.
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
Request Input:
0 No request
1 Request to transmit data to Modbus Slave(s)
MB_ADR
IN
USINT
MODE
194
IN
USINT
Programming instructions
6.3 Global library instructions
Parameter
Parameter
type
Data type
Description
DATA_ADDR
IN
UDIINT
Starting Address in the Slave: Specifies the starting address of the data
to be accessed in the Modbus slave. . See the Modbus operations table
below for valid addresses.
DATA_LEN
IN
UINT
DATA_PTR
IN
VARIANT
Data Pointer: Points to the CPU DB address for the data being written
or read. The DB must be a classic DB type. See the DATA_PTR note
below.
NDR
OUT
BOOL
BUSY
OUT
BOOL
Busy:
0 No MB_MASTER transaction in progress
1 MB_MASTER transaction in progress
ERROR
OUT
BOOL
Error:
0 No error detected
1 Indicates that an error was detected and the error code supplied
at parameter STATUS is valid
STATUS
OUT
WORD
REQ parameter
REQ value FALSE = No request
REQ value TRUE = Request to transmit data to Modbus Slave(s).
You must supply this input through an edge triggered contact on the first call for
MB_MASTER execution. The edge triggerd pulse will invoke the transmission request once.
All inputs are captured and held unchanged for one request and response triggered by this
input.
S7-1200 Programmable controller
System Manual, 05/2009, A5E02486680-01
195
Programming instructions
6.3 Global library instructions
Internally the MB_MASTER will start a state machine to make sure that no other master is
allowed to issue a request until this request has been completed.
In addition if the same instance of the call to the MB_MASTER FB is executed again with the
REQ input TRUE before the completion of the request, then no subsequent transmissions
will be made. However, as soon as the request has been completed, a new request will be
issued if MB_MASTER is executed with the REQ input set to true.
Address type
Modbus function
00001 to 09999
Output bits
1 to 2000
O1H
10001 19999
Input bits
1 to 2000
02H
30001 - 39999
Input registers
1 to 125
04H
40001 to 49999
Holding registers
1 to 125
03H
00001 to 09999
Output bits
1 (single bit)
05H
40001 to 49999
Holding registers
1 (single word)
06H
00001 to 09999
Output bits
2 to 1968
15H
40001 to 49999
Holding registers
2 to 123
16H
Mode 0
Read
400001 to 465536(Extended)
Mode 1
Write
400001 to 465536(Extended)
400001 to 465536(Extended)
Mode 2
Some Modbus slaves do not support single bit or word writes with Modbus functions 05H and 06H. In these cases, Mode 2
is used to force single bit and word writes using Modbus functions 15H and 16H.
Write
00001 to 09999
Output bits
1 to 1968
15H
40001 to 49999
Holding registers
1 to 123
16H
400001 to 465536(Extended
Mode 11
Reads an event counter word from the Modbus slave that is referenced as an input to MB_ADDR
On a Siemens S7-1200 Modbus slave, this counter is incremented every time that the slave receives a valid read or
write (non-broadcast) request from a Modbus master.
The returned value is stored in the word location specified as the input to DATA_PTR.
A valid DATA_LEN is not required for this mode.
196
Programming instructions
6.3 Global library instructions
MB_MASTER Modbus functions
Mode 80
Checks the communication status of the Modbus slave that is referenced as an input to MB_ADDR
The setting of the NDR output bit on the MB_MASTER instruction indicates that the addressed Modbus slave
responded with the appropriate response data.
No data is returned to your program.
A valid DATA_LEN is not required for this mode.
Mode 81
Resets the event counter (as returned by Mode 11) on the Modbus slave that is referenced as an input to MB_ADDR
The setting of the NDR output bit on the MB_MASTER instruction indicates that the addressed Modbus slave
responded with the appropriate response data.
No data is returned to your program.
A valid DATA_LEN is not required for this mode.
DATA_PTR parameter
Points to the local source or destination address (the address in the S7-1200 CPU) of the
data being written or read, respectively. When you use the MB_MASTER instruction to
create a Modbus master, you must create a global data block that provides data storage for
reads and writes to Modbus slaves.
Note
The DATA_PTR parameter must reference a classic Data block type
You must uncheck the "Symbolic address only" box when you add a new Data block to
create a classic global DB type.
197
Programming instructions
6.3 Global library instructions
There is no requirement that the DATA_PTR data areas be in the same global data block.
You can create one data block with multiple areas for Modbus reads, one data block for
Modbus writes, or one data block for each slave station.
All of the arrays in the example below are created as base 1 arrays [1 ##]. The arrays
could have been created as base 0 arrays [0 ###] or a mix of base 0 and base 1.
The first element of any array or structure is always the first source or destination of any
Modbus read or write activity. All the scenarios below are based on the diagram above.
198
Programming instructions
6.3 Global library instructions
Scenario 1: If the first MB_MASTER instruction reads 3 words of data from Modbus
address 40001 on any valid Modbus slave, then the following occurs.
The word from address 40001 is stored in "Data".Array_1[1].
The word from address 40002 is stored in "Data".Array_1[2].
The word from address 40003 is stored in "Data".Array_1[3].
Scenario 2: If the first MB_MASTER instruction reads 4 words of data from Modbus
address 40015 on any valid Modbus slave, then the following occurs.
The word from address 40015 is stored in "Data".Array_1[1].
The word from address 40016 is stored in "Data".Array_1[2].
The word from address 40017 is stored in "Data".Array_1[3].
The word from address 40018 is stored in "Data".Array_1[4].
Scenario 3: If the second MB_MASTER instruction reads 2 words of data from Modbus
address 30033 on any valid Modbus slave, then the following occurs.
The word from address 30033 is stored in "Data".Array_2[1].
The word from address 30034 is stored in "Data".Array_2[2].
Scenario 4: If the third MB_MASTER instruction writes 4 words of data to Modbus address
40050 on any valid Modbus slave, then the following occurs.
The word from "Data".Array_3[1] is written to Modbus address 40050.
The word from "Data".Array_3[2] is written to Modbus address 40051.
The word from "Data".Array_3[3] is written to Modbus address 40052.
The word from "Data".Array_3[4] is written to Modbus address 40053.
Scenario 5: If the third MB_MASTER instruction writes 3 words of data to Modbus address
40001 on any valid Modbus slave, then the following occurs.
The word from "Data".Array_3[1] is written to Modbus address 40001.
The word from "Data".Array_3[2] is written to Modbus address 40002.
The word from "Data".Array_3[3] is written to Modbus address 40003.
Scenario 6: If the fourth MB_MASTER instruction uses a Mode 11 (retrieve valid message
count) from any valid Modbus slave, the following occurs.
The count word is stored in "Data".Array_4[1].
199
Programming instructions
6.3 Global library instructions
Example bit reads and writes using word locations as DATA_PTR input
Table 6- 1
MB_ADDR
27 (Slave example)
00001
ON
MODE
0 (Read)
00002
ON
DATA_ADDR
00001 (Outputs)
00003
OFF
DATA_LEN
00004
ON
DATA_PTR
"Data".Array_4
00005
ON
00006
OFF
00007
ON
00008
OFF
xxxx-1011
xxxx-xxxx
Table 6- 2
MB_ADDR
27 (Slave example)
00001
ON
00010
ON
MODE
0 (Read)
00002
ON
00011
OFF
DATA_ADDR
00003 (Outputs)
00003
OFF
00012
OFF
DATA_LEN
12
00004
ON
00013
ON
DATA_PTR
"Data".Array_4
00005
ON
00014
OFF
00006
OFF
00015
ON
00007
ON
00016
ON
00008
ON
00017
OFF
00009
OFF
00018
ON
LS Byte
1011-0110
0100-xxxx
200
Programming instructions
6.3 Global library instructions
Table 6- 3
MB_ADDR
27 (Slave example)
00001
ON
OFF
MODE
1 (Write)
00002
ON
ON
DATA_ADDR
00001 (Outputs)
00003
OFF
ON
DATA_LEN
00004
ON
OFF
DATA_PTR
"Data".Array_4
00005
ON
ON
00006
OFF
Unchanged
00007
ON
Unchanged
00008
ON
Unchanged
00009
OFF
Unchanged
LS Byte
xxx1-0110
xxxxx-xxxx
Table 6- 4
MB_ADDR
27 (Slave example)
00001
ON
00014
ON
MODE
0 (Read)
00002
ON
00015
OFF
DATA_ADDR
00003 (Outputs)
00003
OFF
00016
ON
DATA_LEN
22
00004
ON
00017
ON
DATA_PTR
"Data".Array_4
00005
ON
00018
OFF
00006
OFF
00019
ON
00007
ON
00020
ON
00008
ON
00021
OFF
00009
ON
00022
ON
00010
OFF
00023
ON
00011
OFF
00024
OFF
00012
ON
00025
OFF
00013
OFF
00026
ON
LS Byte
0111-0110
0110-1010
201
Programming instructions
6.3 Global library instructions
LS Byte
xx01-1011
xxxx-xxxx
Example bit reads and writes using BOOL locations as DATA_PTR input
Although Modbus reads and writes to bit address locations can be handled through the use
of word locations, DATA_PTR areas can also be configured as Boolean data types,
structures or arrays to provide a direct 1 to 1 correlation for the first bit that is read or written
by using a MB_MASTER instruction.
If you use Boolean arrays or structures, it is recommended that you make the data size a
multiple of 8 bits (on byte boundaries). For example, when you create a Boolean array of 10
bits the STEP 7 Basic software will allocate 16 bits (2 bytes) in the global Data block for the
10 bits. Inside the data block, these would be stored as byte1 [xxxx xxxx] byte2 [---- --xx]
where x indicates accessible data locations and indicates locations that are inaccessible.
Modbus requests of up to a length of 16 bits are allowed, but the upper 6 bits would be
placed into byte 2 memory locations that are not referenced and are not accessible by your
program.
Boolean areas can be created as an array of Boolean values or as a structure of Boolean
variables. Both methods operate in an identical manner and differ only in how they are
created and accessed in your program.
The global data block editor view below shows a single array of 16 Boolean values created
with base 0. The array could also have been created as a base 1 array. The arrow shows
how this array is associated with a MB_MASTER instruction.
202
Programming instructions
6.3 Global library instructions
Table 6- 5
DATA_PTR data
MB_ADDR
27 (Slave example)
00001
ON
"Data".Bool[0]=FALSE
OFF
MODE
1 (Write)
00002
ON
"Data".Bool[1]=TRUE
ON
DATA_ADDR
00001 (Outputs)
00003
OFF
"Data".Bool[2]=TRUE
ON
DATA_LEN
00004
ON
"Data".Bool[3]-FALSE
OFF
DATA_PTR
"Data".Bool
00005
ON
"Data".Bool[4]=FALSE
OFF
00006
OFF
Unchanged
00007
ON
Unchanged
00008
OFF
Unchanged
Table 6- 6
MB_ADDR
27 (Slave example)
00001
ON
MODE
0 (Read)
00002
ON
DATA_ADDR
00003 (Outputs)
00003
OFF
"Data".Bool[0]=FALSE
DATA_LEN
15
00004
ON
"Data".Bool[1]=TRUE
DATA_PTR
"Data".Bool
00005
ON
"Data".Bool[2]=TRUE
00006
OFF
"Data".Bool[3]-FALSE
00007
ON
Data".Bool[4]=TRUE
00008
ON
Data".Bool[5]=TRUE
00009
ON
Data".Bool[6]=TRUE
00010
OFF
Data".Bool[7]=FALSE
00011
OFF
Data".Bool[8]=FALSE
00012
ON
Data".Bool[9]=TRUE
00013
OFF
Data".Bool[10]=FALSE
00014
ON
Data".Bool[11]=TRUE
00015
OFF
Data".Bool[12]=FALSE
00016
ON
Data".Bool[13]=TRUE
00017
ON
Data".Bool[14]=TRUE
00018
OFF
00019
ON
Condition codes
STATUS value
(W#16#....)
Description
0000
No error
80C8
203
Programming instructions
6.3 Global library instructions
STATUS value
(W#16#....)
Description
80D1
The receiver issued a flow control request to suspend an active transmission and
never re-enabled the transmission during the specified wait time.
This error is also generated during hardware flow control when the receiver does
not assert CTS within the specified wait time.
80D2
6.3.2.3
The transmit request was aborted because no DSR signal is received from the
DCE.
80E0
80E1
80E2
80E3
80E4
The message was terminated as a result of the specified length exceeding the total
buffer size.
8180
8186
8188
Invalid Mode value or write mode to read only slave address area
8189
818A
818B
818C
8200
MB_SLAVE
Description
The MB_SLAVE instruction allows your program to communicate as a Modbus slave using a
port on the Point-to-Point (PtP) CM 1241 RS485 or CM 1241 RS232 module. A Modbus
RTU master can issue a request and then your program responds via MB_SLAVE execution.
You must assign a unique Instance Data Block when you place the MB_SLAVE instruction in
your program. This MB_SLAVE Instance Data Block name is used when you specify the
MB_DB parameter on the MB_COMM_LOAD instruction.
Modbus communication functions (FC 1, 2, 4, 5, and 15) can read and write bits and words
directly in the PLC Input Process Image and Output process Image.
MB_SLAVE Modbus functions
FC
S7-1200
Function
Data area
Address range
Data area
CPU address
01
Read bits
Output
to
8192
Q0.0 to Q1023.7
02
Read bits
Input
10001
to
18192
I0.0 to I1023.7
04
Read words
Input
30001
to
30512
IW0 to IW1022
05
Write bit
Output
to
8192
Q0.0 to Q1023.7
15
Write bits
Output
to
8192
Q0.0 to Q1023.7
204
Programming instructions
6.3 Global library instructions
Modbus communication functions (FC 3, 6, 16) use a separate and unique Modbus holding
register data block that you must create, before you can specify the MB_HOLD_REG
parameter on the MB_SLAVE instruction.
MB_SLAVE Modbus functions
FC
03
S7-1200
Function
Data area
Address range
CPU DB address
Read words
Holding
Register
40001 to 4999
MB_HOLD_REG
Words 1 to 9999
400001 to 465535
06
Write word
Holding
Register.
4001 to 4999
16
Write words
Holding
Register
4001 to 4999
Words 1 to 65534
MB_HOLD_REG
Words 1 to 9999
MB_HOLD_REG
Words 1 to 9999
400001 to 465535
400001 to 465535
Words 1 to 65534
Words 1 to 65534
Sub-function
Description
08
0000H
Return query data echo test: The MB_SLAVE will echo back to a Modbus master a word of data
that is received.
08
000AH
Clear communication event counter: The MB_SLAVE will clear out the communication event
counter that is used for Modbus function 11.
11
Get communication event counter: The MB_SLAVE uses an internal communication event counter
for recording the number of successful Modbus read and write requests that are sent to the Modbus
slave. The counter does not increment on any Function 8, Function 11, or broadcast requests. It is
also not incremented on any requests that result in a communication error (for example, parity or
CRC errors).
The MB_SLAVE supports broadcast write requests from any Modbus master as long as the
request is for accessing valid locations.
Regardless of the validity of a request, the MB_SLAVE gives no response to a Modbus
master as the result of a broadcast request.
LAD
FBD
205
Programming instructions
6.3 Global library instructions
Parameter
Parameter
type
Data type
Description
MB_ADDR
IN
USINT
MB_HOLD_REG
IN
VARIANT
NDR
OUT
BOOL
DR
OUT
BOOL
Data Read:
0 No data read
1 Indicates that data has been read by the
Modbus master
ERROR
OUT
BOOL
Error:
0 No error detected
1 Indicates that an error was detected and the
error code supplied at parameter STATUS is
valid.
STATUS
OUT
WORD
Error code
206
Programming instructions
6.3 Global library instructions
Operation
MB_SLAVE must be executed periodically to receive each request from the Modbus Master
and then respond as required. The frequency of execution for MB_SLAVE is dependent
upon the response timeout period of the Modbus master. This is illustrated in the following
diagram.
$'5
)&
'DWD
5HVSRQVH
WLPHRXWSHULRG
&5&
0DVWHUVHQGV
6WDUW
&5& LQWHUYDO FKDUDFWHUWLPHV
$'5
6ODYHVHQGV
5HVSRQVH
GHOD\WLPH
$'5
)&
'DWD
6WDUW
&5& LQWHUYDO
The response timeout period is the amount of time a Modbus master waits for the start of a
response from a Modbus slave. This time period is not defined by the Modbus Protocol, but
is a parameter of each Modbus master. The frequency of execution (time between one
execution and the next execution) of MB_SLAVE must be based on the particular
parameters of your Modbus master. At a minimum, you should execute MB_SLAVE twice
within the response timeout period.
207
Programming instructions
6.3 Global library instructions
Advantages:
This type of holding register structure is very fast and simple to create.
The program logic to access a data element is simplified.
Disadvantages:
Although you can programmatically reference each array element by the symbolic
names ( "HR_DB"."Array"[1] through "HR_DB"."Array"[10] ), the names do not describe
the internal function of the data.
The array can consist of only one data type. Type conversions may be required in a
user program with rigid type control.
This is how an array of words structure would appear in the data block editor.
The image below shows how the array would be assigned to the MB_HOLD_REG input of an
MB_SLAVE instruction.
Each element of the array can be accessed by symbolic name, as shown below. In this
example, a new value is moved into the second element of the array which corresponds to
Modbus address 40002.
Each of the words in the array, as defined in the data block, provides the MB_SLAVE
instruction with Modbus holding register addresses. In this instance, since there are only 10
elements in the array, there are only 10 available Modbus holding register addresses usable
by this MB_SLAVE instruction and accessible by a Modbus master.
208
Programming instructions
6.3 Global library instructions
The correlation of the array element names to Modbus addresses is shown below.
"HR_DB".Array[1]
...
...
Disadvantages:
It takes longer to create this type of structure than the standard array of words.
The elements require additional symbolic referencing when used in a user program.
Where the first element of the simple array is referenced as "HR_DB".Array[0] the first
element of this type is referenced "HR_DB".Data.Temp_1.
This is how a named word structure would appear in the data block editor. Each element has
a unique name and can be a WORD, UINT, or INT.
The image below shows how the data structure above would be assigned to the
MB_HOLD_REG input of an MB_SLAVE instruction in your program.
209
Programming instructions
6.3 Global library instructions
Each element of the array can be accessed by its symbolic name as shown below. In this
example, a new value is moved into the second element of the array which corresponds to
Modbus address 40002.
The correlation of the data element names to Modbus addresses is shown below.
"HR_DB".Data.Temp_1
"HR_DB".Data.Temp_2
"HR_DB".Data.Temp_3
"HR_DB".Data.Good_Count
"HR_DB".Data.Bad_Count
"HR_DB".Data.Rework_Count
"HR_DB".Data.Line_Stops
"HR_DB".Data.Avg_Time
"HR_DB".Data.Code_1
"HR_DB".Data.Code_2
Disadvantages:
It takes longer to create this type of structure than the standard array of words.
The Modbus master needs to be configured to accept the data that it will be receiving
from the Modbus slave. As shown in the image below, Temp_1 is a 4 byte real value.
The receiving master needs to be able to reassemble the 2 received words back into
the real value that is expected.
The elements require additional symbolic referencing in your program. Where the first
element of the simple array is referenced as "HR_DB".Array[0], the first element of this
type is referenced as "HR_DB".Data.Temp_1.
210
Programming instructions
6.3 Global library instructions
This is how a named complex structure would appear in the data block editor. Each element
has a unique name with multiple sizes and data types.
The correlation of the data element names to Modbus addresses is shown below.
"HR_DB".Data.Temp_1
"HR_DB".Data.Temp_2
"HR_DB".Data.Good_Count
"HR_DB".Data.Bad_Count
"HR_DB".Data.Rework_Count
"HR_DB".Data.Line_Stops
"HR_DB".Data.Avg_Time
"HR_DB".Data.Long_Code
"HR_DB".Data.Code_1
"HR_DB".Data.Code_2
Another S7-1200 CPU operating as a Modbus master can use the MB_Master instruction
and an identical data structure to receive the block of data from the S7-1200 CPU operating
as a Modbus slave. This Modbus Master instruction will copy all 16 words of data directly
from the slave's HR_DB data block into the master's ProcessData data block, as shown
below.
211
Programming instructions
6.3 Global library instructions
A series of Modbus master Data_PTR data block locations can be used to transfer the same
or different structures from multiple Modbus slaves.
Condition codes
STATUS value
(W#16#....)
Description
80C8
80D1
The receiver issued a flow control request to suspend an active transmission and
never re-enabled the transmission during the specified wait time.
This error is also generated during hardware flow control when the receiver does
not assert CTS within the specified wait time.
80D2
The transmit request was aborted because no DSR signal is received from the DCE
80E0
80E1
80E2
80E3
80E4
The message was terminated as a result of the specified length exceeding the total
buffer size
8180
8186
8187
818C
212
8380
No response
CRC error
8381
01
8382
No response
8383
02
8384
03
8385
03
PROFINET
The S7-1200 CPU has an integrated PROFINET port which supports both Ethernet and
TCP/IP-based communications standards. The following application protocols are supported
by the S7-1200 CPU:
Transport Connection Protocol (TCP)
ISO Transport over TCP (RFC 1006)
The S7-1200 CPU is able to communicate with the following devices:
Other S7-1200 CPUs
STEP 7 Basic programming device
HMIs
Non-Siemens devices using standard TCP communications protocols (Transmission
block (T-block))
There are two ways to communicate using PROFINET:
Direct connection: Use direct communication when you are using a programming device,
HMI, or another CPU connected to a single CPU.
Network connection: Use network communications when you are connecting more than
two devices (for example, CPUs, HMIs, programming devices, and non-Siemens
devices).
Direct connection: Programming device
connected to S7-1200 CPU
213
PROFINET
6.3 Global library instructions
Network connection: More than two devices
connected together
CSM1277 Ethernet Switch
Note
An Ethernet switch is not required for a direct connection between a programming device or
HMI and a CPU. An Ethernet switch is required for a network with more than two CPUs or
HMI devices.
Note
The rack-mounted Siemens CSM1277 4-port Ethernet switch can be used to connect your
CPUs and HMI devices. The PROFINET port on the S7-1200 CPU does not contain an
Ethernet switching device.
Restricted TSAPs or port numbers for passive ISO and TCP communication
If you use the "TCON" instruction to set up and establish a passive communications
connection, the following port addresses are restricted and should not be used:
ISO TSAP (passive): 01.00, 01.01, 02.00, 02.01, 03.00, 03.01
TCP port (passive): 5001, 102, 123, 20, 21, 25, 34962, 34963, 34964, 80
214
PROFINET
7.1 Communication with a programming device
7.1
7.1.1
PROFINET port
215
PROFINET
7.1 Communication with a programming device
An optional strain relief is available to strengthen the PROFINET connection.
7.1.2
7.1.3
7.1.3.1
216
PROFINET
7.1 Communication with a programming device
mask, when combined with the device IP address in a mathematical AND operation, defines
the boundaries of an IP subnet.
Note
An Ethernet-to-USB adapter card (for example, a D-LINK DUB E100 USB 2.0 Fast Ethernet
Adapter [TCP/IP]) is useful when you do not want your CPU on your company LAN. During
initial testing or commissioning tests, this arrangement is particularly useful.
Programming
Device Adapter
Card
Network
Type
Subnet Mask
On-board
adapter card
Connected to
your plant
LAN (and
possibly the
world-wide
web)
(for example, an
Intel(R)
PRO/1000 MT
Network
Connection)
Ethernet-to-USB
adapter card
(for example, DLINK DUB E100
USB 2.0 Fast
Ethernet Adapter
[TCP/IP]
Assigning or checking the IP address of your programming device using "My Network Places" (on
your desktop)
You can assign or check your programming device's IP address with the following menu
selections:
(Right-click) "My Network Places"
"Properties"
(Right-click) "Local Area Connection"
"Properties"
217
PROFINET
7.1 Communication with a programming device
In the "Local Area Connection Properties" dialog, in the "This connection uses the following
items:" field, scroll down to "Internet Protocol (TCP/IP)". Click "Internet Protocol (TCP/IP)",
and click the "Properties" button. Select "Obtain an IP address automatically (DHCP)" or
"Use the following IP address" (to enter a static IP address).
Note
Dynamic Host Configuration Protocol (DHCP) automatically assigns an IP address to your
programming device upon power up from the DHCP server.
Checking the IP address of your programming device using the "ipconfig" and "ipconfig /all"
commands
You can also check the IP address of your programming device, and, if applicable, the IP
address of your IP router (Gateway) with the following menu selections:
"Start" button (on your desktop)
"Run"
In the "Run" dialog, in the "Open" field, enter "cmd" and click the "OK" button. In the
"C:\WINDOWS\system32\cmd.exe" dialog that is displayed, enter the command "ipconfig".
An example result is shown below:
Further information can be displayed with an "ipconfig /all" command. Your programming
device's adapter card type and Ethernet (MAC) address can be found here:
218
PROFINET
7.1 Communication with a programming device
7.1.3.2
219
PROFINET
7.1 Communication with a programming device
3. In the "Project tree," select the
CPU.
220
PROFINET
7.1 Communication with a programming device
7. In the "Accessible devices in
target network" field, click the
device with a MAC address (12
hexadecimal character value).
Then, click the "Load" button.
221
PROFINET
7.1 Communication with a programming device
10. In the "Project tree," verify
that no IP address is assigned to
the CPU, with the following menu
selections:
"Online access"
<Adapter card for the network
in which the device is
located>
"Update accessible devices"
Note: All IP addresses connected
to the selected network will
appear beneath "Update
accessible devices."
11. In the "Project tree," make
the following menu selections:
"Online access"
<Adapter card for the network
in which the device is
located>
"Update accessible devices"
<IP address>
"Online & diagnostics"
222
PROFINET
7.1 Communication with a programming device
12. In the "Online & diagnostics"
dialog, make the following menu
selections:
"Functions"
"Assign IP address"
223
PROFINET
7.1 Communication with a programming device
7.1.3.3
PROFINET port
224
PROFINET
7.1 Communication with a programming device
IP router: Routers are the link between LANs. Using a router, a computer in a LAN can send
messages to any other networks, which might have other LANs behind them. If the
destination of the data is not within the LAN, the router forwards the data to another network
or group of networks where it can be delivered to its destination.
Routers rely on IP addresses to deliver and receive data packets.
IP addresses
properties: In the
Properties window,
select the "Ethernet
address" configuration
entry. The TIA Portal
displays the Ethernet
address configuration
dialog, which
associates the
software project with
the IP address of the
CPU that will receive
that project.
Note
The CPU does not have a pre-configured IP address. You must manually assign an IP
address for the CPU. If your CPU is connected to a router on a network, you must also enter
the router's IP address. All IP addresses are configured when you download the project.
Refer to "Assigning IP addresses to programming and network devices" for more
information.
The following table defines the parameters for the IP address:
Parameter
Description
Subnet
Name of the Subnet to which the device is connected. Click the "Add new subnet"
button to create a new subnet. "Not connected" is the default.
Two connection types are possible:
The "Not connected" default provides a local connection.
A subnet is required when your network has two or more devices.
IP protocol
IP address
Subnet mask
Use IP router
Router address
225
PROFINET
7.1 Communication with a programming device
7.1.4
226
PROFINET
7.1 Communication with a programming device
Using the "Extended download to device" dialog to test for connected network devices
The S7-1200 CPU "Download to device" function and its "Extended download to device"
dialog can show all accessible network devices and whether or not unique IP addresses
have been assigned to all devices. To display all accessible and available devices with their
assigned MAC and IP addresses, check the "Show all accessible devices" checkbox.
If the required network device is not in this list, communications to that device have been
interrupted for some reason. The device and network must be investigated for hardware
and/or configuration errors.
227
PROFINET
7.2 HMI-to-PLC communication
7.2
HMI-to-PLC communication
The CPU supports PROFINET communications connections to HMIs. The following
requirements must be considered when setting up communications between CPUs and
HMIs:
Configuration/Setup:
The PROFINET port of the CPU must be configured to connect with the HMI.
The HMI must be setup and configured.
The HMI configuration information is part of the CPU project and can be configured and
downloaded from within the project.
No Ethernet switch is required for one-to-one communications; an Ethernet switch is
required for more than two devices in a network.
Note
The rack-mounted Siemens CSM1277 4-port Ethernet switch can be used to connect
your CPUs and HMI devices. The PROFINET port on the CPU does not contain an
Ethernet switching device.
Supported functions:
The HMI can read/write data to the CPU.
Messages can be triggered, based upon information retrieved from the CPU.
System diagnostics
Note
WinCC Basic and STEP 7 Basic are components of the TIA Portal. Refer to WinCC Basic
for more information on configuring the HMI.
228
PROFINET
7.2 HMI-to-PLC communication
Task
Establishing the hardware communications connection
An PROFINET interface establishes the physical connection between an HMI and a CPU. Since Auto-Cross-Over
functionality is built into the CPU, you can use either a standard or crossover Ethernet cable for the interface. An
Ethernet switch is not required to connect an HMI and a CPU.
Refer to "Configuring communications between a programming device and a CPU: Establishing the hardware
communications connection (Page 215)" for more information.
7.2.1
229
PROFINET
7.3 PLC-to-PLC communication
Action
Result
7.3
PLC-to-PLC communication
A CPU can communicate with another CPU on a network by using the TSEND_C and
TRCV_C instructions. The following must be considered when setting up communications
between two CPUs:
Configuration/Setup: Hardware configuration is required.
Supported functions: Reading/Writing data to a peer CPU
No Ethernet switch is required for one-to-one communications; an Ethernet switch is
required for more than two devices in a network.
230
PROFINET
7.3 PLC-to-PLC communication
Task
Establishing the hardware communications connection
A PROFINET interface establishes the physical connection between two CPUs. Since Auto-Cross-Over
functionality is built into the CPU, you can use either a standard or crossover Ethernet cable for the interface. An
Ethernet switch is not required to connect the two CPUs.
Refer to "Configuring communications between a programming device and a CPU: Establishing the hardware
communications connection" for more information.
231
PROFINET
7.3 PLC-to-PLC communication
7.3.1
Result
7.3.2
232
PROFINET
7.3 PLC-to-PLC communication
7.3.2.1
TSEND_C instruction
The TSEND_C instruction (Page 157) creates a communications connection to a partner
station. The connection is set up, established, and automatically monitored until it is
commanded to disconnect by the instruction. The TSEND_C instruction combines the
functions of the TCON, TDISCON and TSEND instructions.
From the Device configuration in the TIA Portal, you can configure how a TSEND_C
instruction transmits data. To begin, you insert the instruction into the program from the
Instructions tab at the following location: "Extended Instructions" > "Communications"
The instruction is displayed, along with the Call options dialog where you assign a DB for
storing the parameters of the TSEND_C instruction.
You can assign tag memory locations to the inputs and outputs as in the figure below.
233
PROFINET
7.3 PLC-to-PLC communication
Protocol Name
Usage
RFC
1006
TCP
Transport of frames
234
PROFINET
7.3 PLC-to-PLC communication
In the "Address Details" section of the Connection Parameters dialog, you define the TSAPs
to be used. The TSAP of a connection in the CPU is entered in the "Local TSAP" field. The
TSAP assigned for the connection in your partner CPU is entered under the "Partner TSAP"
field.
Definition
General
End point: Partner
Interface
Subnet
Address
Assigned IP Addresses
Connection type
Connection ID
ID number
Connection data
Address details
TSAP (ASCII)
TSAP ID
235
PROFINET
7.3 PLC-to-PLC communication
A connection-oriented protocol
Can be used very flexibly with third-party systems which exclusively support TCP
Routing-capable
Only static data lengths are applicable.
Messages are acknowledged.
Applications are addressed using port numbers.
Most of the user application protocols, such as TELNET and FTP, use TCP.
Programming effort is required for data management due to the SEND / RECEIVE
programming interface.
Definition
General
End point: Partner
Interface
Subnet
Address
Assigned IP Addresses
Connection type
Connection ID
ID number
Connection data
Active connection setup Radio button to select Local or Partner CPU as the active connection
Address details
Port (decimal)
236
PROFINET
7.3 PLC-to-PLC communication
7.3.2.2
TRCV_C instruction
The TRCV_C instruction (Page 157) creates a communications connection to a partner
station. The connection is set up, established, and automatically monitored until it is
commanded to disconnect by the instruction. The TRCV_C instruction combines the
functions of the TCON, TDISCON, and TRCV instructions.
From the CPU configuration in the TIA Portal, you can configure how a TRCV_C instruction
receives data. To begin, you insert the instruction into the program from the Instructions tab
at the following location: "Extended Instructions" > "Communications"
The instruction is displayed, along with the Call options dialog where you assign a DB for
storing the parameters of the TRCV_C instruction.
You can assign tag memory locations to the inputs and outputs as in the figure below:
237
PROFINET
7.3 PLC-to-PLC communication
Protocol Name
Usage
RFC
1006
TCP
Transport of frames
238
PROFINET
7.3 PLC-to-PLC communication
In the "Address Details" section of the Connection Parameters dialog, you define the TSAPs
to be used. The TSAP of a connection in the CPU is entered in the "Local TSAP" field. The
TSAP assigned for the connection in your partner CPU is entered under the "Partner TSAP"
field.
Definition
General
End point: Partner
Interface
Subnet
Address
Assigned IP Addresses
Connection type
Connection ID
ID number
Connection data
Active connection setup Radio button to select Local or Partner CPU as the active connection
Address details
TSAP (ASCII)
TSAP ID
239
PROFINET
7.3 PLC-to-PLC communication
A connection-oriented protocol
Can be used very flexibly with third-party systems which exclusively support TCP
Routing-capable
Only static data lengths are applicable.
Messages are acknowledged.
Applications are addressed using port numbers.
Most of the user application protocols, such as TELNET and FTP, use TCP.
Programming effort is required for data management due to the SEND / RECEIVE
programming interface.
Definition
General
End point: Partner
Interface
Subnet
Address
Assigned IP Addresses
Connection type
Connection ID
ID number
Connection data
Active connection setup Radio button to select Local or Partner CPU as the active connection
Address details
Port (decimal)
240
PROFINET
7.4 Reference Information
7.4
Reference Information
7.4.1
MAC address
241
PROFINET
7.4 Reference Information
7.4.2
242
PROFINET
7.4 Reference Information
Note
All IP addresses are configured when you download the project.
The following table defines the parameters for time synchronization:
Parameter
Definition
Enable time-of-day
synchronization using Network
Time Protocol (NTP) servers
Server 1
Server 2
Server 3
Server 4
243
PROFINET
7.3 PLC-to-PLC communication
244
The CPU supports the Point-to-Point protocol (PtP) for character-based serial
communication, in which the user application completely defines and implements the
protocol of choice. PtP provides maximum freedom and flexibility, but requires extensive
implementation in the user program.
PtP enables a wide variety of possibilities:
The ability to send information directly to
an external device such as a printer
The ability to receive information from
other devices such as barcode readers,
RFID readers, third-party camera or vision
systems, and many other types of devices
The ability to exchange information,
sending and receiving data, with other
devices such as GPS devices, third-party
camera or vision systems, radio modems,
and many more
PtP communication is serial communication that uses standard UARTs to support a variety
of baud rates and parity options. The RS232 or RS485 communication module (CM)
provides the electrial interface for performing the PtP communications.
The TIA Portal provides libraries of instructions that you can use in programming your
application. These libraries provide PtP communication functions for the following protocols:
USS drive protocol
Modbus RTU Master Protocol
Modbus RTU Slave Protocol
8.1
245
8.2
246
2.4 kbits
19.2 kbits
76.8 kbits
600 baud
4.8 kbits
28.4 kbits
115.2 kbits
1.2 kbits
9.6 kbits
57.6 kbits
Parity: The default value for parity is no parity. Valid choices are:
No parity
Even
Odd
Mark (parity bit always set to 1)
Space (parity bit always set to 0)
Number of stop bits: The number of stop bits can be either one or two. The default is one.
Flow control: For the RS232 communication module, you can select either hardware or
software flow control, as described in the section "Managing flow control (Page 247)". If you
select hardware flow control, you can select whether the RTS signal is always on, or RTS is
switched. If you select software flow control, you can define the ASCII characters for the
XON and XOFF characters.
The RS485 communication module does not support flow control.
Wait time: You specify the wait time in milliseconds. The range is 0 to 65535 milliseconds.
The wait time specifies the time that the communication module waits to receive CTS after
asserting RTS, or for receiving an XON after receiving an XOFF, depending on the type of
flow control. If the wait time expires before the communication module receives an expected
CTS or XON, the communication module aborts the transmit operation and returns an error
to the user program.
8.3
247
Data Terminal Block Ready (DTR) and Data Set Ready (DSR) signal utilization
The CM sets DTR active for either type of hardware flow control. The module transmits only
when the DSR signal becomes active. The state of DSR is only evaluated at the start of the
send operation. If DSR becomes inactive after transmission has started, the transmission will
not be paused.
8.4
248
Parameter
Definition
RTS On delay
Specifies that an idle line will be sent after a break at message start. The
"Idle line after a break" parameter specifies how many bit times constitute
an idle line where the line is held in a marking condition. The default is 12
and the maximum is 65535, up to a limit of eight seconds.
249
Definition
Specifies that a particular condition that you select indicates the start of
a message. You can configure multiple special conditions. The order of
evaluation is:
Idle line
Line break
Start with single character or sequence
Special condition:
Specifies that the receiver recognizes a line break when the receive
data line is driven to a spacing condition for more than a character time,
and that this condition indicates the start of a message.
250
Definition
Special condition:
251
Definition
Recognize message
end by message
timeout
The message end occurs when the configured amount of time to wait for
message end has expired. The message timeout period begins when the
first character is received according to the message start criteria. The
default is 200 ms and the range is 0 to 65535 ms.
Recognize message
end by response
timeout
The message end occurs when the configured amount of time to wait for a
response expires before a valid start sequence is received. The response
timeout period begins when a transmission ends. The default response
timeout is 200 ms and the range is 0 to 65535 ms. You must configure
another end condition to indicate the actual end of a message.
Recognize message
end by inter-character
gap
The message end occurs when the maximum configured timeout between
consecutive characters of a message has expired. The default value for the
inter-character gap is 12 bit times and the maximum number is 65535 bit
times, up to a maximum of eight seconds.
Recognize message
end by max length
The message itself specifies the length of the message. The message end
occurs when a message of the specified length has been received. The
method for specifying and interpreting the message length is described
below.
Recognize message
end with a character
Recognize message
end with a character
sequence
In this case, the end condition is satisfied when two consecutive 0x7A
characters are received, followed by any two characters. The character
preceding the 0x7A 0x7A pattern is not part of the end character sequence.
Two characters following the 0x7A 0x7A pattern are required to terminate
the end character sequence. The values at character positions 4 and 5 are
irrelevant, but they must be received to satisfy the end condition.
252
Len
(n)
STX
0x0C
xx
PKE
4
INDEX
5
xxxx
PWD
8
xxxx
STW
9
10
xxxx
HSW
11
12
xxxx
13
xxxx
BCC
14
xx
Configure the receive message length parameters for this message as follows:
n = 2 (The message length is in byte 2.)
Length size = 1 (The message length is defined in one byte.)
Length m = 0 (There are no additional characters following the length specifier that are
not counted in the length count. Twelve characters follow the length specifier.)
In this example, the characters from 3 to 14 inclusive are the characters counted by Len (n).
Example 2: Consider another message structured according to the following protocol:
SD1
Len
(n)
Len
(n)
SD2
DA
SA
FA
xx
0x06
0x06
xx
xx
xx
xx
xx
xx
FCS
ED
10
11
12
xx
xx
xx
Configure the receive message length parameters for this message as follows:
n = 3 (The message length is in byte 3.)
Length size = 1 (The message length is defined in one byte.)
Length m = 3 (There are three characters following the length specifier that are not
counted in the length. In the protocol of this example, the characters SD2, FCS, and ED
are not counted in the length count. The other six characters are counted in the length
count; therefore the total number of characters following the length specifier is nine.)
In this example, the characters from 5 to 10 inclusive are the characters counted by Len (n).
S7-1200 Programmable controller
System Manual, 05/2009, A5E02486680-01
253
8.5
Configuration instructions
Before your user program can engage in PtP communication, you must configure the
communication interface port, and parameters for sending data and receiving data.
You can perform the port configuration and message configuration for
each communication module through the device configuration or
through these instructions in your user program:
PORT_CFG
SEND_CFG
RCV_CFG
Communication instructions
The PtP communication instructions enable the user program to send messages to and
receive messages from the communication modules.
The communication modules in turn send messages to and receive
messages from the actual point-to-point devices. The message
protocol is in a buffer that is either received from or sent to a specific
communication port.
SEND_PTP
RCV_PTP
All of the PtP functions operate asynchronously. The user program can use a polling
architecture to determine the status of transmissions and receptions. SEND_PTP and
RCV_PTP can execute concurrently. The communication modules buffer the transmit and
receive messages as necessary up to a maximum buffer size of 1024 bytes.
Additional instructions provide the capability to reset the receive buffer,
and to get and set specific RS232 signals.
8.5.1
RCV_RST
SGN_GET
SGN_SET
Polling architecture
To implement a polling architecture, the user program must check the status of each
message it sends or receives. The main program thread typically executes the polling
sequence.
254
255
8.6
Point-to-Point instructions
8.6.1
256
Parameter number
Event number
Error class
0
Error number
Status codes
Description
0000
No error
8x3A
8070
8080
8081
8082
257
Description
8083
Buffer overflow:
The CM returned a received message with a length greater than the length
parameter allowed.
8.6.2
8090
8091
8092
PORT_CFG instruction
PORT_CFG (Port Configuration) allows you to change port parameters such as baud rate
from your program.
Set up the initial static configuration of the port in the Hardware configuration properties.
Execute the PORT_CFG instruction in your program to change the configuration. The
PORT_CFG dynamic configuration changes are not permanently stored in the PLC.
LAD
258
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
PORT
IN
PORT
PROTOCOL
IN
UINT
Parameter
type
Data type
Description
BAUD
IN
UINT
PARITY
IN
UINT
Port parity:
1 - No parity
2 - Even parity
3 - Odd parity
4- Mark parity
5 - Space parity
DATABITS
IN
UINT
STOPBITS
IN
UINT
Stop bits:
1 - 1 stop bit
2 - 2 stop bits
FLOWCTRL
IN
UINT
Flow control:
1 - No flow control
2 - XON/XOFF
3 - Hardware RTS always ON
4 - Hardware RTS switched
XONCHAR
IN
CHAR
XOFFCHAR
IN
CHAR
XWAITIME
IN
UINT
DONE
OUT
BOOL
TRUE for one scan, after the last request was completed
with no error
ERROR
OUT
BOOL
TRUE for one scan, after the last request was completed
with an error
STATUS
OUT
WORD
259
Condition codes
8.6.3
STATUS
(W#16#....)
Description
80A0
80A1
80A2
80A3
80A4
80A5
SEND_CFG instruction
SEND_CFG (Send Configuration) allows the dynamic configuration of serial transmission
parameters in a Point-to-Point communication port. Any pending messages awaiting
transmission within a communication module (CM) will be discarded once SEND_CFG is
executed.
Set up the initial static configuration of the port in the device configuration properties.
Execute the SEND_CFG instruction in your program to change the configuration. The
SEND_CFG dynamic configuration changes are not permanently stored in the PLC.
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
PORT
IN
PORT
RTSONDLY
260
IN
UINT
Parameter
type
Data type
Description
RTSOFFDLY
IN
UINT
BREAK
IN
UINT
IDLELINE
IN
UINT
DONE
OUT
BOOL
ERROR
OUT
BOOL
STATUS
OUT
WORD
Condition codes
STATUS
Description
(W#16#....)
80B0
8.6.4
80B1
Break time is greater than the allowed value (2500 bit times)
80B2
Idle time is greater than the allowed value (2500 bit times)
RCV_CFG instruction
RCV_CFG (Receive Configuration) performs dynamic configuration of serial receiver
parameters in a Point-to-Point communication port. This instruction configures the conditions
that signal the start and end of a received message. Messages that satisfy these conditions
will be received by the RCV_PTP instruction.
Any queued messages waiting for transmission within a communication module (CM) will be
discarded when RCV_CFG is executed.
Set up the initial static configuration of the CM port in the device configuration properties.
Execute the RCV_CFG instruction in your program to change the configuration. The
RCV_CFG dynamic configuration changes are not permanently stored in the PLC; therefore,
following a power cycle, the initial static configuration from the device configuration will be
used.
261
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
PORT
IN
PORT
CONDITIONS
IN
Block_SDT
DONE
OUT
BOOL
ERROR
OUT
BOOL
STATUS
OUT
WORD
262
Characters
Variable Sequences
Start conditions can be constructed that are based upon a variable number of
character sequences (up to a maximum of 4) consisting of a varying number of
characters (up to a maximum of 5). Each character position within each sequence
may be selected as a specific character, or selected as a wild-card character, meaning
any character will qualify. This start condition can be used when different sequences
of characters indicate the start of a message.
Consider the following received hexadecimal coded message: "68 10 aa 68 bb 10 aa
16" and the configured start sequences shown in the table below. Start sequences
begin to be evaluated when the first 68H character is successfully received. Upon
successfully receiving the fourth character (the second 68H), then start condition 1 is
satisfied. Upon successfully receiving the fifth character (bbH), evaluation of the end
conditions begins.
The start sequence processing can be terminated due to various parity, framing, or
inter-character timing errors. These errors result in no received message, because the
start condition was not satisfied.
Start condition
First
Character
68H
xx
10H
aaH
xx
xx
xx
dcH
aaH
xx
xx
xx
e5H
xx
xx
xx
xx
xx
68H
xx
263
5&97,0(
Transmitted characters
Received characters
Message Timeout
The message timeout condition specifies that a message should be received within
the time specified by MSGTIME. The timer begins as soon as the specified start
condition has been satisfied.
Received characters
Intercharacter Gap
The intercharacter time is the time measured from the end of one character (the last
stop bit) until the end of the next character. If the time between any two characters
exceeds the number of configured bit times, the message will be terminated.
264
Received characters
The intercharacter timer expires and terminates the message with errors
Address
(1)
(2)
Len
(N)
(3)
xx
xx
xx
Message
... (x)
xx
xx
xx
xx
xx
Variable Characters
This end condition can be used to end receiving based upon different character
sequences. The sequences can consist of a varying number of characters (up to a
maximum of 5). Each character position within each sequence can be selected as a
specific character, or selected as a wild-card character, meaning any character will
satisfy the condition. Any leading characters that are configured to be ignored are not
required to be part of the message. Any trailing characters that are ignored are
required to be part of the message.
265
Parameter
type
Data type
Description
STARTCOND
IN
UINT
IDLETIME
IN
UINT
STARTCHAR
IN
BYTE
STRSEQ1CTL
IN
BYTE
STRSEQ1
IN
CHAR[5]
STRSEQ2CTL
IN
BYTE
STRSEQ2
IN
CHAR[5]
STRSEQ3CTL
IN
BYTE
STRSEQ3
IN
CHAR[5]
STRSEQ4CTL
IN
BYTE
STRSEQ4
IN
CHAR[5]
266
Parameter
Parameter
type
Data type
Description
ENDCOND
IN
UINT
MAXLEN
IN
UINT
IN
UINT
Parameter
type
Data type
Description
LENGTHSIZE
IN
UINT
LENGTHM
IN
UINT
RCVTIME
IN
UINT
MSGTIME
IN
UINT
CHARGAP
IN
UINT
ENDSEQ1CTL
IN
BYTE
ENDSEQ1
IN
CHAR[5]
STATUS
(W#16#....)
Description
80C0
80C1
80C2
80C3
Max length end condition is enabled and max length is 0 or > 1024
80C4
Condition codes
80C5
80C6
80C7
80C8
80C9
80CA
267
8.6.5
STATUS
(W#16#....)
Description
80CB
80CC
Start sequence (any one of 4) is enabled but all chars are "don't care"
SEND_PTP instruction
SEND_PTP (Send Point-to-Point data) initiates the transmission of the data. SEND_PTP
transfers the specified buffer to the RS232 or RS485 module. The CPU program continues
while the module sends the data at the specified baud rate.
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
PORT
IN
PORT
BUFFER
IN
VARIANT
LENGTH
IN
UINT
PTRCL
IN
BOOL
268
DONE
OUT
BOOL
TRUE for one scan, after the last request was completed
with no error
ERROR
OUT
BOOL
TRUE for one scan, after the last request was completed
with an error
STATUS
OUT
WORD
Operation
While a transmit operation is in progress, the DONE and ERROR outputs are FALSE. When
a transmit operation is complete, either the DONE or the ERROR output will be set TRUE
(for one scan cycle) to show the status of the transmit operation. While DONE or ERROR is
TRUE, the STATUS output is valid.
The instruction returns a status of 16#7001 if the communication module (CM) accepts the
transmit data. Subsequent SEND_PTP executions return a 16#7002 if the CM is still busy
transmitting. When the transmit operation is complete, the CM will return the status of the
transmit operation 16#0000, if no errors occurred. Subsequent executions of SEND_PTP
with REQ low return a status of 16#7000 (not busy).
Relationship of the output values to REQ:
This assumes that the instruction is called periodically to check for the status of the
transmission process. In the diagram below, it is assumed that the instruction is called every
scan (represented by the STATUS values).
The following diagram shows how the DONE and STATUS parameters are valid for only one
scan if the REQ line is pulsed (for one scan) to initiate the transmit operation.
The following diagram shows the relationship of DONE, ERROR and STATUS parameters
when there is an error.
269
Condition codes
8.6.6
STATUS
(W#16#....)
Description
80D0
80D1
80D2
80D3
7000
Not busy
7001
7002
RCV_PTP instruction
RCV_PTP (Receive Point-to-Point) checks for messages that have been received in the
Point-to-Point communication module (CM). If a message is available, it will be transferred
from the module to the CPU. If an error has occurred, an appropriate STATUS value will be
returned.
The STATUS value is valid when either NDR or ERROR is TRUE. The STATUS value
provides the reason for termination of the receive operation in the CM. This will typically be a
positive value, indicating that the receive operation was successful and that the receive
process terminated normally. If the STATUS value is negative (the Most Significant Bit of the
hexadecimal value is set), that indicates the receive operation was terminated for an error
condition such as parity, framing, or overrun errors.
Each Point-to-Point CM module can buffer up to a maximum of 1K bytes. This buffer can be
allocated across multiple received messages.
LAD
FBD
Parameter
Parameter
type
Data type
Description
EN_R
IN
BOOL
PORT
IN
PORT
270
Parameter
type
Data type
Description
BUFFER
IN
VARIANT
NDR
OUT
BOOL
TRUE for one scan, when new data is ready and operation
is complete with no errors.
ERROR
OUT
BOOL
TRUE for one scan, after the operation was completed with
an error
STATUS
OUT
WORD
LENGTH
OUT
UINT
The output NDR (New Data Ready) indicates that the requested action has completed
without error and new data has been received. This output will be set for one scan.
Condition codes
8.6.7
STATUS
(W#16#...)
Description
0000
No buffer present
80E0
80E1
80E2
80E3
80E4
0094
0095
0096
0097
0098
0099
RCV_RST instruction
RCV_RST (Receiver Reset) clears the receive buffer.
LAD
FBD
271
Parameter
Parameter
type
REQ
IN
BOOL
PORT
IN
PORT
8.6.8
DONE
OUT
BOOL
When TRUE for one scan, indicates that the last request was
completed without errors.
ERROR
OUT
BOOL
When TRUE, shows that the last request was completed with
errors. Also, when this output is TRUE, the STATUS output
will contain related error codes.
STATUS
OUT
WORD
Error code
SGN_GET instruction
SGN_GET (Get RS232 Signals) reads the current states of RS232 communication signals.
This function is only valid for the RS232 CM (communication module).
LAD
Parameter
FBD
Parameter
type
REQ
IN
BOOL
Get RS232 signal state values on the rising edge of this input
PORT
IN
PORT
272
NDR
OUT
BOOL
TRUE for one scan, when new data is ready and the
operation is complete with no errors
ERROR
OUT
BOOL
TRUE for one scan, after the operation was completed with an
error
STATUS
OUT
WORD
DTR
OUT
BOOL
DSR
OUT
BOOL
Parameter
type
RTS
OUT
BOOL
CTS
OUT
BOOL
DCD
OUT
BOOL
RING
OUT
BOOL
Condition code
STATUS
Description
(W#16#....)
8.6.9
80F0
80F1
80F2
80F3
SGN_SET instruction
SGN_SET (Set RS232 Signals) sets the states of RS232 communication signals. This
function is only valid for the RS232 CM (communication module).
LAD
FBD
Parameter
Parameter
type
Data type
Description
REQ
IN
BOOL
PORT
IN
PORT
SIGNAL
IN
BYTE
RTS
IN
BOOL
DTR
IN
BOOL
273
Parameter
type
Data type
Description
DSR
IN
BOOL
DONE
OUT
BOOL
TRUE for one scan, after the last request was completed
with no error
ERROR
OUT
BOOL
TRUE for one scan, after the last request was completed
with an error
STATUS
OUT
WORD
Condition code
8.7
STATUS
(W#16#....)
Description
80F0
80F1
80F2
80F3
Errors
Data type
Default
Description
DONE
Boolean
FALSE
ERROR
Boolean
FALSE
STATUS
Word
STATUS output
Both general and PtP specific errors can be returned. The bit representation for general
errors is as follows:
15
1
274
8
Parameter number
7
0
Event number
Error class
0
Error number
Error classes
Description
Port configuration
80Ax
Transmit configuration
80Bx
Receive configuration
80Cx
Transmission runtime
80Dx
Reception runtime
80Ex
Signal handling
80Fx
Description
0x80A0
0x80A1
0x80A2
0x80A3
0x80A4
0x80A5
Description
0x80B0
0x80B1
0x80B2
0x80B3
0x80B4
0x80B5
275
Description
0x80C0
0x80C1
0x80C3
0x80C4
0x80C5
0x80C6
0x80C7
0x80C8
0x80C9
0x80CA
0x80CB
0x80CC
Signal errors
Event / error ID
Description
0x80F0
0x80F1
0x80F2
The DSR signal can not be set since the module is a DTE device
Description
The total available transmit buffer of the CP has been exceeded
0x80D0
0x80D1
276
0x80D2
The transmit request was aborted because no DSR signal is received from the
DCE
0x80D3
0x7000
0x7001
0x7002
The transmit function is busy with subsequent calls (polls after the first call)
Description
0x80E0
0x80E1
0x80E2
0x80E3
0x80E4
The message was terminated as a result of the specified length exceeding the
total buffer size
0x0094
The message was terminated because the maximum character length was
received (MAXLEN)
0x0095
The message was terminated because the complete message was not
received in the specified time (MSGTIME)
0x0096
The message was terminated because the next character was not received in
the within the duration of the inter-character time (CHARGAP)
0x0097
The message was terminated because the first character was not received in
the specified time (RCVTIME)
0x0098
The message was terminated because the "n+len+m" length condition has
been satisfied (N+LEN+M)
0x0099
The message was terminated because the end sequence has been satisfied
(ENDSEQ)
Description
0x8n3A
0x8070
0x8080
0x8082
0x8083
0x8085
LEN parameter has the value of 0 or is greater than the largest value allowed
0x8088
277
278
Status LEDs
The CPU and the I/O modules use LEDs to provide information about either the operational
status of the module or the I/O.
The CPU provides the following status indicators:
STOP/RUN
Solid orange indicates STOP mode
Solid green indicates RUN mode
Flashing (alternating green and orange) indicates that the CPU is starting up
ERROR
Flashing red indicates an error, such as an internal error in the CPU, a error with the
memory card, or a configuration error (mismatched modules)
Solid red indicates defective hardware
MAINT (Maintenance)
Whenever you insert a memory card, the MAINT LED flashes. The CPU then changes to
STOP mode. After the CPU has changed to STOP mode, perform one of the following
functions to initiate the evaluation of the memory card:
Change the CPU to RUN mode
Perform a memory reset (MRES)
Power-cycle the CPU
Description
STOP / RUN
Orange / Green
ERROR
Red
MAINT
Orange
Power is off
Off
Off
Off
Off
Stop mode
On
(orange)
Run mode
On
(orange)
On
(orange)
Flashing
Error
On
(either orange or green)
Flashing
Maintenance requested
On
(either orange or green)
On
279
STOP / RUN
Orange / Green
ERROR
Red
MAINT
Orange
On
(orange)
On
Off
Flashing
Flashing
The CPU also provides two LEDs that indicate the status of the PROFINET communications.
Open the bottom terminal block cover to view the PROFINET LEDs.
Link (green) turns on to indicate a successful connection
Rx/Tx (yellow) turns on to indicate transmission activity
The CPU and each digital signal module (SM) provide an I/O Channel LED for each of the
digital inputs and outputs. The I/O Channel (green) turns on or off to indicate the state of the
individual input or output.
In addition, each digital SM provides a DIAG LED that indicates the status of the module:
Green indicates that the module is operational
Red indicates that the module is defective or non-operational
Each analog SM provides an I/O Channel LED for each of the analog inputs and outputs.
Green indicates that the channel has been configured and is active
Red indicates an error condition of the individual analog input or output
In addition, each analog SM provides a DIAG LED that indicates the status of the module:
Green indicates that the module is operational
Red indicates that the module is defective or non-operational
The SM detects the presence or absence of power to the module (field-side power, if
required).
Description
Field-side power is off
Not configured or updated in progress
Module configured with no errors
I/O Channet
(Red / Green)
Flashing red
Flashing red
Flashing green
Off
On (green)
On (green)
Flashing red
Flashing red
On (green)
Error condition
280
DIAG
(Red / Green)
9.2
You can then access the data on the target system in the online or diagnostics view using
the "Online tools" task card.
The current online
status of a device
is indicated by an
icon to the right
next to the device
in the project
navigation.
The orange color
indicates an online
connection.
Select "Accessible
Nodes" to find a
CPU on the
network.
281
9.3
282
9.4
9.5
283
9.6
9.7
284
The various functions can be selected using the buttons at the top of the watch table.
Enter the tag name to monitor and select a display format from the dropdown selection. With
an online connection to the CPU, clicking the "Monitor" button displays the actual value of
the data point in the "Monitor value" field.
Description
Permanent
Permanent: Continuously collects the data at the start of the scan cycle, after
the CPU reads the inputs
Once: Collects the data at the start of the scan cycle, after the CPU reads the
inputs
285
Description
Permanent: Continuously collects the data at the end of the scan cycle, before
the CPU writes the outputs
Once: Collects the data once at the end of the scan cycle, before the CPU
writes the outputs
At transition to
STOP
For modifying a PLC tag at a given trigger, select either the start or the end of cycle.
Modifying an output: The best trigger event for modifying an output is at the end of the
scan cycle, immediately before the CPU writes the outputs.
Monitor the value of the outputs at the beginning of the scan cycle to determine what
value is written to the physical outputs. Also, monitor the outputs before the CPU writes
the values to the physical outputs in order to check program logic and to compare to the
actual I/O behavior.
Modifying an input: The best trigger event for modifying an input is at the start of the
cycle, immediately after the CPU reads the inputs and before the user program uses the
input values.
If you are modifying inputs the start of the scan cycle, you should also monitor the value
of the inputs at the end of the scan cycle to ensure that the value of the input at the end
the scan cycle has not changed from the start of the scan cycle. If there is a difference in
the values, your user program may be writing to an input in error.
To diagnose why the CPU might have gone to STOP, use the "Transition to STOP" trigger to
capture the last process values.
286
&
'
Startup
RUN
Handling of communication requests and selftest diagnostics are not affected by the Force
function.
Digital I/O points assigned to HSC, PWM, and PTO cannot be forced
The digital I/O points used by the high-speed counter (HSC), pulse-width modulation (PWM),
and pulse-train output (PTO) devices are assigned during device configuration. When digital
I/O point addresses are assigned to these devices, the values of the assigned I/O point
addresses cannot be modified by the Watch table force function.
287
288
Technical specifications
A.1
Standards compliance
The S7-1200 automation system complies with the following standards and test
specifications. The test criteria for the S7-1200 automation system are based on these
standards and test specifications.
CE approval
The S7-1200 Automation System satisfies requirements and safety related
objectives according to the EC directives listed below, and conforms to the
harmonized European standards (EN) for the programmable controllers
listed in the Official Journals of the European Community.
EC Directive 2006/95/EC (Low Voltage Directive) "Electrical Equipment Designed for Use
within Certain Voltage Limits"
EN 61131-2:2007 Programmable controllers - Equipment requirements and tests
EC Directive 2004/108/EC (EMC Directive) "Electromagnetic Compatibility"
Emission standard
EN 61000-6-4:2007: Industrial Environment
Immunity standard
EN 61000-6-2:2005: Industrial Environment
EC Directive 94/9/EC (ATEX) "Equipment and Protective Systems Intended for Use in
Potentially Explosive Atmosphere
EN 60079-15:2005: Type of Protection 'n'
The CE Declaration of Conformity is held on file available to competent authorities at:
Siemens AG
IA AS RD ST PLC Amberg
Werner-von-Siemens-Str. 50
D92224 Amberg
Germany
289
Technical specifications
A.1 General Technical Specifications
cULus approval
Underwriters Laboratories Inc. complying with
Underwriters Laboratories, Inc.: UL 508 Listed (Industrial Control
Equipment)
Canadian Standards Association: CSA C22.2 Number 142
(Process Control Equipment)
NOTICE
The SIMATIC S7-1200 series meets the CSA standard.
The cULus logo indicates that the S7-1200 has been examined and certified by
Underwriters Laboratories (UL) to standards UL 508 and CSA 22.2 No. 142.
FM approval
Factory Mutual Research (FM):
Approval Standard Class Number 3600 and 3611
Approved for use in:
Class I, Division 2, Gas Group A, B, C, D, Temperature Class T4A Ta =
40 C
Class I, Zone 2, IIC, Temperature Class T4 Ta = 40 C
ATEX approval
EN 60079-0:2006: Explosive Atmospheres - General Requirements
EN 60079-15:2005: Electrical Apparatus for potentially explosive
atmospheres;
Type of protection 'n'
II 3 G Ex nA II T4
The following special conditions for safe use of the S7-1200 must be followed:
Install modules in a suitable enclosure providing a minimum degree of protection of IP54
according to EN 60529 and take into account the environmental conditions under which
the equipment will be used.
When the temperature under rated conditions exceeds 70 C at the cable entry point, or
80 C at the branching point of the conductors, the temperature specification of the
selected cable should be in compliance with the actual measured temperature.
Provisions should be made to prevent the rated voltage from being exceeded by transient
disturbances of more than 40%.
290
Technical specifications
A.1 General Technical Specifications
C-Tick approval
The S7-1200 automation system satisfies requirements of standards to AS/NZS
2064 (Class A)
Maritime approval
The S7-1200 products are periodically submitted for special agency approvals related to
specific markets and applications. Consult your local Siemens representative if you need
additional information related to the latest listing of exact approvals by part number.
Classification societies:
ABS (American Bureau of Shipping)
BV (Bureau Veritas)
DNV (Det Norske Veritas)
GL (Germanischer Lloyd)
LRS (Lloyds Register of Shipping)
Class NK (Nippon Kaiji Kyokai)
Industrial environments
The S7-1200 automation system is designed for use in industrial environments.
Application Field
Industrial
EN 61000-6-4:2007
EN 61000-6-2:2005
Electromagnetic compatibility
Electromagnetic Compatibility (EMC) is the ability of an electrical device to operate as
intended in an electromagnetic environment and to operate without emitting levels of
electromagnetic interference (EMI) that may disturb other electrical devices in the vicinity.
291
Technical specifications
A.1 General Technical Specifications
Electromagnetic Compatibility - Immunity per EN 61000-6-2
EN 61000-4-2
Electrostatic discharge
EN 61000-4-3
Radiated electromagnetic field
EN 61000-4-4
Fast transient bursts
EN 6100-4-5
Surge immunity
EN 61000-4-6
Conducted disturbances
EN 61000-4-11
Voltage dips
AC systems
0% for 1 cycle, 40% for 12 cycles and 70% for 30 cycles at 60 Hz
Environmental conditions
Environmental Conditions - Transport and Storage
EN 60068-2-2, Test Bb, Dry heat and
EN 60068-2-1, Test Ab, Cold
-40 C to +70 C
25 C to 55 C, 95% humidity
Atmospheric pressure
292
Technical specifications
A.1 General Technical Specifications
Environmental Conditions - Operating
Ambient temperature range
(Inlet Air 25 mm below unit)
0 C to 55 C horizontal mounting
0 C to 45 C vertical mounting
95% non-condensing humidity
Atmospheric pressure
Concentration of contaminants
S02: < 0.5 ppm; H2S: < 0.1 ppm; RH < 60% non-condensing
5 C to 55, 3 C/minute
Protection Class
Protection Class II according to EN 61131-2 (Protective conductor not required)
Degree of protection
IP20 Mechanical Protection, EN 60529
Protects against finger contact with high voltage as tested by standard probe. External
protection required for dust, dirt, water and foreign objects of < 12.5mm in diameter.
Rated voltages
Rated Voltage
Tolerance
24 VDC
120/230 VAC
NOTICE
When a mechanical contact turns on output power to the S7-1200 CPU, or any digital
signal module, it sends a "1" signal to the digital outputs for approximately 50
microseconds. You must plan for this, especially if you are using devices which respond to
short duration pulses.
293
Technical specifications
A.2 CPUs
A.2
CPUs
A.2.1
Technical Specifications
Model
CPU 1211C
AC/DC/Relay
CPU 1211C
DC/DC/Relay
CPU 1211C
DC/DC/DC
6ES7 211-1BD30-0XB0
6ES7 211-1HD30-0XB0
6ES7 211-1AD30-0XB0
370 grams
General
Dimensions W x H x D (mm)
90 x 100 x 75
Weight
420 grams
380 grams
Power dissipation
10 W
8W
4 mA/input used
CPU Features
User memory
6 inputs/4 outputs
2 inputs
none
1 SB max.
294
Technical specifications
A.2 CPUs
Technical Specifications
Model
CPU 1211C
AC/DC/Relay
CPU 1211C
DC/DC/Relay
CPU 1211C
DC/DC/DC
3 CMs max.
High-speed counters
3 total
Single phase: 3 at 100 kHz
Quadrature phase: 3 at 80 kHz
Pulse outputs
Edge interrupts
Memory card
+/- 60 seconds/month
Performance
Boolean execution speed
0.1 s/instruction
12 s/instruction
18 s/instruction
Communication
Number of ports
Type
Ethernet
Data rates
10/100 Mb/s
Cable type
CAT5e shielded
Power supply
Voltage range
85 to 264 VAC
Line frequency
47 to 63 Hz
--
60 mA at 120 VAC
30 mA at 240 VAC
300 mA at 24 VDC
900 mA at 24 VDC
Input current
CPU only at max. load
CPU with all expansion accessories
at max. load
Inrush current (max.)
20 A at 264 VAC
12 A at 28.8 VDC
1500 VAC
Not isolated
20 ms at 120 VAC
80 ms at 240 VAC
10 ms at 24 VDC
Sensor power
Voltage range
295
Technical specifications
A.2 CPUs
Technical Specifications
Model
CPU 1211C
AC/DC/Relay
CPU 1211C
DC/DC/Relay
Type
Rated voltage
30 VDC, max.
Surge voltage
15 VDC at 2.5 mA
CPU 1211C
DC/DC/DC
5 VDC at 1 mA
Isolation groups
Filter times
0.2, 0.4, 0.8, 1.6, 3.2, 6.4, and 12.8 ms (selectable in groups of 4)
Analog inputs
Number of inputs
Type
Voltage (single-ended)
Range
0 to 10 V
27,649 to 32,511 (refer to Analog input representation for voltage (Page 315) )
32,512 to 32767 (refer to Analog input representation for voltage (Page 315) )
Resolution
10 bits
35 VDC
Smoothing
None, Weak, Medium, or Strong (refer to Analog input response times (Page 315)
for step response times)
Noise rejection
10, 50, or 60 Hz (refer to Analog input response times (Page 315) for sample
rates)
Impedance
100 K
None
40 dB, DC to 60 Hz
Signal plus common mode voltage must be less than +12 V and greater than -12 V
Digital outputs
Number of outputs
Type
Voltage range
--
20 VDC min.
--
Current (max.)
2.0 A
0.5 A
Lamp load
30 W DC / 200 W AC
5W
ON state resistance
0.6 max.
296
Technical specifications
A.2 CPUs
Technical Specifications
Model
CPU 1211C
AC/DC/Relay
CPU 1211C
DC/DC/Relay
CPU 1211C
DC/DC/DC
--
10 A max.
Surge current
Overload protection
No
Isolation resistance
--
--
Isolation groups
--
L+ minus 48 VDC, 1 W
dissipation
10 ms max.
Not recommended
--
--
Number of Outputs On
simultaneously
Wiring Diagrams
Figure A-1
297
Technical specifications
A.2 CPUs
Figure A-2
Figure A-3
298
Technical specifications
A.2 CPUs
A.2.2
Technical Specifications
Model
CPU 1212C
AC/DC/Relay
CPU 1212C
DC/DC/Relay
CPU 1212C
DC/DC/DC
6ES7 212-1BD30-0XB0
6ES7 212-1HD30-0XB0
6ES7 212-1AD30-0XB0
370 grams
General
Dimensions W x H x D (mm)
90 x 100 x 75
Weight
425 grams
385 grams
Power dissipation
11 W
9W
4 mA/input used
CPU Features
User memory
8 inputs/6 outputs
2 inputs
2 SMs max.
1 SB max.
3 CMs max.
High-speed counters
4 total
Single phase: 3 at 100 kHz and 1 at 30 kHz clock rate
Quadrature phase: 3 at 80 kHz and 1 at 20 kHz clock rate
Pulse outputs
Edge interrupts
Memory card
+/- 60 seconds/month
Performance
Boolean execution speed
0.1 s/instruction
12 s/instruction
18 s/instruction
Communication
Number of ports
Type
Ethernet
Data rates
10/100 Mb/s
Cable type
CAT5e shielded
299
Technical specifications
A.2 CPUs
Technical Specifications
Model
CPU 1212C
AC/DC/Relay
CPU 1212C
DC/DC/Relay
CPU 1212C
DC/DC/DC
Voltage range
85 to 264 VAC
Line frequency
47 to 63 Hz
--
Input current
CPU only at max. load
80 mA at 120 VAC
40 mA at 240 VAC
400 mA at 24 VDC
1200 mA at 24 VDC
20 A at 264 VAC
12 A at 28.8 VDC
1500 VAC
Not isolated
20 ms at 120 VAC
80 ms at 240 VAC
10 ms at 24 VDC
Power supply
Sensor power
Voltage range
Type
Rated voltage
30 VDC, max.
Surge voltage
15 VDC at 2.5 mA
5 VDC at 1 mA
Isolation groups
Filter times
0.2, 0.4, 0.8, 1.6, 3.2, 6.4, and 12.8 ms (selectable in groups of 4)
Single phase: 100 KHz (Ia.0 to Ia.5) and 30 KHz (Ia.6 to Ia.7)
Quadrature phase: 80 KHz (Ia.0 to Ia.5) and 20 KHz (Ia.6 to Ia.7)
Analog inputs
Number of inputs
Type
Voltage (single-ended)
Range
0 to 10 V
27,649 to 32,511 (Refer to Analog input representation for voltage (Page 315) )
32,512 to 32767 (Refer to Analog input representation for voltage (Page 315) )
Resolution
10 bits
35 VDC
300
Technical specifications
A.2 CPUs
Technical Specifications
Model
CPU 1212C
AC/DC/Relay
CPU 1212C
DC/DC/Relay
CPU 1212C
DC/DC/DC
Smoothing
None, Weak, Medium, or Strong (refer to Analog input response times (Page 315)
for step response times)
Noise rejection
10, 50, or 60 Hz (refer to Analog input response times (Page 315) for sample rates)
Impedance
100 K
None
40 dB, DC to 60 Hz
Signal plus common mode voltage must be less than +12 V and greater than -12 V
Digital outputs
Number of outputs
Type
Voltage range
--
20 VDC min.
--
Current (max.)
2.0 A
0.5 A
Lamp load
30 W DC / 200 W AC
5W
ON state resistance
0.6 max.
--
10 A max.
Surge current
Overload protection
No
Isolation resistance
--
--
Isolation groups
--
L+ minus 48 VDC, 1 W
dissipation
10 ms max.
10 ms max.
50 s max., off to on
200 s max., on to off
Not recommended
--
--
Number of Outputs On
simultaneously
301
Technical specifications
A.2 CPUs
Wiring Diagrams
Figure A-4
Figure A-5
302
Technical specifications
A.2 CPUs
Figure A-6
A.2.3
Technical Specifications
Model
CPU 1214C
AC/DC/Relay
CPU 1214C
DC/DC/Relay
CPU 1214C
DC/DC/DC
6ES7 214-1BE30-0XB0
6ES7 214-1HE30-0XB0
6ES7 214-1AE30-0XB0
415 grams
General
Dimensions W x H x D (mm)
110 x 100 x 75
Weight
475 grams
435 grams
Power dissipation
14 W
12 W
4 mA/input used
CPU Features
User memory
14 inputs/10 outputs
2 inputs
8 SMs max.
1 SB max.
3 CMs max.
303
Technical specifications
A.2 CPUs
Technical Specifications
Model
CPU 1214C
AC/DC/Relay
High-speed counters
6 total
Single phase: 3 at 100 kHz and 3 at 30 kHz clock rate
Quadrature phase: 3 at 80 kHz and 3 at 20 kHz clock rate
Pulse outputs
14
CPU 1214C
DC/DC/Relay
CPU 1214C
DC/DC/DC
Edge interrupts
Memory card
+/- 60 seconds/month
Performance
Boolean execution speed
0.1 s/instruction
12 s/instruction
18 s/instruction
Communication
Number of ports
Type
Ethernet
Data rates
10/100 Mb/s
Cable type
CAT5e shielded
Power supply
Voltage range
85 to 264 VAC
Line frequency
47 to 63 Hz
--
500 mA at 24 VDC
1500 mA at 24 VDC
20 A at 264 VAC
12 A at 28.8 VDC
1500 VAC
Not isolated
20 ms at 120 VAC
80 ms at 240 VAC
10 ms at 24 VDC
Input current
CPU only at max. load
Sensor power
Voltage range
14
Type
304
Technical specifications
A.2 CPUs
Technical Specifications
Model
CPU 1214C
AC/DC/Relay
Rated voltage
30 VDC, max.
Surge voltage
15 VDC at 2.5 mA
5 VDC at 1 mA
CPU 1214C
DC/DC/Relay
CPU 1214C
DC/DC/DC
Isolation groups
Filter times
0.2, 0.4, 0.8, 1.6, 3.2, 6.4, and 12.8 ms (selectable in groups of 4)
Single phase: 100 KHz (Ia.0 to Ia.5) and 30 KHz (Ia.6 to Ib.5)
Quadrature phase: 80 KHz (Ia.0 to Ia.5) and 20 KHz (Ia.6 to Ib.5)
14
Analog inputs
Number of inputs
Type
Voltage (single-ended)
Range
0 to 10 V
27,649 to 32,511 (Refer to Analog input representation for voltage (Page 315) )
32,512 to 32767 (Refer to Analog input representation for voltage (Page 315) )
Resolution
10 bits
35 VDC
Smoothing
None, Weak, Medium, or Strong (refer to Analog input response time (Page 315)
for step response times)
Noise rejection
10, 50, or 60 Hz (refer to Analog input response time (Page 315) for sample rates)
Impedance
100 K
None
40 dB, DC to 60 Hz
Signal plus common mode voltage must be less than +12 V and greater than -12 V
Digital outputs
Number of outputs
10
Type
Voltage range
--
20 VDC min.
--
Current (max.)
2.0 A
0.5 A
Lamp load
30 W DC / 200 W AC
5W
ON state resistance
0.6 max.
--
10 A max.
Surge current
305
Technical specifications
A.2 CPUs
Technical Specifications
Model
CPU 1214C
AC/DC/Relay
CPU 1214C
DC/DC/Relay
CPU 1214C
DC/DC/DC
Overload protection
No
Isolation resistance
--
--
Isolation groups
--
L+ minus 48 VDC, 1 W
dissipation
10 ms max.
10 ms max.
50 s max., off to on
200 s max., on to off
Not recommended
--
--
Number of Outputs On
simultaneously
10
Wiring Diagrams
Figure A-7
306
Technical specifications
A.2 CPUs
Figure A-8
Figure A-9
307
Technical specifications
A.3 Digital signal modules (SMs)
A.3
A.3.1
Technical Specifications
Model
SM 1221 DI 8x24VDC
SM 1221 DI 16x24VDC
6ES7 221-1BF30-0XB0
6ES7 221-1BH30-0XB0
General
Dimensions W x H x D (mm)
45 x 100 x 75
Weight
170 grams
210 grams
Power dissipation
1.5 W
2.5 W
105 mA
130 mA
4 mA / input used
4 mA / input used
Number of inputs
16
Type
Rated voltage
30 VDC, max.
Surge voltage
15 VDC at 2.5 mA
5 VDC at 1 mA
Isolation groups
Filter times
0.2, 0.4, 0.8, 1.6, 3.2, 6.4, and 12.8 ms (selectable in groups of 4)
Digital inputs
308
4
16
Technical specifications
A.3 Digital signal modules (SMs)
Wiring diagrams
SM 1221 DI 8 x 24 VDC
SM 1221 DI 16 x 24 VDC
6ES7 221-1BF30-0XB0
6ES7 221-1BH30-0XB0
309
Technical specifications
A.3 Digital signal modules (SMs)
A.3.2
Technical Specifications
Model
SM 1222
DQ 8xRelay
SM1222
DQ 16xRelay
SM1222
DQ 8x24VDC
SM1222
DQ 16x24VDC
6ES7 222-1HF300XB0
6ES7 222-1HH300XB0
6ES7 222-1BF300XB0
6ES7 222-1BH300XB0
General
Dimensions W x H x D (mm)
45 x 100 x 75
Weight
190 grams
260 grams
180 grams
220 grams
Power dissipation
4.5 W
8.5 W
1.5 W
2.5 W
120 mA
135 mA
120 mA
140 mA
--
Number of outputs
Type
Digital Outputs
16
16
Voltage range
--
20 VDC min.
--
Current (max.)
2.0 A
0.5 A
Lamp load
30 W DC/200 W AC
5W
0.6 max.
--
10 A max.
Surge current
Overload protection
No
Isolation resistance
--
--
Isolation groups
1
8A
10 A
4A
--
L+ minus 48 V, 1 W dissipation
Switching delay
10 ms max.
50 s max. off to on
200 s max. on to off
--
--
310
16
16
Technical specifications
A.3 Digital signal modules (SMs)
Wiring Diagrams
SM 1222 DQ 8 x Relay
SM 1222 DQ 8 x 24 VDC
6ES7 222-1HF30-0XB0
6ES7 222-1BF30-0XB0
SM 1222 DQ 16 x Relay
SM 1222 DQ 16 x 24 VDC
6ES7 222-1HH30-0XB0
6ES7 222-1BH30-0XB0
311
Technical specifications
A.3 Digital signal modules (SMs)
A.3.3
Technical Specifications
Model
SM 1223 DI 8x24
VDC, DQ 8xRelay
SM 1223 DI 16x24
VDC, DQ
16xRelay
SM 1223 DI 8x24
VDC, DQ 8x24
VDC
SM 1223 DI 16x24
VDC, DQ16x24
VDC
6ES7 223-1PH300XB0
6ES7 223-1PL300XB0
6ES7 223-1BH300XB0
6ES7 223-1BL300XB0
Dimensions W x H x D (mm)
45 x 100 x 75
70 x 100 x 75
45 x 100 x 75
70 x 100 x 75
Weight
230 grams
350 grams
210 grams
310 grams
Power dissipation
5.5 W
10 W
2.5 W
4.5 W
145 mA
180 mA
145 mA
185 mA
4 mA / Input used
11 mA / Relay coil used
4 mA / Input used
Number of inputs
16
Type
Rated voltage
30 VDC max.
Surge voltage
Digital Inputs
16
15 VDC at 2.5 mA
5 VDC at 1 mA
Isolation groups
Filter times
0.2, 0.4, 0.8, 1.6, 3.2, 6.4, and 12.8 ms, selectable in groups of 4
2
16
16
16
Digital Outputs
Number of outputs
Type
16
Voltage range
--
20 VDC, min.
--
Current (max.)
2.0 A
0.5 A
Lamp load
30 W DC / 200 W AC
5W
0.6 max.
--
10 A max.
Surge current
Overload protection
No
Isolation resistance
--
--
312
Technical specifications
A.3 Digital signal modules (SMs)
Technical Specifications
Model
SM 1223 DI 8x24
VDC, DQ 8xRelay
SM 1223 DI 16x24
VDC, DQ
16xRelay
SM 1223 DI 8x24
VDC, DQ 8x24
VDC
SM 1223 DI 16x24
VDC, DQ16x24
VDC
Isolation groups
10A
8A
4A
8A
--
L+ minus 48 V, 1 W dissipation
Switching delay
10 ms max.
50 s max. off to on
200 s max. on to off
--
--
16
16
Wiring diagrams
SM 1223 DI 8 x 24 VDC, DQ 8 x Relay
6ES7 223-1PH30-0XB0
6ES7 223-1PL30-0XB0
313
Technical specifications
A.3 Digital signal modules (SMs)
314
6ES7 223-1BH30-0XB0
6ES7 223-1BL30-0XB0
Technical specifications
A.4 Analog signal modules (SMs)
A.4
A.4.1
Technical Specifications
Model
SM 1231 AI 4x13bit
SM 1234 AI 4x13bit
AQ 2x14bit
SM 1232 AQ 2x14bit
6ES7 231-4HD30-0XB0
6ES7 234-4HE30-0XB0
6ES7 232-4HB30-0XB0
General
Dimensions W x H x D (mm)
45 x 100 x 75
Weight
180 grams
220 grams
180 grams
Power dissipation
1.5 W
2.0 W
1.5 W
80 mA
45 mA
60 mA (no load)
45 mA (no load)
Analog Inputs
Number of inputs
Type
--
Range
10 V, 5 V, 2.5 V, or 0 to 20 mA
--
-27,648 to 27,648
Overshoot/undershoot range
(data word)
--
35 V / 40 mA
--
Smoothing
--
Noise rejection
--
Impedance
--
None
--
--
--
40 dB, DC to 60 Hz
--
--
--
Analog Outputs
Number of outputs
315
Technical specifications
A.4 Analog signal modules (SMs)
Technical Specifications
Model
SM 1231 AI 4x13bit
SM 1234 AI 4x13bit
AQ 2x14bit
Type
--
Voltage or current
Range
--
10 V or 0 to 20 mA
Resolution
--
Voltage: 14 bits
Current: 13 bits
--
--
--
Load impedance
--
Voltage: 1000
Current: 600
--
--
none
SM 1232 AQ 2x14bit
Diagnostics
Overflow/underflow
Yes1
No
Yes on outputs
Yes
Not applicable
No
Yes on outputs
Yes
Yes
If a voltage greater than +30 VDC or less than -15 VDC is applied to the input, the resulting value will be unknown and
the corresponding overflow or underflow may not be active.
60 Hz
50 Hz
10 Hz
18
22
100
Weak
52
63
320
Medium
32
203
241
1200
Strong
61
400
483
2410
0.625
4.17
25
Sample Rate
316
Rejection Frequency
400 Hz
Technical specifications
A.4 Analog signal modules (SMs)
Rejection Frequency
60 Hz
50 Hz
10 Hz
None
63
65
130
Weak
84
93
340
Medium
221
258
1210
Strong
424
499
2410
Sample Rate
4.17
25
10 V
5 V
2.5 V
0 to 10 V
32767
7FFF
11.851 V
5.926 V
2.963 V
Overflow
11.851V
Overflow
32512
7F00
32511
7EFF
11.759 V
5.879 V
2.940 V
Overshoot range
11.759 V
27649
6C01
Overshoot
range
27648
6C00
10 V
5V
2.5 V
Rated range
10 V
Rated range
20736
5100
7.5 V
3.75 V
1.875 V
361.7 V
180.8 V
90.4 V
361.7 V
0V
0V
0V
0V
-1
FFFF
-20736
AF00
-7.5 V
-3.75 V
-1.875 V
-27648
9400
-10 V
-5 V
-2.5 V
Negative
values are not
supported
-27649
93FF
-32512
8100
-11.759 V
-5.879 V
-2.940 V
-32513
80FF
-32768
8000
7.5 V
Undershoot range
Underflow
-11.851 V
-5.926 V
-2.963 V
317
Technical specifications
A.4 Analog signal modules (SMs)
Decimal
Hexadecimal
0 mA to 20 mA
32767
7FFF
23.70 mA
Overflow
32512
7F00
32511
7EFF
23.52 mA
Overshoot range
27649
6C01
27648
6C00
20 mA
Rated range
20736
5100
15 mA
723.4 nA
0 mA
-1
FFFF
-4864
ED00
-4865
ECFF
-32768
8000
Undershoot range
-3.52 mA
Underflow
318
Decimal
Hexadecimal
10 V
32767
7FFF
0.00 V
32512
7F00
11.76 V
Overshoot range
10 V
Rated range
32511
7EFF
27649
6C01
27648
6C00
20736
5100
7.5 V
361.7 V
0V
-1
FFFF
-361.7 V
-20736
AF00
-7.5 V
-27648
9400
-10 V
-27649
93FF
-32512
8100
-32513
80FF
-32768
8000
Undershoot range
-11.76 V
Underflow, off power
0.00 V
Technical specifications
A.4 Analog signal modules (SMs)
Decimal
Hexadecimal
20 mA
32767
7FFF
23.70 mA
Overflow
32512
7F00
32511
7EFF
23.52 mA
Overshoot range
27649
6C01
27648
6C00
20 mA
Rated range
20736
5100
15 mA
723.4 nA
0 mA
-1
FFFF
-32512
8100
-32513
80FF
-32768
8000
Undershoot range
Underflow
Wiring Diagrams
SM 1231 AI x 13 Bit
SM 1234 AI 4 x 13 Bit
6ES7 231-4HD30-0XB0
6ES7 234-4HE30-0XB0
319
Technical specifications
A.4 Analog signal modules (SMs)
SM 1232 AQ 2 x 14 bit
6ES7 232-4HB30-0XB0
320
Technical specifications
A.5 Signal boards (SBs)
A.5
A.5.1
6ES7 223-0BD30-0XB0
General
Dimensions W x H x D (mm)
38 x 62 x 21
Weight
40 grams
Power dissipation
1.0 W
50 mA
4 mA / Input used
Digital inputs
Number of inputs
Type
Rated voltage
30 VDC, max.
Surge voltage
15 VDC at 2.5 mA
5 VDC at 1 mA
Isolation groups
Filter times
Digital Outputs
Number of outputs
Output type
Voltage range
20 VDC min.
Current (max.)
0.5 A
Lamp load
5W
0.6 max.
10 A max.
321
Technical specifications
A.5 Signal boards (SBs)
Technical Data
Model
Surge current
Overload protection
No
Isolation groups
1A
L+ minus 48 V, 1 W dissipation
Switching delay
2 s max. off to on
10 s max. on to off
322
Technical specifications
A.5 Signal boards (SBs)
A.5.2
SB 1223 AQ 1x12bit
6ES7 232-4HA30-0XB0
General
Dimensions W x H x D (mm)
38 x 62 x 21 mm
Weight
40 grams
Power dissipation
1.5 W
15 mA
40 mA (no load)
Analog Outputs
Number of outputs
Type
Voltage or current
Range
10 V or 0 to 20 mA
Resolution
Voltage: 12 bits
Current: 11 bits
Load impedance
Voltage: 1000
Current: 600
None
Diagnostics
Overflow/underflow
Yes
Yes
Yes
323
Technical specifications
A.5 Signal boards (SBs)
324
Technical specifications
A.6 Communication modules (CMs)
A.6
A.6.1
Table A- 1
Technical Data
Order no. (MLFB)
6ES7 241-1CH30-0XB0
30 x 100 x 75 mm
Weight
150 grams
2 V min. at RL = 100
1.5 V min. at RL = 54
Receiver threshold/sensitivity
Isolation
RS485 signal to chassis ground
RS485 signal to CPU logic common
1000 m max.
1.1 W
From +5 VDC
220 mA
Pin
Description
Connector
1 GND
Not connected
3 TxD+
4 RTS
5 GND
Pin
Description
6 PWR
Not connected
8 TXD-
Not connected
SHELL
Chassis ground
325
Technical specifications
A.7 SIMATIC memory cards
A.6.2
6ES7 241-1AH30-0XB0
30 x 100 x 75 mm
Weight
150 grams
+/- 5 V min. at RL = 3K
3 K min.
Receiver threshold/sensitivity
Isolation
RS 232 signal to chassis ground
RS 232 signal to CPU logic common
10 m max.
1.1 W
From +5 VDC
220 mA
Pin
Description
1 DCD
2 RxD
3 TxD
4 DTR
Logic ground
5 GND
A.7
Connector
Pin
Description
6 DSR
7 RTS
8 CTS
9 RI
SHELL
Chassis ground
326
Order Number
Capacity
6ES7 954-8LF00-0AA0
24 MB
6ES7 954-8LB00-0AA0
2 MB
Technical specifications
A.8 Input simulators
A.8
Input simulators
Model
8 Position Simulator
14 Position Simulator
6ES7 274-1XF30-0XA0
6ES7 274-1XH30-0XA0
Dimensions W x H x D (mm)
43 x 35 x 23
67 x 35 x 23
Weight
20 grams
30 grams
Points
14
CPU 1214C
WARNING
These input simulators are not approved for use in Class I DIV 2 or Class I Zone 2
hazardous locations. The switches present a potential spark hazard/explosion hazard if
used in a Class I DIV 2 or Class I Zone 2 location.
8 Position Simulator
24 VDC sensor power out
PP
6ES7 274-1XF30-0XA0
327
Technical specifications
A.8 Input simulators
14 Position Simulator
24 VDC sensor
power out
PP
6ES7 274-1XH30-0XA0
328
The CPU has an internal power supply that provides power for the CPU itself, for any
expansion modules, and for other 24 VDC user power requirements.
There are three types of expansion modules:
Signal modules (SM) are installed on the right-side of the CPU. Each CPU allows a
maximum number of signal modules possible without regard to the power budget.
CPU 1214 allows 8 signal modules
CPU 1212 allows 2 signal modules
CPU 1211 allows no signal modules
Communication modules (CM) are installed on the left-side of the CPU. A maximum of 3
communication modules is allowed for any CPU without regard to the power budget.
Signal boards (SB) are installed on top of the CPU. A maximum of 1 signal board is
allowed for any CPU.
Use the following information as a guide for determining how much power (or current) the
CPU can provide for your configuration.
Each CPU supplies both 5 VDC and 24 VDC power:
The CPU provides 5 VDC power for the expansion modules when an expansion module
is connected. If the 5 VDC power requirements for expansion modules exceed the power
budget of the CPU, you must remove expansion modules until the requirement is within
the power budget.
Each CPU has a 24 VDC sensor supply that can supply 24 VDC for local input points or
for relay coils on the expansion modules. If the power requirement for 24 VDC exceeds
the power budget of the CPU, you can add an external 24 VDC power supply to provide
24 VDC to the expansion modules. You must manually connect the 24 VDC supply to the
input points or relay coils.
WARNING
Connecting an external 24 VDC power supply in parallel with the DC sensor supply can
result in a conflict between the two supplies as each seeks to establish its own preferred
output voltage level.
The result of this conflict can be shortened lifetime or immediate failure of one or both
power supplies, with consequent unpredictable operation of the PLC system.
Unpredictable operation could result in death, severe personal injury and/or property
damage.
The DC sensor supply on the CPU and any external power supply should provide power
to different points. A single connection of the commons is allowed.
Some of the 24V power input ports in the PLC system are interconnected, with a logic
common circuit connecting multiple M terminals. The CPU 24V power supply input, the SM
relay coil power input, and a non-isolated analog power supply input are examples of circuits
that are interconnected when designated as not isolated in the data sheets. All non-isolated
M terminals must connect to the same external reference potential.
S7-1200 Programmable controller
System Manual, 05/2009, A5E02486680-01
329
WARNING
Connecting non-isolated M terminals to different reference potentials will cause unintended
current flows that may cause damage or unpredictable operation in the PLC and connected
equipment.
Such damage or unpredictable operation could result in death, severe personal injury
and/or property damage.
Always be sure that all non-isolated M terminals in a PLC system are connected to the
same reference potential.
Information about the power budgets of the CPUs and the power requirements of the signal
modules is provided in the technical specifications (Page 289).
Note
Exceeding the power budget of the CPU may result in not being able to connect the
maximum number of modules allowed for your CPU.
B.1
330
5 VDC
1600 mA
24 VDC
400 mA
Minus
System requirements
5 VDC
24 VDC
14 * 4 mA = 56 mA
3 SM 1223, 5 V power
3 * 145 mA = 435 mA
1 SM 1221, 5 V power
1 * 105 mA = 105 mA
3 * 8 * 4 mA = 96 mA
3 * 8 * 11 mA = 264 mA
1 SM 1221, 8 inputs
8 * 4 mA = 32 mA
Total requirements
540 mA
448 mA
Current balance
5 VDC
24 VDC
1060 mA
(48 mA)
Equals
B.2
5 VDC
24 VDC
Minus
System requirements
5 VDC
24 VDC
Total requirements
Equals
Current balance
5 VDC
24 VDC
331
332
Order numbers
CPUs
CPU 1211C
CPU 1212C
CPU 1214C
Order Number
CPU 1211C DC/DC/DC
6ES7 211-1AD30-0XB0
6ES7 211-1BD30-0XB0
6ES7 211-1HD30-0XB0
6ES7 212-1AD30-0XB0
6ES7 212-1BD30-0XB0
6ES7 212-1HD30-0XB0
6ES7 214-1AE30-0XB0
6ES7 214-1BE30-0XB0
6ES7 214-1HE30-0XB0
Order Number
Signal modules
6ES7 221-1BF30-0XB0
6ES7 221-1BH30-0XB0
6ES7 222-1BF30-0XB0
6ES7 222-1BH30-0XB0
6ES7 222-1HF30-0XB0
6ES7 222-1HH30-0XB0
6ES7 223-1BH30-0XB0
6ES7 223-1BL30-0XB0
6ES7 223-1PH30-0XB0
6ES7 223-1PL30-0XB0
6ES7 231-4HD30-0XB0
6ES7 232-4HB30-0XB0
6ES7 234-4HE30-0XB0
Communication
modules
CM 1241 RS232
6ES7 241-1AH30-0XB0
CM 1241 RS485
6ES7 241-1CH30-0XB0
Signal boards
6ES7 223-0BD30-0XB0
6ES7 232-4HA30-0XB0
HMI devices
Order Number
6AV6 647-0AA11-3AX0
6AV6 647-0AB11-3AX0
6AV6 647-0AD11-3AX0
333
Order numbers
HMI devices
Order Number
6AV6 647-0AF11-3AX0
6AV6 647-0AG11-3AX0
Programming package
Order Number
6ES7 822-0AA0-0YA0
Order Number
Memory Cards
SIMATIC MC 2 MB
6ES7 954-8LB00-0AA0
SIMATIC MC 24 MB
6ES7 954-8LF00-0AA0
6EP1 332-1SH71
6GK7 277-1AA00-0AA0
6ES7 274-1XF30-0XA0
6ES7 274-1XH30-0XA0
6ES7 292-1AG30-0XA0
Other hardware
Spare Parts
6ES7 292-1AH30-0XA0
6ES7 292-1AL30-0XA0
6ES7 292-1AM30-0XA0
6ES7 292-1AP30-0XA0
6ES7 292-1AV30-0XA0
6ES7 292-1BC0-0XA0
6ES7 292-1BF30-0XA0
6ES7 292-1BG30-0XA0
6ES7 292-1BL30-0XA0
Documentation
S7-1200 Programmable Controller System Manual
334
Order Number
German
6ES7 298-8FA30-8AH0
English
6ES7 298-8FA30-8BH0
French
6ES7 298-8FA30-8CH0
Spanish
6ES7 298-8FA30-8DH0
Italian
6ES7 298-8FA30-8EH0
Chinese
6ES7 298-8FA30-8FH0
German
6ES7 298-8FA30-8AQ0
English
6ES7 298-8FA30-8BQ0
French
6ES7 298-8FA30-8CQ0
Spanish
6ES7 298-8FA30-8DQ0
Italian
6ES7 298-8FA30-8EQ0
Chinese
6ES7 298-8FA30-8FQ0
Index
A
Absolute value (ABS) instruction, 111
AC
Inductive loads, 32
Accessing the online help, 14
Add (ADD) instruction, 107
Analog I/O status indicators, 280
Analog signal module specifications, 315
Analog signal module voltage, 316
AND instruction, 124
ATEX approval, 290
ATTACH interrupt instruction, 172
B
Baud rate, 247
Bit logic, 87
Block
Types, 35
Block call
Basics, 35
Calling as single instance or multi-instance, 80
Block move (MOVE_BLK) instruction, 115
Blocks
data blocks (DBs), 35
function blocks (FBs), 35
functions (FCs), 35
organization blocks (OBs), 35
Break, 249, 250
Bus connector, 11
C
Calendar instructions, 130
CAN_DINT time delay interrupt instruction, 175
CE approval, 289
Ceiling (CEIL) instruction, 120
Character position
message length, 253
Character sequence
message end, 252
message start, 251
Clearance for installation, 20
Clock
time-of-day clock, 46
S7-1200 Programmable controller
System Manual, 05/2009, A5E02486680-01
335
Index
Cycle time, 45
HMI to CPU, 229
HSC (high-speed counter), 104
Industrial Ethernet port, 72, 224
IP address, 72, 224
PLC to PLC communication, 230
ports, 246
PROFINET, 72, 224
receive message, 250
Startup parameters, 37
Configuring parameters
CPU, 67
Ethernet port, 72, 224
modules, 69
PROFINET, 72, 224
Connector
Installation and Removal, 29
Contact information, 3
Context-sensitive help, 14
Convert instructions, 119
Copy protection, 84
Counter
high-speed (HSC), 102
high-speed (HSC): configuring, 104
Counter instructions, 97
CPU
1211C specifications, 294
1211C wiring diagrams, 297
1212C specifications, 299
1212C wiring diagrams, 302
1214C specifications, 303
1214C wiring diagrams, 306
Add modules, 68
Add new device, 66
Comparison chart, 10
configuring communication to HMI, 228
configuring multiple, 230
Configuring parameters, 67
Cycle time, 45
Device configuration, 65
download to device, 227
Ethernet port, 72, 224
going online, 281
Grounding, 31
Inductive loads, 32
Installation procedures, 24
IP address, 72, 224
Isolation guidelines, 31
Lamp loads, 33
MAC address, 241
Network connection, 71
online, 282
336
Operating modes, 38
operating panel for online, 283
Overview, 9
Password protection, 48
Power budget, 20
power requirements, 329
PROFINET, 72, 224
Program execution, 37
Security levels, 48
Signal board (SB), 11
Startup parameters, 37
Startup processing, 39
STOP mode, 286
Thermal zone, 22
watch tables, 284
Wiring guidelines, 30, 32
Creating a network connection, 71
C-Tick approval, 291
CTRL_PWM instruction, 179
CTS, 247
cULus approval, 290
Customer support, 3
Cycle time, 43, 45
Cycle time monitoring, online CPU, 283
D
Data block
Global data block, 49, 81
Instance data block, 49
organization block (OB), 78
Data block (DB), 81
Data handling block (DHB), 82
Data transmission, initiating, 268
Data types, 54
Arrays, 57
STRING, 57
Date instructions, 130
DB (data block), 81
DC
Inductive loads, 32
DEC (decrement) instruction, 110
Decode (DECO) instruction, 125
DELETE instruction, 143
Designing a PLC system, 75, 76
DETACH interrupt instruction, 172
Device configuration, 65, 216
Add modules, 68
Add new device, 66
Configuring the CPU, 67
Configuring the modules, 69
Ethernet port, 72, 224
S7-1200 Programmable controller
System Manual, 05/2009, A5E02486680-01
Index
Network connection, 71
PROFINET, 72, 224
Diagnostics buffer, 46, 284
Digital I/O status indicators, 280
Digital signal board (SB) specifications, 321
DIN rail, 23
DIS_AIRT alarm interrupt instruction, 177
Displaying the contents and index (online help), 15
Divide (DIV) instruction, 107
Documentation, 14
Download to device, 227
F
FB (function block), 80
FBD (function block diagram), 83
FC (function), 80
Fill (FILL_BLK) instruction, 117
FIND instruction, 143
Floating-point math instruction, 113
Floor (FLOOR) instruction, 120
H
Hardware configuration, 65
Add modules, 68
Add new device, 66
Configuring the CPU, 67
Configuring the modules, 69
Ethernet port, 72, 224
Network connection, 71
PROFINET, 72, 224
Hardware flow control, 247
Help, 14
Displaying the contents and index, 15
337
Index
Expanding, 15
Printing, 16
Undocking, 15
High-speed counter, 102
High-speed counter (HSC) instruction, 99
HMI
configuring PROFINET communication, 228
HMI devices
Network connection, 71
Overview, 17
Hotline, 3
HSC (high-speed counter), 102
configuration, 104
I
I/O
Addressing, 53
analog status indicators, 280
digital status indicators, 280
Inductive loads, 32
I/O modules
watch tables, 284
Idle line, 249, 250
INC (increment) instruction, 110
Inductive loads, 32
Information system, 14
Displaying the contents and index, 15
Expanding, 15
Printing, 16
Undocking, 15
Input simulators, 327
In-range instruction, 106
INSERT instruction, 143
Installation
Clearance, 20
Communication module (CM), 27
CPU, 24
Grounding, 31
Guidelines, 19
Inductive loads, 32
Isolation guidelines, 31
Lamp loads, 33
Mounting dimensions, 22
Overview, 19
Power budget, 20
Signal board (SB), 28
Signal module (SM), 25
STEP 7, 12
Terminal block connector, 29
Thermal zone, 22
TIA Portal, 12
338
Index
OR, 124
out-of-range, 106
PID_Compact, 178
PORT_CFG (port configuration), 258
positive edge, 91
RCV_CFG (receive configuration), 261
RCV_PtP (receive Point-to-Point), 270
RCV_RST (receiver reset), 271
RE_TRIGR, 43, 151
reset, 89
return value (RET), 123
rotate left (ROL), 129
rotate right (ROR), 129
round, 119
scale (SCALE_X), 121
select (SEL), 127
SEND_CFG (send configuration), 260
SEND_PTP (send Point-to-Point data), 268
set, 89
SGN_GET (get RS232 signals), 272
SGN_SET (set RS232 signals), 273
shift left (SHL), 128
shift right (SHR), 128
STP (stop PLC scan cycle), 152
string operations: CONCAT, 143
string operations: DELETE, 143
string operations: FIND, 143
string operations: INSERT, 143
string operations: LEFT, 143
string operations: LEN (string length), 143
string operations: MID, 143
string operations: REPLACE, 143
string operations: RIGHT, 143
string to value: S_CONV, 135
string to value: STRG_VAL, 135
subtract (SUB), 107
swap, 118
T_ADD, 130
T_CONV, 130
T_DIFF, 130
T_SUB, 130
TCON, 163
TDISCON, 163
time, 130
timer, 93
timer: RT (reset timer), 93
timer: TOF (off-delay timer), 93
timer: TON (on-delay timer), 93
timer: TONR (on-delay retentive timer), 93
timer: TP (pulse timer), 93
TRCV, 163
TRCV_C, 157, 237
J
JMPN instruction, 123
Jump (JMP) instruction, 123
K
Know-how protection, 84
L
Label instruction, 123
LAD (ladder logic), 82
Lamp loads, 33
LED indicators, 256, 279
LEFT instruction, 143
LEN instruction, 143
Length
message, 253
Length m, 253
Length n, 253
Limit instruction, 112
Linear programming, 76
339
Index
M
MAC address, 72, 224, 241
Maritime approval, 291
Master polling architecture, 255
Math instructions, 107
MAX (maximum) instruction, 111
Maximum message length, 252
Memory
clock memory, 47
I (process image input), 51
L (local memory), 49
load memory, 45, 58
M (bit memory), 52
Q (process image output), 51
retentive memory, 45, 58
system memory, 47
Temp memory, 52
work memory, 45, 58
Memory card specifications, 326
Memory card, using, 61
Memory locations, 49, 51
Memory usage monitoring, online CPU, 283
Message configuration
instructions, 254
receive, 250
transmit, 249
Message end, 252
Message length, 252
Message start, 250
MID instruction, 143
MIN (minimum) instruction, 111
Miscellaneous PtP parameter errors, 277
MOD (modulo) instruction, 108
Modules
Communication module (CM), 12
Comparison chart, 10
Configuring parameters, 69
Signal board (SB), 11
Signal module (SM), 11
Thermal zone, 22
Monitoring the program, 85
Mounting
Clearance, 20
Communication module (CM), 27
CPU, 24
Dimensions, 22
Grounding, 31
Guidelines, 19
Inductive loads, 32
Isolation, 31
Lamp loads, 33
Overview, 23
340
N
NEG (negation) instruction, 109
Negative edge instruction, 91
Network communication, 215
Network connection, 71
multiple CPUs, 232
Network time protocol (NTP), 242
Normalize (NORM) instruction, 121
Not OK instruction, 107
Numbers
Floating point, 55
Real, 55
O
Off-delay (TOF) instruction, 93
OK instruction, 107
On-delay delay (TON) instruction, 93
On-delay retentive (TONR) instruction, 93
Online CPU, 282
cycle time monitoring, 283
memory usage monitoring, 283
operating panel, 283
Online help, 14
Displaying the contents and index, 15
Expanding the help window, 15
Printing, 16
Undocking, 15
Online, going online, 281
OR instruction, 124
Organization block
Call, 35
configuring operation, 80
creating, 79
Function, 35
multiple cyclic, 79
Priority classes, 35
processing, 78
Out-of-range instruction, 106
Output parameters, 80
Index
P
Parameter assignment, 80
Parameters configuration
receive, 238
transmit, 234
Parity, 247
Password protection
Code block, 84
CPU, 48
PID_Compact instruction, 178
PLC
Overview, 9
system design, 75
using blocks, 76
Point-to-point communication, 245
Point-to-Point programming, 254
Polling architecture, 254
Port configuration, 246
instructions, 254
Port configuration errors, 275
PORT_CFG (port configuration) instruction, 258
Portal view, 13
Add modules, 68
Add new device, 66
Configuring the CPU, 67
Configuring the Ethernet port, 72, 224
Configuring the modules, 69
PROFINET, 72, 224
Positive edge instruction, 91
Power budget, 20, 329
sample, 330, 331
Power requirements
calculating, 330, 331
Printing the help topics, 16
Priorities in processing, 40
Priority class
Overview, 35
PROFINET, 213
IP address, 72, 224
Network connection, 71
testing a network, 226
PROFINET interface
Ethernet address properties, 73, 225
Time synchronization properties, 243
Program execution, 36
Program structure, 77
Programming
FBD (function block diagram), 83
LAD (ladder), 82
Linear, 76
power flow (EN and ENO), 83
PtP instructions, 254
S7-1200 Programmable controller
System Manual, 05/2009, A5E02486680-01
Structured, 76
Project
Protecting a code block, 84
Restricting access to a CPU, 48
Project view, 13
Add modules, 68
Add new device, 66
Configuring the CPU parameters, 67
Configuring the Ethernet port, 72, 224
Configuring the modules, 69
Device configuration, 65
Network connection, 71
PROFINET, 72, 224
Protection class, 293
Protection level
Code block, 84
CPU, 48
Protocol
communication, 245
freeport, 245
PTO (pulse train output), 180
PtP communication, 245
PtP instruction return values, 274
PtP programming, 254
Pulse delay (TP) instruction, 93
Pulse train output (PTO), 180
PWM
CTRL_PWM instruction, 179
Q
Queuing, 40
R
Rated voltages, 293
RCV_CFG (receive configuration) instruction, 261
RCV_PTP (receive Point-to-Point) instruction, 270
RCV_RST (receiver reset) instruction, 271
RE_TRIGR instruction, 151
Receive configuration errors, 276
Receive message configuration, 250
Receive parameters configuration, 238
Receive runtime return values, 277
Relay electrical service life, 294
REPLACE instruction, 143
Reset instruction, 89
Reset timer (RT) instruction, 93
Return value (RET) instruction, 123
Return values
PtP instructions, 274
341
Index
S
S_CONV instruction, 135
S7-1200
Add modules, 68
Add new device, 66
Clearance, 20
Communication module (CM), 12
Comparison chart of CPU models, 10
Configuring the CPU parameters, 67
Configuring the modules, 69
CPU, 9
CPU installation procedures, 24
Cycle time, 45
Device configuration, 65
Ethernet port, 72, 224
Expanding the capabilities, 10
Grounding, 31
HMI devices, 17
Inductive loads, 32
installing a CM, 27
installing an SB, 28
installing an SM, 25
IP address, 72, 224
Isolation guidelines, 31
Lamp loads, 33
Mounting dimensions, 22
Network connection, 71
Overview of installation, 23
Password protection, 48
Power budget, 20
PROFINET, 72, 224
Signal board (SB), 11
Signal module (SM), 11
Startup parameters, 37
Terminal block connector, 29
342
Thermal zone, 22
Wiring guidelines, 30, 32
SB 1223 specifications, 321, 323
SB 1223 wiring diagram, 322
SB 1232 wiring diagram, 324
Scale (SCALE_X instruction, 121
Scan cycle time, 43
Security
Code block, 84
CPU, 48
Select (SEL) instruction, 127
Send message configuration, 249
Send parameters configuration, 234
SEND_CFG (send configuration) instruction, 260
SEND_PtP (send Point-to-Point data) instruction, 268
Serial communication, 245
Set instruction, 89
SGN_GET (get RS232 signals) instruction, 272
SGN_SET (set RS232 signals) instruction, 273
Shift left (SHL) instruction, 128
Shift right (SHR) instruction, 128
Signal board (SB)
Add modules, 68
Comparison chart, 10
Device configuration, 65
Installation, 28
Overview, 11
power requirements, 329
Removal, 28
Signal board (SM)
Add new device, 66
Signal handling errors, 276
Signal module (SM)
Add modules, 68
Add new device, 66
Comparison chart, 10
Device configuration, 65
Installation, 25
Overview, 11
power requirements, 329
Removal, 25
Signal modules
SM 1221 specifications, 308
SM 1222 specifications, 310
SM 1223 specifications, 312
Single instance
Example, 81
Slave polling architecture, 255
Software flow control, 248
Specifications
Analog dignal module voltage, 316
Analog signal modules, 315
Index
T
T_ADD instruction, 130
T_CONV instruction, 130
T_DIFF instruction, 130
T_SUB instruction, 130
TCON instruction, 163
TCP/IP communication, 213
TDISCON instruction, 163
Technical specifications, 289
Technical support, 3
Terminal block connector
Installation, 29
Testing the program, 85
Thermal zone, 22
TIA Portal
Add modules, 68
Add new device, 66
Configuring the CPU, 67
Configuring the modules, 69
Device configuration, 65
Ethernet port, 72, 224
Installation, 12
Network connection, 71
Portal view, 13
PROFINET, 72, 224
Project view, 13
Time instructions, 130
Time of day, setting the online CPU, 282
Timer instructions, 93
TOF (off-delay) timer instruction, 93
TON (on-delay delay) timer instruction, 93
TONR (on-delay retentive) timer instruction, 93
Tool tips, 14
TP (pulse delay) timer instruction, 93
Transmission block (T-block), 232
Transmit configuration errors, 275
Transmit message configuration, 249
Transmit runtime errors, 276
TRCV instruction, 163
TRCV_C instruction, 157, 237
TRCV_C instruction configuration, 238
Truncate (TRUNC) instruction, 119
TSAP (transport service access points, 234
TSAP (transport service access points), 238
TSEND instruction, 163
343
Index
U
Undocking the online help, 15
Uninterruptible fill (UFILL_BLK) instruction, 117
Uninterruptible move (UMOVE_BLK) instruction, 115
USS protocol library, 182
USS status codes, 190
USS_DRV instruction, 184
USS_PORT instruction, 187
USS_RPM instruction, 187
USS_WPM instruction, 189
V
VAL_STRG instruction, 135
Value to string instructions, 135
W
Wait time, 247
Watch tables, 85, 284
Watchdog, 151
Wiring diagrams
CPU 1211C, 297
CPU 1212C, 302
CPU 1214C, 306
SB 1223, 322
SB 1232, 324
SM 1221 signal module, 309
SM 1222 signal module, 311
SM 1223 signal module, 313
SM 1231, 1232, 1234, 319
Wiring guidelines
Grounding, 31
Prerequisites, 30
X
XON / XOFF, 248
XOR (exclusive OR) instruction, 124
344
SIMATIC
S7-1200 System Manual
Update to edition 05/2009
Product Information
In spite of efforts to ensure the accuracy and clarity in the product documentation, some of the pages in the S7-1200
Programmable Controller System Manual contain information that has been identified as being incomplete, incorrect or
misleading.
An interrupt event with no attached OB
When you configure the PLC, you can configure interrupt events to occur (for example, for the HSC or for edge-detection of
digital inputs). You have the option to associate the event with an interrupt OB during configuration, or you can also use an
Attach instruction in your program to associate an event with an interrupt OB.
If the interrupt event occurs but cannot find an attached OB, the following message might be written to the diagnostics
buffer: "Accepted number of pending OB 0 - events exceeded - Processing continued (no OB processing)"
When troubleshooting, check the following possible causes for this message:
An interrupt event was enabled but not associated with an interrupt OB in the device configuration, and the user program
did not include an Attach instruction to associate the event with an interrupt OB.
A Detach instruction in the user program removed the association with the interrupt OB.
If you receive this message, ensure that all events are correctly attached to an interrupt OB.
Booleans and Boolean arrays are not allowed for TRCV/TRCV_C and PtP instructions
The use of Boolean data or Boolean arrays is not allowed for the TRCVand TRCV_C instructions and for the point-to-point
(PtP) instructions.
GET_ERROR instruction always returns a 0 for the FLAGS byte
In the description of the of the data structure for the ERROR parameter of the GET_ERROR instruction (Section 6.2.3.3), the
description of the FLAGS byte states that a value of "1" determines that an error occurred during a call to another block.
However, the GET_ERROR instruction always returns a value of "0" for the FLAGS byte.
"Diagnostics changed" bit is not available during startup or the first scan cycle
Because the CPU does not set the "diagnostics changed" bit until the end of the first execution of the of the program cycle
OBs, your program cannot detect if there has been a diagnostic change either during the execution of the startup OBs or the
first execution of the program cycle OBs.
Attempting to force I/O on a write-protected memory card causes an error
If the user program on a write-protected memory card is being executed by the CPU, you cannot initiate or change the
forcing of I/O from a watch table because you cannot override the values in the write-protected user program. Any attempt to
force the write-protected values generates an error.
Procedure for accessing the properties of a card reader
In section 3.4.2 that describes how to create a "Program" card, the procedure is incorrect. After you expand the "SIMATIC
card reader", you must also expand the card reader device. Select the drive where you inserted the memory card. Right-click
the drive to display the context menu and select "Properties". From the drop-down menu for "Card type" of the "Properties"
dialog, select "Program".
Password-protection of specific blocks or instructions
Section 3.1.4 of the S7-1200 System Manual incorrectly implies that access to the CPU can be password-protected for an
individual instruction, such as the "Set time of day/date" instruction. However, you can only password-protect access for the
complete CPU.
Siemens 2009
A5E02573237-01, 05/2009
Explanation
8070
8080
8081
8090
8091
8092
Size (bits)
Numeric Range
BCD16
16
-999 to 999
123, -123
BCD32
32
-9999999 to 9999999
1234567, -1234567
Data type
Description
OUT
Exceeding the maximum pulse frequency with the basic motion control instructions
NOTICE
As described in the S7-1200 System Manual, the maximum pulse frequency of the pulse output generators is 100 KHz for
the digital outputs of the CPU and 20 KHz for the digital outputs of the signal board. However, STEP 7 Basic does not alert
you when you configure an axis that with a maximum speed or frequency that exceeds this hardware limitation. This could
cause problems with your application, so always ensure that you do not exceed the maximum pulse frequency of the
hardware.
Description
Force
Retentive
I
Process image input
No
No
I_:P
(Physical input)
Yes
No
Siemens AG
Industry Sector
Postfach 48 48
90026 NRNBERG
Update to edition 05/2009
A5E02573237-01, 05/2009
4