Control Systems & Sensors

Reader
Edition 2024/2025
Version V 1.0
Version History

Version History
VERSION DATE AUTHOR CHANGES

V 1.0 2024.08.30 M. Joren Initial release

Version 1.0
Table of Contents

Table of Contents
1 PREFACE ............................................................................................................................................................... 1
2 WHAT IS A PLC?.................................................................................................................................................... 2
2.1 Introduction ................................................................................................................................................................ 2
2.2 Modularity .................................................................................................................................................................. 5
2.2.1 Fieldbus ................................................................................................................................................................. 5
2.3 How does a PLC work? .............................................................................................................................................. 6
2.3.1 Scan cycle ............................................................................................................................................................. 6
2.3.2 Operating modes of the CPU ................................................................................................................................ 7
2.3.3 Execution of the user program ............................................................................................................................. 8
2.4 Extensibility .............................................................................................................................................................. 10
2.4.1 Signal modules ................................................................................................................................................... 10
2.4.2 Communication................................................................................................................................................... 11

3 PROGRAMMING LANGUAGES ................................................................................................................................. 12

3.1 Ladder Diagram (LAD) ............................................................................................................................................. 13
3.2 Function Block Diagram (FBD) ................................................................................................................................ 16
3.3 Structured Control Language (SCL) ........................................................................................................................ 17
3.3.1 Program Control in SCL ...................................................................................................................................... 18
3.3.2 Loops in SCL ....................................................................................................................................................... 21
3.3.3 Control functions ................................................................................................................................................ 24
3.3.4 Conversions in SCL ............................................................................................................................................. 25
3.3.5 Tips and Tricks for SCL....................................................................................................................................... 26

4 THE ISA-S88 MODEL ........................................................................................................................................... 27

4.1 ISA-S88 Control levels ............................................................................................................................................. 28
4.2 Introduction ISA-S88 ................................................................................................................................................ 29
4.2.1 Physical Model .................................................................................................................................................... 29
4.3 Examples .................................................................................................................................................................. 33
4.3.1 Chemical Process ............................................................................................................................................... 33
4.3.2 Production Line ................................................................................................................................................... 35

5 SOFTWARE DESIGN .............................................................................................................................................. 40

5.1 Software Development Life Cycle ........................................................................................................................... 40
5.2 The V-Model ............................................................................................................................................................. 41
5.3 Understanding the V-Model ..................................................................................................................................... 42
5.3.1 Problem Analysis ................................................................................................................................................ 42
5.3.2 User Requirements ............................................................................................................................................. 43
5.3.3 System Requirements......................................................................................................................................... 43
5.3.4 System Design .................................................................................................................................................... 44
5.3.5 Module Design .................................................................................................................................................... 44
5.3.6 Coding ................................................................................................................................................................. 44
5.4 MoSCoW method ..................................................................................................................................................... 45
5.5 How to apply the V-Model ....................................................................................................................................... 46
5.5.1 Problem Analysis ................................................................................................................................................ 46
5.5.2 Translating .......................................................................................................................................................... 47
5.6 The Turn-Key Project ................................................................................................................................................ 47
5.7 Software Testing ...................................................................................................................................................... 49
5.8 Examples .................................................................................................................................................................. 50

6 STATE MACHINES AND FLOWCHARTS ..................................................................................................................... 52

6.1 Flowcharts................................................................................................................................................................ 52
6.2 State Machines ........................................................................................................................................................ 54

-i- Version 1.0

Table of Contents

7 PROGRAM BLOCKS ............................................................................................................................................... 56

7.1 Choosing the type of structure for your program ................................................................................................... 57
7.2 Using blocks to structure your program ................................................................................................................. 57
7.3 Organization Blocks (OB) ........................................................................................................................................ 59
7.3.1 Create an OB ....................................................................................................................................................... 59
7.3.2 Event execution priorities and queuing .............................................................................................................. 62
7.4 Function (FC)............................................................................................................................................................ 65
7.4.1 Create an FC ........................................................................................................................................................ 65
7.4.2 Programming the FC ........................................................................................................................................... 67
7.4.3 Changing between languages ............................................................................................................................ 69
7.5 Function Block (FB) ................................................................................................................................................. 70
7.5.1 Reusable code blocks with associated memory ............................................................................................... 70
7.5.2 Assigning the start value in the instance DB ..................................................................................................... 71
7.6 Datablock (DB) ......................................................................................................................................................... 72
7.6.1 Global DB ............................................................................................................................................................. 72
7.6.2 Instances ............................................................................................................................................................. 73
7.6.3 Multi-instances.................................................................................................................................................... 73
7.6.4 Optimized and standard data blocks ................................................................................................................. 74
7.7 Creating reusable blocks ......................................................................................................................................... 75
7.7.1 Passing parameters to blocks............................................................................................................................ 76
7.7.2 EN and ENO for LAD, FBD and SCL .................................................................................................................... 77

8 TIMERS, COUNTERS AND EDGES ............................................................................................................................ 79

8.1 Timers ...................................................................................................................................................................... 79
8.1.1 Timer TON – Generate ON-delay ........................................................................................................................ 81
8.1.2 Timer TOF – Generate OFF-delay ....................................................................................................................... 83
8.1.3 Timer TP – Generate pulse ................................................................................................................................. 85
8.2 Counters ................................................................................................................................................................... 86
8.2.1 Count up counter ................................................................................................................................................ 87
8.2.2 Count down counter ........................................................................................................................................... 88
8.2.3 Count up and down counter ............................................................................................................................... 89
8.3 Clock and system memories ................................................................................................................................... 91
8.4 Rising and Falling edges .......................................................................................................................................... 93

9 ANALOGUE SIGNALS ............................................................................................................................................. 96

9.1 Measuring transducers ............................................................................................................................................ 96
9.2 Analogue modules – A/D converter ....................................................................................................................... 97
9.2.1 Current based ...................................................................................................................................................... 98
9.2.2 Voltage based ..................................................................................................................................................... 98
9.2.3 Comparison ......................................................................................................................................................... 99
9.3 Configuring analogue modules in the PLC ...........................................................................................................100
9.4 Scaling with NORM_X and SCALE_X .....................................................................................................................102

10 DATA TYPES ...................................................................................................................................................... 104

10.1 Introduction ............................................................................................................................................................104
10.2 Bool, Byte, Word and DWord data types................................................................................................................107
10.3 Integer data types ..................................................................................................................................................108
10.4 Floating-point real data types ................................................................................................................................108
10.5 Time and Date data types......................................................................................................................................109
10.6 Character and String data types ............................................................................................................................110
10.7 String and WString .................................................................................................................................................110
10.8 Array data type .......................................................................................................................................................113
10.8.1 Array Addressing..........................................................................................................................................113
10.9 Data structure data type ........................................................................................................................................115
10.10 PLC data type .........................................................................................................................................................116
10.10.1 Creating User Defined Types (UDT).............................................................................................................117

- ii - Version 1.0
Table of Contents

10.10.2 Testing the UDT............................................................................................................................................118

10.11 Variant pointer data type .......................................................................................................................................124
10.12 Accessing a "slice" of a tagged data type .............................................................................................................125
10.13 Converting ..............................................................................................................................................................126
10.13.1 Implicit conversion.......................................................................................................................................126
10.13.2 Explicit conversions .....................................................................................................................................127

11 INTRODUCTION TIA PORTAL................................................................................................................................ 129

11.1 Project View ...........................................................................................................................................................129
11.2 Menu Bar and Toolbar ...........................................................................................................................................131
11.3 Project Tree ............................................................................................................................................................132
11.4 Overview Window...................................................................................................................................................134
11.5 Inspector Window ..................................................................................................................................................135
11.6 Window Arrangement ............................................................................................................................................136
11.6.1 Window Arrangement Options .....................................................................................................................136
11.6.2 Menu – View ................................................................................................................................................137
11.6.3 Window Sections in the Working Area ........................................................................................................138
11.6.4 Windows Layouts Save/Manage/Use .........................................................................................................140
11.7 Grouping of devices in the project navigation ......................................................................................................141
11.8 Task Cards .............................................................................................................................................................142
11.9 Reference Data.......................................................................................................................................................144
11.9.1 Cross-references of PLC Tags .....................................................................................................................144
11.9.2 Overlapping Accesses .................................................................................................................................145
11.9.3 Cross-reference of a Variable (Tag) in the Block Editor .............................................................................146
11.9.4 Go To… ..........................................................................................................................................................147
11.9.5 Assignment of I, Q, M, T, C ...........................................................................................................................148
11.9.6 Call Structure................................................................................................................................................149
11.9.7 Dependency Structure .................................................................................................................................150
11.10 Saving a Project .....................................................................................................................................................151
11.11 Help Functions .......................................................................................................................................................152
11.11.1 Archiving / Retrieving projects ....................................................................................................................153
11.11.2 Archiving.......................................................................................................................................................153
11.11.3 Retrieving......................................................................................................................................................154
11.11.4 Undo and Redo .............................................................................................................................................155
11.11.5 Keyboard Shortcuts in the Engineering .......................................................................................................156
11.11.6 Global Search / Find and Replace in the Editor ..........................................................................................157
11.11.7 Detailed Information in the Overview of Addresses ...................................................................................158
11.11.8 Tag Table ......................................................................................................................................................159

12 ONLINE & DIAGNOSTICS ..................................................................................................................................... 162

12.1 Status LEDs ............................................................................................................................................................163
12.2 Going online and connecting to a CPU .................................................................................................................165
12.2.1 Local settings ...............................................................................................................................................166
12.3 Comparing offline and online CPUs ......................................................................................................................167
12.4 Monitoring and modifying values in the CPU .......................................................................................................168
12.4.1 Monitoring Tags ...........................................................................................................................................169
12.4.2 Monitoring a Block .......................................................................................................................................170
12.5 Watch tables ..........................................................................................................................................................172
12.5.1 Monitor / Modify Variables (Tags) ..............................................................................................................174
12.6 Snapshots ..............................................................................................................................................................176
12.6.1 Capturing a snapshot ..................................................................................................................................176
12.6.2 Copying the snapshot values to the CPU .....................................................................................................176
12.6.3 Copying the snapshot values to the start values.........................................................................................176
12.6.4 Copying individual snapshots or monitor values to start values ................................................................176
12.7 Enabling outputs in STOP mode ...........................................................................................................................177
12.8 Forcing values in the CPU ......................................................................................................................................178

- iii - Version 1.0

Table of Contents

12.8.1 Using the force table ....................................................................................................................................178

12.8.2 Operation of the Force function ..................................................................................................................179
12.9 Hardware diagnostics ............................................................................................................................................180
12.9.1 Diagnosing Hardware ..................................................................................................................................180
12.9.2 General .........................................................................................................................................................181
12.9.3 CPU Diagnostics Buffer ...............................................................................................................................182

13 HUMAN MACHINE INTERFACE (HMI) ................................................................................................................... 184

13.1 Introduction ............................................................................................................................................................184
13.1.1 Data exchange .............................................................................................................................................184
13.2 WinCC – Basic configuration interface .................................................................................................................185
13.3 Adding an HMI device to the project .....................................................................................................................186
13.3.1 Configuring the IP Address of a Touch panel .............................................................................................187
13.3.2 Configuring an HMI Connection ..................................................................................................................189
13.4 Downloading an HMI project into the touch panel ...............................................................................................190
13.5 Create an HMI screen ............................................................................................................................................193
13.6 Adding elements ....................................................................................................................................................193
13.6.1 Buttons .........................................................................................................................................................193
13.6.2 I/O Fields ......................................................................................................................................................194
13.6.3 Basic Objects ...............................................................................................................................................195

14 PLCSIM............................................................................................................................................................ 196
14.1 Introduction to PLCSim..........................................................................................................................................196
14.2 S7-PLCSIM concepts .............................................................................................................................................197
14.2.1 Two views: Compact view and Project view ...............................................................................................197
14.2.2 Differences between a simulated PLC and a physical PLC........................................................................198
14.3 Working in Compact View .....................................................................................................................................199
14.3.1 Description of the Compact View user interface .......................................................................................200
14.4 Working in the Project view ...................................................................................................................................201
14.4.1 Project view user interface ..........................................................................................................................201
14.4.2 Project view user interface overview ..........................................................................................................201
14.4.3 The S7-PLCSIM menu bar............................................................................................................................202
14.4.4 S7-PLCSIM toolbar .......................................................................................................................................205
14.4.5 The Operator panel ......................................................................................................................................206
14.4.6 Project Tree description...............................................................................................................................206
14.5 S7-PLCSIM settings ...............................................................................................................................................208
14.5.1 Application settings .....................................................................................................................................208
14.6 Working with SIM tables ........................................................................................................................................209
14.6.1 SIM tables and the SIM table editor ............................................................................................................209
14.6.2 SIM table editor description ........................................................................................................................209
14.6.3 Creating and populating a SIM table ...........................................................................................................212
14.6.4 Working with values in the Control view .....................................................................................................216
14.7 Working in the Sequence Editor ............................................................................................................................219
14.7.1 Sequences and the Sequence Editor ..........................................................................................................219
14.7.2 Undo and Redo in the Sequence Editor.......................................................................................................223
14.7.3 Creating and populating a sequence ..........................................................................................................223
14.7.4 Methods for starting a sequence ................................................................................................................228
14.7.5 Sequence actions and action parameters ..................................................................................................231
14.7.6 Time-related Sequence information ...........................................................................................................231
14.7.7 Inserting, adding, and deleting sequence steps .........................................................................................235
Enable and disable sequence steps................................................................................................................................236
14.7.8 Step time adjustment ..................................................................................................................................236
14.7.9 Sequence error conditions ..........................................................................................................................237

15 INSTALLING TIA PORTAL V17 ............................................................................................................................. 238

15.1 Installing TIA Portal ...............................................................................................................................................239

- iv - Version 1.0
Table of Contents

15.1.1 Install PLCSim V17 ......................................................................................................................................240

15.1.2 Install TIA Portal Update 4...........................................................................................................................240
15.1.3 Install PLCSim Update 1 ..............................................................................................................................240
15.1.4 Install Startdrive V17 ...................................................................................................................................240
15.2 Installing Licenses .................................................................................................................................................241
15.3 TIA Portal settings .................................................................................................................................................243
15.3.1 Import tps-File ..............................................................................................................................................243

16 NAMING CONVENTION........................................................................................................................................ 245

16.1 Explanation.............................................................................................................................................................245
16.2 Inputs ......................................................................................................................................................................246
16.3 Outputs ...................................................................................................................................................................247
16.4 HMI tags .................................................................................................................................................................248
16.5 Data Block names ..................................................................................................................................................248
16.6 ISA-88 naming conventions ..................................................................................................................................250
16.6.1 Control Modules (CM) .................................................................................................................................250
16.6.2 Equipment Modules (EM) ............................................................................................................................250
16.6.3 Units (UN) .....................................................................................................................................................250
16.6.4 Process Cells (PC) .......................................................................................................................................251

17 INDEX ............................................................................................................................................................... 252

-v- Version 1.0

Preface

1 Preface
The reader contains parts from the Siemens manuals listed below. These manuals can be downloaded from the
Siemens website (manual titles are clickable) and contain more information on programming the S7-1200 and
S7-1500 PLCs and the HMI.

- Siemens S7-1200 Programmable Controller – System Manual

- Siemens S7-1200 Getting started with S7-1200
- Siemens Programming Guideline for S7-1200/S7-1500
- Siemens Programming Style Guide for S7-1200/S7-1500
- Siemens S7-1200 Easy Book
- Siemens S7-PLCSIM manual V17

If you find any inconsistencies or unclear items in this reader, please mention it to us, and we will update the
reader.

Also, if you think something can be changed to improve the quality of the reader, please do. Our goal is to create
a reader that you will continue to use during your professional life as a PLC programmer.

The reader uses UK English. Sometimes, words, such as optimized vs. optimized, appear differently from those
used in the TIA Portal.

-1- Version 1.0

What is a PLC?

2 What is a PLC?

2.1 Introduction
A Programmable Logic Controller (PLC) is a specialised computer system widely used in Industrial Control
Systems (ICS). PLCs are designed to handle a wide range of inputs and outputs, including digital and analogue
signals, and also communicate with other devices. Unlike systems like Arduinos and office computers, PLCs
are built to withstand harsh industrial environments, including extreme temperatures, humidity and electrical
noise.

While the specific applications vary widely, all PLCs monitor inputs and other variable values, make decisions
based on a stored program, and control outputs to automate a machine or process.

There are many types of PLCs, and they vary significantly in appearance and capabilities. Figure 2.1 shows some
common used PLCs from different manufacturers.

Figure 2.1 – Common used PLCs in Europe

Using the same PLC configuration used for a chemical plant in a small conveyor system would make no sense.
Therefore, scalability is an important feature. Within the Siemens PLC family, there are two main product lines:
The S7-1200 series and the S7-1500 series (the older S7-300 series is being replaced by the S7-1200 and S7-
1500 series, where the S7-1500 series PLC will replace the S7-400 series).

Both PLC series are modular. The S7-1200 series is used in small—to medium-sized applications, while the S7-
1500 is used in medium- to large applications.

-2- Version 1.0

What is a PLC?
Introduction

Figure 2.2 – Small/medium sized machine

Figure 2.3 – Large production line

-3- Version 1.0

What is a PLC?
Introduction

Besides the common applications shown Figure 2.2 and Figure 2.3, PLCs are used in a variety of other kind of
installations. Examples include:
• Panama canal
• Fairground rides
• Power plants
• Water treatment plants
• Building automation

Figure 2.4 – Also PLC controlled machines

-4- Version 1.0

What is a PLC?
Modularity

2.2 Modularity
The primary function of a PLC is to monitor inputs and make decisions based on the programmed logic to
control the output devices. This involves monitoring sensors and other input devices to determine the system’s
current state, processing this information using the programmed logic, and then sending commands to output
devices such as motors, valves, and other equipment to control the system’s operation.

Figure 2.5 – Schematic representation of a water treatment plant

PLCs offer several advantages over traditional hardwired control systems. They are more flexible and can be
easily reprogrammed or reconfigured to adapt to system changes. They are also more reliable, designed to
operate in harsh industrial environments and can withstand vibration, shock, and extreme temperatures.

2.2.1 Fieldbus
Ethernet-based field buses further improve the flexibility of a PLC system. A field bus is a communication
network used to connect field devices such as sensors, actuators, and other equipment to a PLC or other control
device. The field bus provides a means for devices in the system to communicate with each other and exchange
data cyclically. Field buses come in various types and use protocols designed for specific applications and
requirements. A significant advantage of these field buses is that the protocol is standardised, has an open
specification, and is designed to be interoperable between different manufacturers. Manufacturers of industrial
devices can offer these field bus communication interfaces to their products to improve connectivity.

-5- Version 1.0

What is a PLC?
How does a PLC work?

2.3 How does a PLC work?

The central processing unit (CPU) is a microprocessor-based system that contains the system memory and is
the PLC’s decision making unit.
The CPU monitors the inputs, outputs, and other variables and makes decisions based on instructions stored in
its user program memory.
Some CPUs have input and output points in the same enclosure with the CPU. For example, the S7-1215, shown
in Figure 2.6 has 14 digital inputs, 10 digital outputs, 2 analogue inputs and 2 analogue outputs.

Figure 2.6 – S7-1215 CPU

2.3.1 Scan cycle

The CPU executes the PLC user program as part of a repetitive process referred to as a scan. After startup, a
typical CPU scan includes the following steps:

• The CPU reads the statuses of the inputs

• The CPU executes the user program
• The CPU performs internal diagnostic and communication tasks
• The CPU updates the statuses of the outputs.

This process is repeated continuously as long as the PLC is in the run mode, as shown in Figure 2.7.

The time required for a scan depends on the CPU's capabilities, the size of the user program, the number of
inputs and outputs, and the amount of communication required. However, because PLC CPUs are very fast, this
time is typically measured in milliseconds. This means that the response time for a PLC is also very fast.

-6- Version 1.0

What is a PLC?
How does a PLC work?

STARTUP RUN
A Copies the state of the physical inputs to I ① Writes Q memory to the physical outputs
memory
B Initialises the Q output (image) memory area ② Copies the state of the physical inputs to I
with either zero, the last value, or the memory
configured substitute value. Ze‐ roes PB, PN,
and AS-i outputs
C Initialises non-retentive M memory and data ③ Executes the program cycle Obs
blocks to their initial value and enables
configured cyclic interrupt and time-of-day
events. Executes the startup OBs.
D Stores any interrupt events into the queue to ④ Performs self-test diagnostics
be processed after entering RUN mode
E Enables the writing of Q memory to the physical ⑤ Processes interrupt and communications during
outputs any part of the scan cycle

Figure 2.7 – Schematic representation running of a PLC (from: S7-1200 Programmable controller)

2.3.2 Operating modes of the CPU

The CPU has three modes of operation: STOP mode, STARTUP mode, and RUN mode. Status LEDs on the front
of the CPU indicate the current mode of operation.

• In STOP mode, the CPU is not executing the program, and you can download a project. The RUN/STOP
LED is solid yellow.
• In STARTUP mode, the CPU executes any startup logic (if present). The CPU does not process interrupt
events during the startup mode. The RUN/STOP LED alternates flashing between green and yellow.
• In RUN mode, the scan cycle executes repeatedly. Interrupt events can occur, and the CPU can process
them at any point during the program cycle phase. You can download some parts of a project in RUN
mode. The RUN/STOP LED is solid green.

-7- Version 1.0

What is a PLC?
How does a PLC work?

2.3.3 Execution of the user program

The CPU supports the following types of code blocks that allow you to create an efficient structure for your user
program:

• Organization blocks (OBs) define the structure of the program. Some OBs have predefined behaviour
and start events, but you can also create OBs with custom start events.
• Functions (FCs, see Section 7.4 on page 65) and function blocks (FBs, see Section 7.5 on page 70)
contain the program code corresponding to specific tasks or combinations of parameters. Each FC or
FB provides a set of input and output parameters for sharing data with the calling block. An FB also
uses an associated data block (called an instance DB) to maintain the state of values between
execution that other blocks can use in the program.
• Data blocks (DBs, see Section 7.6 on page 72) store data that can be used by the program blocks.

Execution of the user program begins with one or more optional startup organisation blocks (OBs, see Section
7.3 on page 59) that execute once upon entering RUN mode, followed by one or more program cycle OBs that
execute cyclically. You can also associate an OB with an interrupt event, either a standard event or an error
event. These OBs execute whenever the corresponding standard or error event occurs.

Startup
When starting a PLC/CPU the PLC will:
• use the Start-Up OB (when present in the CPU).
• Reading and verifying the I/O configuration with the actual detected configuration
• The cycle time monitoring is temporarily deactivated.
• A time or alarm-controlled program … is not possible.
• The local I/O is accessible with peripheral instructions.

Before the CPU starts with the user program, the start-up program is executed (if present). This start-up program
is programmed is a specific Organizational Block (OB), called ‘Start Up’. Within this OB specific settings can be
given for the cyclic program.

Scan Cycle
For each scan cycle, the CPU writes the outputs, reads the inputs, executes the user program, updates
communication modules, and responds to user interrupt events and communication requests. Communication
requests are handled periodically throughout the scan, as shown in Figure 2.7.

These actions (except for user interrupt events) are serviced regularly and in sequential order. Enabled user
interrupt events are serviced according to priority in the order in which they occur. For interrupt events, the CPU
reads the inputs, executes the OB, and then writes the outputs using the associated process image partition
(PIP), if applicable.

The system guarantees that the scan cycle will be completed in the maximum cycle time; otherwise, a time error
event is generated.

• Each scan cycle begins by retrieving the current values of the digital and analogue outputs from the
process image and then writing them to the physical outputs of the CPU, SB, and SM modules
configured for automatic I/O update (default configuration). When a physical output is accessed by an
instruction, both the output process image and the physical output itself are updated.

-8- Version 1.0

What is a PLC?
How does a PLC work?

• The scan cycle continues by reading the current values of the digital and analogue inputs from the CPU,
SB, and SMs configured for automatic I/O update (default configuration) and then writing these values
to the process image. When a physical input is accessed by an instruction, the value of the physical
input is accessed by the instruction, but the input process image is not updated.
• After reading the inputs, the user program is executed from the first instruction through the end
instruction. This includes all the program cycle OBs and their associated FCs and FBs. The program
cycle OBs are executed in order according to the OB number, with the lowest OB number executing first.
Communication processing occurs periodically throughout the scan, possibly interrupting user program
execution.

Self-diagnostic checks include periodic checks of the system and the I/O module status checks. Interrupts can
occur during any part of the scan cycle and are event-driven. When an event occurs, the CPU interrupts the scan
cycle and calls the OB configured to process that event. After the OB finishes processing the event, the CPU
resumes execution of the user program at the point of interruption.

Program cycle OB
Program cycle OBs execute cyclically while the CPU is in RUN mode. The main block of the program is a program
cycle OB. This is where you place the instructions that control your program and where you call additional user
blocks. You can have multiple program cycle OBs, which the CPU executes in numerical order. Main (OB 1) is
the default.

Section 7.3, starting at page 59, explains OBs in more detail.

-9- Version 1.0

What is a PLC?
Extensibility

2.4 Extensibility
PLC can be extended with more inputs, outputs (I/O), or other functionalities. These additions can be directly
mounted to the PLC, as shown in Figure 2.8. The I/O modules, called Signal Modules (SM), are added on the
right side of the CPU. The communication modules (CM) are added on the left side of the CPU.

Figure 2.8 – S7-1200 CPU with expansion modules

2.4.1 Signal modules

Digital input devices provide an on or off signal to a PLC, and digital output devices turn on or off in response to
a PLC signal.

Analogue input devices provide a variable current or voltage, such as 4 to 20 milliamps or 0 to 10 volts,
representing a condition in a machine or process, and analogue output devices require a similarly variable signal
from the PLC. In addition, analogue input devices such as thermocouples and resistance temperature detectors
(RTDs) provide variable signals that require special processing.

A digital I/O device connects to an S7-1200 PLC through a digital I/O channel on a CPU, digital signal board, or
digital signal module. Similarly, an analog I/O device connects to an S7-1200 PLC through an analog I/O channel
on a CPU, analog signal board, or analog signal module. A signal board can be added to the CPU to increase the
CPUs I/O channels without increasing the size of the CPU.

- 10 - Version 1.0
What is a PLC?
Extensibility

2.4.2 Communication
PLCs use a variety of communication technologies. The most basic type of communication used is serial
communication, where bits are sent and received one at a time. Serial communication is still used with some
devices; however, more often, PLCs use network communication.

For example, Industrial Ethernet is a high-performance network that uses industrial-grade switching technology.
An Industrial Ethernet switch is an active network component that allows multiple devices to communicate
simultaneously at high speeds.

Figure 2.9 – CPU with communication modules

PROFINET is an open Industrial Ethernet standard and the leading Industrial Ethernet standard worldwide.
PROFINET IO, the most widely used form of PROFINET, handles both non-time-critical IT communications and
the full range of real-time control communications.

Another network type used is PROFIBUS, an open fieldbus standard. A fieldbus is a multi-drop network that
provides a standardised approach for communication with devices commonly used for factory automation or
process control. The version of PROFIBUS most widely used in factory automation applications is PROFIBUS
DP.

All S7-1200 and S7-1500 CPUs have at least 1 PROFINET port.

With Siemens, the most used fieldbus is ProfiNET. Other used field busses are:
• ProfiBUS
• Modbus
• EtherCAT
• Interbus
• DeviceNET

- 11 - Version 1.0
Programming languages

3 Programming languages
PLC can be programmed in several languages. According to the IEC61131-3, there are 5 official languages:

• Ladder Diagram (LAD)

• Function Block Diagram (FBD)
• Sequential Function Chart (SFC)
• Structure Text (ST) or Structured Control Language (SCL)
• Instruction List (IL) or STatement List (STL)
The language SFC is not available for the S7-1200 PLCs, only for the S7-1500 series PLC1. The language
Instruction List (IL) is depreciated by Siemens for the S7-1200 and S7-1500 series PLC. It is often used in the
predecessor PLCs, S7-300 and S7-400 Series.

The programming languages mentioned below are widely used in industrial automation (not only in Siemens
PLCs).

It is a matter of preference or the engineering department's definition of what language you will use to program
a specific functionality. But generally:

- FBD stands for Function Block Diagram and is very similar to digital electronics. Therefore, it will have
a good “look and feel” for engineers with an electronic background.
- LAD is LADder programming, which is similar to electric wiring diagrams. Therefore, LAD will probably
be used a lot in an environment where engineers with an Electrical background have to use the software
for status viewing.
- SFC is Sequential Flow Chart programming, a language (only S7-1500 CPUs) used a lot when
sequencers are needed in a PLC program. It gives a good overview of what part of your program the
code is executed and under what conditions the software is awaiting action.
- SCL is Structured Control Language. It is very similar to other Structured Text languages and is often
preferred by engineers with an ICT background.
- IL is an Instruction list and is a language used a lot in the early days of PLCs (like in 1990 in the Siemens
S5-115U CPU). Sometimes this language is used in code generation by companies equipped with large
libraries of similar controls needed for different configurations. For new applications, this language is
not advised. Most engineers don’t like to use it because the overview is not so good, so debugging and
status viewing are very complicated.
The majority of library functions are possible to use in most languages. A more detailed description of the
languages you will find below.

Write here some global stuff on FBD, SFC and ST/SCL and maybe on IL (so the footnote can disappear). Then
the logic sequence in this chapter is correct. See remark on the title.

1
The predecessors of the S7-1200 and S7-1500 also have the possibility for SFC. These old PLC … blablabal

- 12 - Version 1.0
Programming languages
Ladder Diagram (LAD)

3.1 Ladder Diagram (LAD)

Ladder Diagram (LD) is one of the most widely used programming languages for PLCs. Ladder Diagram derives
its name from its visual resemblance to a ladder, where the horizontal rungs represent control logic and the
vertical rails represent the power flow from left to right. Each rung contains combinations of inputs and outputs
that mimic the behaviour of electrical relay logic, making it highly intuitive for electrical engineers and
technicians.

The primary advantage of Ladder Diagram is its simplicity and ease of use. It was originally developed to
simplify the transition from traditional relay control systems to digital control systems, allowing engineers
familiar with relay logic to quickly adapt to PLC programming. Each rung of the ladder represents a distinct piece
of logic, typically beginning with input conditions and ending with an output action, which makes it
straightforward to read, understand, and troubleshoot. This visual format is particularly effective for
documenting control systems and training personnel, as it provides a clear and concise representation of the
control logic.

Figure 3.1 – a small piece of a Ladder program

Ladder uses mostly bit logic instructions. These bit logic instructions interpret states of 0 and 1 and combine
them according Boolean Logic. These logic calculations produce a result of 0 or 1 which is called the Result of
Logic Operation (RLO).

The most used bit instructions are shown in Table 3.1 and Table 3.2.

To create the logic for complex operations, you can insert branches to create the logic for parallel circuits.
Parallel branches are opened downwards or are connected directly to the power rail. You terminate the branches
upwards.

LAD provides "box" instructions for various functions, such as math, timer, counter, and move. STEP 7 does not
limit the number of instructions (rows and columns) in a LAD network.

Every LAD network must terminate with a coil or a box instruction.

- 13 - Version 1.0
Programming languages
Ladder Diagram (LAD)

LAD SYMBOL DESCRIPTION

Normally Open Contact
The activation of the normally open contact depends on the signal state of the associated
operand. When the operand has signal state "1", the normally open contact closes and the signal
state at the output is set to the signal state of the input.

When the operand has signal state "0", the normally open contact is not activated and the signal
state at the output of the instruction is reset to "0".
Two or more normally open contacts are linked bit-by-bit by AND when connected in series.
With a series connection, power flows when all contacts are closed.
The normally open contacts are linked by OR when connected in parallel. With a parallel
connection, power flows when one of the contacts is closed.
Normally Closed Contact
The activation of the normally closed contact depends on the signal state of the associated
operand. When the operand has signal state "1", the normally closed contact opens and the
signal state at the output of the instruction is reset to "0".

When the operand has signal state "0", the normally closed contact is not enabled and the signal
state of the input is transferred to the output.
Two or more normally closed contacts are linked bit-by-bit by AND when connected in series.
With a series connection, power flows when all contacts are closed.
The normally closed contacts are linked by OR when connected in parallel. With a parallel
connection, power flows when one of the contacts is closed.
Inverter
You use the "Invert RLO" instruction to invert the signal state of the result of logic operation
(RLO). If the signal state is "1" at the input of the instruction, the output of the instruction has
signal state "0". If the signal state is "0" at the input of the instruction, the output has the signal
state "1".
Output coil
You can use the "Assignment" instruction to set the bit of a specified operand. If the result of
logic operation (RLO) at the input of the coil has signal state "1", the specified operand is set to
signal state "1". If the signal state is "0" at the input of the coil, the bit of the specified operand
is reset to "0".

The instruction does not influence the RLO. The RLO at the input of the coil is sent directly to
the output.
Inverted output coil
The "Negate assignment" instruction inverts the result of logic operation (RLO) and assigns it to
the specified operand. When the RLO at the input of the coil is "1", the operand is reset. When
the RLO at the input of the coil is "0", the operand is set to signal state "1".
Table 3.1 - Ladder instructions (Taken from S7-1200 Programmable controller System Manual)

- 14 - Version 1.0
Programming languages
Ladder Diagram (LAD)

LAD SYMBOL DESCRIPTION

Set Coil
You can use the "Set output" instruction to set the signal state of a specified operand to "1".
The instruction is only executed if the result of logic operation (RLO) at the input of the coil is
"1". If power flows to the coil (RLO = "1"), the specified operand is set to "1". If the RLO at the
input of the coil is "0" (no signal flow to the coil), the signal state of the specified operand remains
unchanged.

Reset Coil
You can use the "Reset output" instruction to reset the signal state of a specified operand to "0".
The instruction is only executed if the result of logic operation (RLO) at the input of the coil is
"1". If power flows to the coil (RLO = "1"), the specified operand is reset to "0". If the RLO at the
input of the coil is "0" (no signal flow to the coil), the signal state of the specified operand remains
unchanged.
Positive edge detection
You can use the "Scan operand for positive signal edge" instruction to determine if there is a "0"
to "1" change in the signal state of a specified operand (<Operand1>). The instruction compares
the current signal state of <Operand1> with the signal state of the previous scan, which is saved
in an edge memory bit (<Operand2>). If the instruction detects a change in the result of logic
operation (RLO) from "0" to "1", there is a positive, rising edge.

The positive signal edge is queried each time the instruction executes. When a positive signal
edge is detected, <Operand1> is set to signal state "1" for one program cycle. In all other cases,
the operand has the signal state "0".

Specify the operand to be queried (<Operand1>) in the operand placeholder above the
instruction. Specify the edge memory bit (<Operand2>) in the operand placeholder below the
instruction

See also Section 8.4 Rising and Falling edges on page 93.
Negative edge detection
You can use the "Scan operand for negative signal edge" instruction to determine if there is a
"1" to "0" change in the signal state of a specified operand (<Operand1>). The instruction
compares the current signal state of <Operand1> with the signal state of the previous scan that
is saved in an edge memory bit <Operand2>. If the instruction detects a change in the result of
logic operation (RLO) from "1" to "0", there is a negative, falling edge.

The negative signal edge is queried each time the instruction executes. When a negative signal
edge is detected, <Operand1> is set to signal state "1" for one program cycle. In all other cases,
the operand has the signal state "0".

Specify the operand to be queried (<Operand1>) in the operand placeholder above the
instruction. Specify the edge memory bit (<Operand2>) in the operand placeholder below the
instruction.

See also Section 8.4 Rising and Falling edges on page 93.
Table 3.2 - Ladder instructions (Taken from S7-1200 Programmable controller System Manual)

- 15 - Version 1.0
Programming languages
Function Block Diagram (FBD)

3.2 Function Block Diagram (FBD)

Like LAD, Function Block Diagram (FBD) is a graphical programming language. FBD represents control logic
through interconnected blocks, each of which performs a specific function. These blocks can be standard
functions like logical operations (AND, OR, NOT), arithmetic operations (ADD, SUBTRACT), or more complex
user-defined functions.

One of the main advantages of FBD is its intuitive and visual approach to programming. Engineers can create
control logic by simply connecting functional blocks with lines that represent the flow of signals or data. This
visual representation makes it easier to understand and design the control process, especially for those who
may not be familiar with textual programming languages. FBD is particularly effective for representing
processes that can be broken down into discrete, interlinked functions, making it widely used in process control
and automation industries.

FBD excels in scenarios where the control logic can be naturally visualized as a series of operations and data
flows.

Figure 3.2 – Simple FBD network

- 16 - Version 1.0
Programming languages
Structured Control Language (SCL)

3.3 Structured Control Language (SCL)

SCL, or Structured Control Language, is a high-level, PASCAL-based programming language. Compared to
traditional LAD or FBD, SCL is particularly designed to offer a more user-friendly and structured approach to
programming PLCs.

One of SCL's primary advantages is its ability to handle complex algorithms and data processing tasks more
efficiently than graphical languages. It supports structured programming concepts such as loops, conditional
statements, and user-defined functions, which enable developers to create more modular, readable, and
maintainable code. This particularly benefits large-scale automation projects where code clarity and reusability
are crucial. Additionally, SCL allows for better handling of numerical computations and data manipulations,
which are often required in sophisticated industrial control processes.

For instance, we can use an SUB block to subtract two variables from each other in the Ladder Diagram. But in
the SCL, that subtraction can be represented using an equation that appears to be more typical.

Figure 3.3 – Comparision LAD vs SCL

Figure 3.4 – a small piece of an SCL program

It is possible to add a SCL network in block programmed in another language, e.g. LAD, see Figure 3.5.

- 17 - Version 1.0
Programming languages
Structured Control Language (SCL)

Figure 3.5 – Embedding SCL in a block programmed in LAD

Each SCL instruction ends with a semi-column ;

3.3.1 Program Control in SCL

A control statement is a specialised type of SCL expression, that performs tasks mentioned in Table 3.3. A
single statement typically occupies one line of code. You can enter multiple statements on one line, or you can
break a statement into several lines of code to make the code easier to read. Separators (such as tabs, line
breaks and extra spaces) are ignored during the syntax check. An END statement terminates the control
statement.

SCL looks a lot like C, C++ or PASCAL, but is just a little bit different in how functions
work.

KEYWORD FUNCTIONALITY
Program branching IF Program branching with BOOLean value
Case Program branching with INT value
Program loop For Program loop with control variable
(terminate While Program loop with execution condition
possible) Repeat Program loop with terminate condition
Loop terminations Continue Stop current loop iteration
Exit Exit program loop
Block termination Return Exit the block
Goto Jump to a specific label within the same block
Table 3.3 – Control structures

- 18 - Version 1.0
Programming languages
Structured Control Language (SCL)

IF – THEN – ELSE
The instruction "Run conditionally" branches the program flow depending on a condition. The condition is an
expression with a Boolean value (TRUE or FALSE). Logical expressions or comparative expressions can be
stated as conditions.

When the instruction is executed, the stated expressions are evaluated. If the value of an expression is TRUE,
the condition is fulfilled; if the value is FALSE, it is not fulfilled.

Figure 3.6 – The ‘If – Then – Else’ statement

CASE
The instruction CASE executes one of several instruction sequences depending on the value of an expression.

The value of the expression must be an integer or a bit string. When the CASE instruction is executed, the value
of the expression (tag) is compared with the values of several constants. If the value of the expression (tag)
agrees with the value of a constant, the condition is fulfilled, and the instructions that are programmed directly
after this constant are executed. The constants can assume various values.

- 19 - Version 1.0
Programming languages
Structured Control Language (SCL)

Figure 3.7 – The ‘Case – Of’ statement

- 20 - Version 1.0
Programming languages
Structured Control Language (SCL)

3.3.2 Loops in SCL

Within SCL it is possible to have loops, as shown in Table 3.3. In the following section the three kinds of loops
are explained.

WHILE
The instruction ‘While’ can be read as Run if the condition is met. It causes a program loop to be repeatedly
executed until the implementation condition is satisfied. The condition is an expression with a Boolean value
(TRUE or FALSE). Logical expressions or comparative expressions can be stated as conditions.

When the instruction is executed, the stated expressions are evaluated. If the value of an expression is TRUE,
the condition is fulfilled; if the value is FALSE, it is not fulfilled.

Program loops can also be nested. Within a program loop, you can program additional program loops with other
loop variables.

Figure 3.8 – The ‘While’ loop

The instructions are only executed if the termination condition is fulfilled.

- 21 - Version 1.0
Programming languages
Structured Control Language (SCL)

REPEAT
The instruction ‘Repeat … Until’ can be read as: Run if condition is not met. It causes a program loop to be
repeatedly executed until a termination condition is met. The condition is an expression with Boolean value
(TRUE or FALSE). Logical expression or comparative expressions can be stated as conditions.

When the instruction is executed, the stated expressions are evaluated. If the value of an expression is TRUE,
the condition is fulfilled; if the value is FALSE, it is not fulfilled.

The instructions are executed once, even if the termination condition is fulfilled.

Figure 3.9 – The ‘Repeat’ loop

- 22 - Version 1.0
Programming languages
Structured Control Language (SCL)

FOR loop
A FOR statement executes a sequence of statements in a loop whereby consecutive values are assigned to a
variable (control variable). The control variable must be declared as a local variable and be of the data type SINT
up to LINT.

The definition of a loop with FOR includes specifying an initial and final value. Both values must be of the same
type.

You can use one basic expression each to form the final value and the desired increment. You have to keep in
mind:

• You can omit the statement BY (increment). If no increment is specified, it is +1. The increment can be
a negative value, like -1. Then, the value is decreased for every execution of the loop.
• Initial value, final value and increment are expressions. The evaluation occurs once the FOR statement
is executed.
• It is not allowed to change the two values for the final value and increment during the loop's execution.

Figure 3.10 – The ‘For’ loop

- 23 - Version 1.0
Programming languages
Structured Control Language (SCL)

3.3.3 Control functions

Continue
The "Recheck loop condition" instruction ends the current program run of a FOR, WHILE or REPEAT loop.

After execution of the instruction, the conditions for the continuation of the program loop are evaluated again.
The instruction affects the program loop, which directly contains the instruction.

Exit
The instruction "Exit loop immediately" cancels the execution of a FOR, WHILE, or REPEAT loop at any point,
regardless of conditions. The program is continued after the end of the loop (END_FOR, END_WHILE,
END_REPEAT).

The instruction affects the program loop, which directly contains the instruction.

Return
The instruction "Exit block" exits the program execution in the currently edited block and continues in the calling
block.
The instruction can be omitted at the end of the block.

Goto
Use the instruction "Jump" to resume the execution of a program at a given point marked with a jump label.
The jump labels and the instruction "Jump" must be in the same block. The name of a jump label can only be
assigned once within a block. Each jump label can be the target of several jump instructions.
A jump from the "outside" into a program loop is not permitted, but a jump from a loop to the "outside" is
possible.

Adhere to the following grammatical rules for jump labels:

• Letters (a to z, A to Z)
• A combination of letters and numbers. Check that the order is correct, i.e. first the letters, then the
numbers (a - z, A - Z, 0 - 9).

Special characters or a combination of letters and numbers must not be used in reverse order, i.e. first the
numbers and then the letters (0-9, a - z, A - Z).

You can declare the instruction as follows:

GOTO <jump label>;

...

<Jump label>: <Instructions>

- 24 - Version 1.0
Programming languages
Structured Control Language (SCL)

3.3.4 Conversions in SCL

Within SCL, some conversions between data types are made automatically. Sometimes it results in an
unexpected data type. Table xx shows

DATATYPE 1 OPERATION DATATYPE 2 RESULTING DATATYPE

INT + DINT DINT
USINT + UDINT UDINT
SINT + USINT INT
INT + REAL REAL
REAL + LREAL LREAL
Table 3.4 - SCL Conversion Results

- 25 - Version 1.0
Programming languages
Structured Control Language (SCL)

3.3.5 Tips and Tricks for SCL

Commenting on your code is even more important when working with SCL. The following tips are from the
Siemens Programming Guideline for S7-1200/S7-1500.

Document your code

Using symbolic names and comments in your program can make the code easy to understand and readable for
your colleagues.

Use the comments in the programs to improve readability. Design the program code so that other people can
also understand it straight away.

In the programming language SCL, comments on instructions, blocks, and functions can be commented with //
in every row, as shown in Figure 3.11.

Use REGIONs
The SCL code can be divided into areas with the keyword REGION. These areas can be given a name and
collapsed and expanded.

Why use REGIONs?

• Better overview
• Easy navigation even in large blocks
• Ready code fragments can be collapsed
• REGIONs can be nested

Figure 3.11 – Piece of SCL code

- 26 - Version 1.0
The ISA-S88 model

4 The ISA-S88 model

In the industrial automation environment, there are 2 important guidelines: the ISA-95 model and the ISA-88
model. The ISA 95 model is used for MES (Manufacturing Executing System2) and ERP (Enterprise Resource
Planning3) systems and is outside the scope of the courses CSS and ICS).
The latter, the ISA-88 or S88 model, is used in both the CSS and the ICS course.

Figure 4.1 – ISA 88 and ISA 95 [Source]

Figure 4.1 shows how the ISA-88 and ISA-95 are related, where the ISA-88 standard covers the bottom 3 levels.
The ERP lives in Level 4, and the MES lives in Level 3. Level 2 contains the monitoring and supervision of the
process (SCADA4 and HMI5).
ISA-95 consists of models and terminology to describe the information exchange between systems focused on
sales, finance and logistics and systems for production, maintenance and quality. The ISA-88 standard consists
of models and terms that logically divide the production process and control the operation of the machinery.

2
MES is used in manufacturing equipment to track and document the transformation of raw materials into
finished goods. MES provides information that helps manufacturing decision-makers understand how current
conditions on the plant floor can be optimized to improve production output. MES works as a real-time
monitoring system to enable the control of multiple elements of the production process (e.g. inputs, personnel,
machines and support services). [Source: Wikipedia]
3
ERP is the integrated management of main business processes, often in real-time and mediated by software
and technology. ERP is usually referred to as a category of business management software – typically a suite
of integrated applications – that an organization can use to collect, store, manage and interpret data from many
business activities. [Source: Wikipedia]
4
SCADA is an abbreviation of Supervisory Control and Data Acquisition and is the top level in visualising the big
picture.
5
HMI is an abbreviation of Human Machine Interface and visualise on a low level the machine.

- 27 - Version 1.0
The ISA-S88 model
ISA-S88 Control levels

ISA-S88 can be applied in fully automated, semi-automated, and even in completely manual production
processes. Although ISA-S88 is not meant to be a “software design standard” but a physical model of a batch
control system, the ISA-S88 model is very useful for creating structured software within the “definitions” of this
model.
Building a structured control system means a physical component (called a Control Module) is directly
connected to a “piece of software” that controls that physical component.

Explainer

James Sexton, who designed batch systems according to ISA88 long before the
standard was defined, explains:
ISA-88 Batch Control Design - YouTube

4.1 ISA-S88 Control levels

Batch Control
In a batch process, a quantity of a product is made, for example, soup, 2000 L. You can measure the amount of
the gene that you have produced. Examples: making soup, beer, paracetamol, and concrete.

The hardware can be used for multiple operations.

Continuous Control
A continuous process always produces a product, and it is not interrupted. Examples include power plants,
water treatment plants, and chemical plants.

The hardware is designed for a specific task. Little possibilities for adjusting the process. You can output only
measure in the flow (how much of something is provided)

Discrete Control
Products are built in numbers. Example: 1000 LED TVs.

Each product has its own identity. During the process, it remains the same.

- 28 - Version 1.0
The ISA-S88 model
Introduction ISA-S88

4.2 Introduction ISA-S88

The ISA-S88 standard is an international standard (published by the International Society of Automation, short
ISA) that describes the models and terminology for batch control. It was published in an attempt to standardise
the process of making batches of a product. The goal was to make it easier for automation suppliers to
integrate, communicate, and configure batches.

The ISA-S88 contains three models: physical, process, and procedural. The physical model handles the
equipment (hardware) used during operation (e.g., heaters, valves, LEDs). The process model handles the
chemical and physical changes during production, such as adding water, mixing ingredients, and heating or
cooling the product. The procedural model describes the product's recipe structure. It is the link between the
process and physical models (e.g., making recipe X using equipment Y).

4.2.1 Physical Model

As shown in Figure 4.2, the physical model consists of 7 levels. 4 of these levels are mandatory, and they must
be present: Process Cell, Unit, Equipment Module and the Control Module.

The Enterprise, Site and Area levels are optional.

Enterprise
An enterprise is a collection of one or more sites. It can contain all other components of the physical model. An
enterprise is responsible for determining which products are produced, where, and how they are produced.

At the very top of the model is the enterprise level, which may contain one or more lower levels. Here, we usually
discuss a company or a department that decides which products will be manufactured. It may contain all of the
underlying levels.

Site
A site is a collection of one or more areas. It is a physical, geographical or logical grouping determined by the
enterprise:

A site is responsible for any local adjustments to products that are produced there.

The method of production can show small differences between sites. A logical, physical or geographical group
determined by the enterprise. The boundaries of a site are decided by business criteria.

Area
An area is a collection of one or more process cells. It is a physical, geographical or logical grouping determined
by a site. A logical, physical or geographical group determined by the site. Just like the site level, the boundaries
of the area level are decided by organizational or business criteria.

- 29 - Version 1.0
The ISA-S88 model
Introduction ISA-S88

Figure 4.2 - ISA-S88 Physical Model

Process Cell
A Process Cell (PC) contains all Units, Equipment Modules, and Control Modules required to make one or more
batches. A process can contain multiple batches at a time and a process cell.

Example: a production line where one or more products can be made.

A process cell is everything required to process or produce a batch. It is defined as a group of logically
connected process facilities in one area. Each processing cell must include units and may include equipment
modules and/or control modules.

Unit
A unit consists of Equipment Modules and Control Modules. Within a Unit, there are actions that are important
to the process (mixing, heating, etc.). In a PC, all units operate independently of each other. Within a unit, there
can be only one batch or a part of it at a time.

- 30 - Version 1.0
The ISA-S88 model
Introduction ISA-S88

Units are one or more major processing activities. They are made up of equipment and control modules.

Equipment Module
An Equipment Module (EM) is made up of Control Modules and possibly a sum of Equipment Modules. An EM
can be part of a unit but can also operate as a stand-alone process in a PC. EMs carry out small actions, like
dosing and weighing, and combine all the hardware to execute the small process actions.

Equipment modules carry out minor processing activities. They may include control modules and other
equipment modules.

Control Module
A Control Module (CM) operates individually on a process to perform specific basic actions. It cannot process
actions such as a Unit or an EM does. A CM does not have to be part of an EM; it can also fit directly into a Unit.

Control modules are the lowest level. These modules are typically tied directly to one piece of hardware, such
as sensors and actuators. One control module can also be a collection of multiple control modules. For example,
a motor and encoder can be in one control module.

Example
Figure 4.3 shows how a Process Cell is dissected into multiple Units, which are further dissected into Equipment
Modules and Control Modules. As you can see, the green Control Unit is the smallest part. In this case, a valve.
Other Control Units can be a motor, robot, cylinder, and so on.

An Equipment Module consists of one or more Control Units that are needed to fulfil a specific task.

A Unit consists of one or more Equipment Modules, and a Process Cell contains one or more Units.

- 31 - Version 1.0
The ISA-S88 model
Introduction ISA-S88

Figure 4.3 - Example dissection Process Cell (from: Siemens Project Generator)

- 32 - Version 1.0
The ISA-S88 model
Examples

4.3 Examples

4.3.1 Chemical Process

Figure 4.4- Unit Reactor dissected into Equipment Modules

From the example shown in Figure 4.4 the whole machine can be dissected into the following Equipment
Modules (EM):

• Feeding
• Agitator Control
• Pressure Control
• Temperature Control
• Transfer Out
• Reactor

When taking the EM Transfer Out, we can further dissect this EM into Control Units (CU), as shown in Figure 4.5:

- 33 - Version 1.0
The ISA-S88 model
Examples

Figure 4.5- EM Transfer Out dissected into Control Modules

From here we can distinguish the following Control Modules:

• XV01
• XV02
• M02
• XV3
• XV04
• XV05
• XV06

For example, the CM XV01 contains next to the ‘output’ to the valve also the inputs for
detecting if the valve is open or closed (or the % of opening), or when present, the flow
through the valve.

- 34 - Version 1.0
The ISA-S88 model
Examples

4.3.2 Production Line

For the assembly of an Underbody (shown in Figure 5.4), an assembly line is engineered and built.

Figure 4.6 – Underbody of a car

Figure 5.5 shows a functional decomposition of this assembly line (Process Cell). It is already divided into
multiple Units, called SG01 to SG06.

The production line of Figure 4.7 contains 3 PLCs, called 3UB5MBG01, 3UB5MBG02 and
3UB5MBG03.

A PLC is not automatically a Unit within the functional decomposition from Process Cell
to Units. Look beyond that and focus on the functionality.

It does not make sense that Units SG01 and SG02 are merged together. They each have
a separate and completely different function. SG01 collects the three parts, whereas
SG02 welds them together.

As the name functional decomposition suggests, look at the function of the parts and group things that are
related to each other together function-wise!

Table 5.1 shows the function of each Unit, which explains why everything needed to fulfil that function is grouped
together.

- 35 - Version 1.0
The ISA-S88 model
Examples

UNIT FUNCTION
SG 01 Collecting RearEnd, MainFloor and FrontEnd and place these together.
SG 02 Weld these parts together (geometrical: correct alignment of parts)
SG 03 More welding
SG 04 Add parts (SideSils)
SG 05 More welding
SG 06 Transport:
Shuttle: for transport within the Process Cell
Lift: for transport to conveyer system (used for transport to other welding lines)
Table 4.1 - Functional decomposition from Process Cell into Units

Figure 4.7 - Example dissection Process Cell into Units

According to the ISA-S88 Physical model, an Unit can be dissected into Equipment Modules (EM). From the
assembly line shown in Figure 4.7, SG03 is further decomposed and shown in Figure 4.8.

- 36 - Version 1.0
The ISA-S88 model
Examples

Figure 4.8 – Dissection of SG03 into Equipment Modules

Figure 4.8 shows that the Unit SG03 consists of the following Equipment Modules:

• Robots 30R01 – 30R04, and 30R06

• Fixture 30FX01
• Gates 30SGT01 and 30SGT02

Figure 4.9 – Dissection of Equipment Module 30FX01 into Control Modules

- 37 - Version 1.0
The ISA-S88 model
Examples

Zooming in on Equipment Module 30FX01 consists of the following Control Modules:

• DEV3001 … DEV3004
• DEV3016 and DEV3017

When taking a good look at DEV3001 and DEV3017 in Figure 4.9, they are grouped together. In fact, they belong
to each other. Figure 4.10 shows how these two Control Modules (here called devices) are related.

DEV3001 provides the motion (back and front) and DEV3017 lock the slide into a fixed position6.

A Control Unit can contain 1 or more Control Units, as shown in Figure 4.2 and explained
in Section Control Module.

Figure 4.10 – The CMAX – Pneumatic servo controller

These two Control Units belong to each other.

A detailed view of the Control Module DEV3001 is shown in Figure 4.12.

Figure 4.11 – Control of DEV3001 and DEV3017

6
Locking or fixating a (pneumatic) servo drive is normally not done. A servo drive wants to be in its position. In
this specific application, it is important that the position is held, because in this fixture the geometry of the car
is defined.

- 38 - Version 1.0
The ISA-S88 model
Examples

Figure 4.12 – Control of DEV3001 (CMAX – pneumatic position servo)

- 39 - Version 1.0
Software Design
Software Development Life Cycle

5 Software Design

5.1 Software Development Life Cycle

The complete software development process, or Software Development Life Cycle, is creating or changing
software systems and the methodologies used to achieve the changes. In the world of software engineering,
SDLC underlines various types of development methodologies. These methodologies combine to form a
skeleton of planning, control, and execution, globally known as SDLC.

Figure 5.1 – The Software Development Life Cycle

One of the methods used in the SDLC is the V-Model. Other used methods are:

• Waterfall model
• Prototyping model
• Spiral model
• Iterative and incremental model
• Agile, Scrum and DevOps

- 40 - Version 1.0
Software Design
The V-Model

5.2 The V-Model

The V-Model, also known as the Verification and Validation model, is a software development methodology that
maps the different stages of development onto a V-shaped diagram, as shown in Figure 5.2. This model
emphasises a sequential design process where each development phase is paired with a corresponding testing
phase.

Figure 5.2 – The V-model

The left side of the "V" represents the stages of system specification and design, starting with requirements
analysis and progressing through system design, architectural design, and module design. The right side of the
"V" represents the stages of system testing, which correspond directly to the earlier stages of development,
including unit testing, integration testing, system testing, and acceptance testing.

The central idea of the V-Model is that for each phase of development, there is a directly associated phase of
testing. This ensures that verification and validation processes are integrated into every stage of the
development lifecycle, promoting early detection and resolution of defects. The V-Model is particularly known
for its structured approach, which provides clear milestones and deliverables, ensuring that each development
activity is thoroughly checked against the requirements and specifications set out at the beginning of the
project.

- 41 - Version 1.0
Software Design
Understanding the V-Model

Why is this model used in PLC software engineering?

• PLC software is meant to be reliable. It controls production facilities that operate 24/7 for the next 20-
25 years, such as (nuclear) power plants, chemical processes, or assembly lines.
• The machine controlled by the PLC must be easy to operate. Operators must have a clear operating
panel (HMI) that shows all system information. When a malfunction occurs, an alarm must be
generated with all the necessary information for the operator to solve the problem with as little
downtime (…) as possible.
• Service engineers must be able to troubleshoot the system and understand the software to find the
problem quickly.

5.3 Understanding the V-Model

One of the V-Model's main strengths is its emphasis on verification and validation at each stage of the
development process. The dashed line between the left and right leg represents this, for example, in Module
design and Module testing in Figure 5.2.

Related to the ISA-S88 Model, the smallest parts (Control Modules) are first designed and tested before being
combined into an Equipment Module.

A well-documented and structured development process makes maintaining and upgrading PLC software
easier. As changes are made, the V-Model ensures that modifications are systematically tested and validated,
reducing the risk of introducing new errors.

The following sections describe the left side of the V-Model. For each design process on the left side of the V-
Model, there is a verification process on the right side. The verification process is not described.

A commonly used method for prioritizing requirements (user or system requirements) is the MoSCoW
methodology, as described in Section 5.4 on page 45.

5.3.1 Problem Analysis

Problem Analysis is the initial phase in the V-Model. During this phase, the primary objective is to thoroughly
understand the problem the system or project aims to solve. This involves identifying and analysing the root
causes of the problem, understanding the context in which it occurs, and defining the scope and objectives of
the project.

Try to thoroughly understand the problem that the system or project aims to solve. If
there are any uncertainties, discuss them with the customer:

According to me, I think you meant this. Is that correct?

The outputs of the Problem Analysis phase form the foundation for defining User and System Requirements. By
thoroughly understanding the problem and its context, project teams can ensure that the subsequent
requirements are aligned with the actual needs and constraints, leading to more effective and targeted
solutions.

- 42 - Version 1.0
Software Design
Understanding the V-Model

5.3.2 User Requirements

User Requirements refer to the needs and expectations of the end users or stakeholders that the system or
product must satisfy. These requirements describe what the users want to achieve with the system, focusing
on the desired outcomes and functionalities rather than the technical specifications.

User requirements in the V-Model are typically defined early in the development process and serve as a
foundation for all subsequent project phases. They are captured in a document called the User Requirements
Specification (URS) or similar. This document outlines:

• Functional Requirements
What the system should do, detailing the specific functions and features it must provide.

• Non-Functional Requirements
How the system should perform, including performance, usability, reliability, and other quality attributes.

• Constraints
Any limitations or conditions that the system must adhere to, such as regulatory requirements,
compatibility issues, or design restrictions.

The user requirements are on the left side of the "V” on position 2, at the top level of system requirements. As
the development progresses down the left side, these requirements are broken into more detailed system and
component specifications. Once the system is built, the right side of the "V" involves validating and verifying
that each part meets these initial user requirements through various testing and evaluation phases, ensuring
the final product fulfils the intended user needs.

5.3.3 System Requirements

System Requirements are a more detailed and technical refinement of the User Requirements. They specify what
the system must do to satisfy user requirements, often including functional and non-functional aspects. These
requirements are critical because they bridge the gap between what users want and how the technical solution
will be implemented.

System Requirements are usually captured in a System Requirements Specification (SRS) document and
include:

• Functional Requirements
Detailed descriptions of the system's functionalities, specifying how the system should behave in
various scenarios. This includes inputs, outputs, and the processing that must occur.

• Non-Functional Requirements
Specifications related to the system's performance, reliability, scalability, security, usability, and other
quality attributes.

• Interface Requirements
Describes how the system will interact with other systems, software, hardware, and users. This includes
user interfaces, APIs, and integration points.

• Design Constraints
Limitations imposed by standards, regulations, or technological constraints affect how the system can
be designed and implemented.

- 43 - Version 1.0
Software Design
Understanding the V-Model

The System Requirements are derived from the User Requirements and placed below them on the left side of the
"V," in position 3. These requirements guide the system architecture and design phases, ensuring that the
system's structure and components can fulfil the user requirements.

During the testing phases on the right side of the "V", the System Requirements are verified to ensure that the
developed system meets all specified criteria. This ensures that the final product satisfies user expectations
and adheres to the technical and operational specifications necessary for successful deployment and
operation.

5.3.4 System Design

System design is a crucial phase in the V-Model of systems development. It involves defining the detailed
architecture and components of the system based on the system requirements. The primary goal of system
design is to create a blueprint that guides the construction of the system, ensuring it meets all specified
requirements.

In this phase, a functional decomposition is made. Chapter 5, The ISA-S88 model, describes how to do this.

5.3.5 Module Design

In the Module Design phase, the individual modules' detailed internal structure and behaviour are specified. This
phase is crucial for translating the high-level system architecture into detailed specifications that developers
can use to build the system.

This includes creating flowcharts and sequencers for each module from the User Story and how these modules
communicate.

5.3.6 Coding
In the Coding phase, the module is programmed according to the specifications made in the Module Design
phase. When finished coding, it is tested in the Module Testing phase to validate whether it behaves as expected
(described in the Module Design documentation).

Want to know more about the phases of the V-Model? See the reader from System
Engineering for a more detailed overview of the V-Model.

Using the V-Model and the ISA-S88 model, a structured and maintainable PLC program can be created. While
the ISA-S88 model creates the structure, the V-Model defines the process from customer requirements to
delivery of the requested machine.

- 44 - Version 1.0
Software Design
MoSCoW method

5.4 MoSCoW method

The MoSCoW method is a prioritization technique used in management, business analysis, project
management, and software development to reach a common understanding with stakeholders on the
importance they place on the delivery of each requirement.

The term MOSCOW itself is an acronym derived from the first letter of each of four prioritization categories:

• M – Must have
• S – Should have
• C – Could have
• W – Would have or Won’t have
The interstitial O’s are added to make the word pronounceable. While the O’s are usually in lower-case to indicate
that they do not stand for anything.

All requirements are important, however to deliver the greatest and most immediate business benefits early the
requirements must be prioritized. Developers will initially try to deliver all the Must have, Should have and Could
have requirements but the Should and Could requirements will be the first to be removed if the delivery
timescale looks threatened.

The plain English meaning of the prioritization categories has value in getting customers to better understand
the impact of setting a priority, compared to alternatives like High, Medium and Low.

The categories are typically understood as:

Must have

Requirements labelled as Must have are critical to the current delivery timebox in order for it to be a success. If
even one Must have requirement is not included, the project delivery should be considered a failure (note:
requirements can be downgraded from Must have, by agreement with all relevant stakeholders; for example,
when new requirements are deemed more important). MUST can also be considered an acronym for the
Minimum Usable Subset.

Should have

Requirements labelled as Should have are important but not necessary for delivery in the current delivery
timebox. While Should have requirements can be as important as Must have, they are often not as time-critical
or there may be another way to satisfy the requirement so that it can be held back until a future delivery timebox.

Could have

Requirements labelled as Could have are desirable but not necessary and could improve the user experience or
customer satisfaction for a little development cost. These will typically be included if time and resources permit.

Would have

Requirements labelled as Would have, have been agreed by stakeholders as the least-critical, lowest-payback
items, or not appropriate at that time. As a result, Would have requirements are not planned into the schedule
for the next delivery timebox. Would have requirements are either dropped or reconsidered for inclusion in a
later timebox. (Note: occasionally the term Won’t have is used).

- 45 - Version 1.0
Software Design
How to apply the V-Model

5.5 How to apply the V-Model

The customer provides a list of functionality of the requested machine, or production line. Some customers
have very detailed specifications, that will make the design process less difficult. Most customers provide a
story on what the machine should do, and which hardware should be used.

For those cases, the V-Model helps defining the User and System Requirements, and structuring the design and
tests phases.

Why the structured approach is important is shown in Section 5.6. In this section a typical Turn-Key project is
described.

5.5.1 Problem Analysis

You must realise that customers are very familiar with the system they want you to design. Therefore, you can
count on the fact that it will never be complete based on assumptions. The customer knows and assumes that
you know them, too. And you, as an engineer, don’t know them yet.

A customer's description can be something like this:

“I need a mixing system with 50 litres of content and where 2 fluids are mixed. After heating, the mixture will be
dosed into bottles with an exact content of mixed fluid of 250 ml in each bottle. A conveyor belt feeds empty
bottles to the bottom valve of the mixer tank. Then they are filled with this amount and transported to a robot
system that will take the filled bottles from the conveyor and put them into a crate (by the way: the robot is
delivered and controlled by company x).”

The above description (phase 1 of the V-Model) is open to many different interpretations. So, reading it carefully
and writing in your own “engineer's language” how the functionality should be is always better than guessing
what the outcome should be.

The “engineers language” means that you are going to convert the “customers story” to a requirements table,
as you learned in the “System Engineering” class.

When something is unclear, or worse, there are requirements opposite to each other, and there are 2 choices
where you can decide between what to do with that:

• Ask the customer (teacher) what is meant to do in that specific requirement.

• Make an assumption, register it in the design report, and design it in that way.

It is no option to do nothing with insecurities you have about functionality.

Of course, the first option is always the best, especially in the beginning phase of the project. Then, you get the
closest to the result “the customer” (teacher) wants.

In the end phase, shortly before delivery of the project, this can be too time-consuming for the last details, and
if you don’t want to delay the project, it can be best to make a logical, functional, correct decision.

- 46 - Version 1.0
Software Design
The Turn-Key Project

5.5.2 Translating
First, be sure that the “user requirements” and the “system requirements” (phases 2 and 3 of the V-Model) are
precise and understood by you until the smallest detail is possible. You must be able to do your “system
engineering” without having to doubt whether the functionality will be approved in the end or not. If you have no
doubts or points about discussing functionality with your customer (or teacher), you can steam forward with
your complete focus on a known project output.

Sometimes, you get a better requirement document with more details. However, your task is to understand what
is needed and convert that into a design that gives your customer a working solution without discussions when
you commission and deliver the solution at the customer's production site.

5.6 The Turn-Key Project

A definition of a ‘Turn-Key project’ is:

A "Turn-Key project" in engineering refers to a type of project where a single entity, often a contractor or a firm,
is responsible for the entire process, from design to the final operational state. The contractor handles all
aspects of the project, including design, engineering, procurement, construction, and commissioning, delivering
a fully operational facility or system to the client. This approach is designed to minimise the client's involvement
in the complexities of the project execution, hence the term "Turn-Key," implying that the client only needs to
"turn the key" to start operations once the project is completed.

The benefits of the Turn-Key approach are:

• Single point or responsibility

The contractor is the sole identity responsible for the entire project, reducing the client’s risk and
simplifying project management.

• Fixed Price and Schedule

Turn-key projects typically have a fixed price and a guaranteed completion date, providing the client with
cost and time predictability.

• Integrated Services
The contractor handles all phases of the project, including:

o Design: Developing detailed plans and specifications.

o Procurement: Sourcing and purchasing all necessary materials and equipment.
o Construction: Building the project according to the designs.
o Commissioning: Testing and ensuring that the project meets all operational requirements.
• Performance Guarantees
The contractor often guarantees the performance of the completed project, ensuring it meets specified
operational criteria.

• Reduced Client Involvement

The client is minimally involved in the project's day-to-day management, which allows them to focus on
their core business activities.

• Streamlined Communication
With a single point of contact, communication is more straightforward, reducing the potential for
misunderstandings and delays.

- 47 - Version 1.0
Software Design
The Turn-Key Project

A manufacturer of automotive parts wants to build a new production line. To streamline the process, they opt
for a turnkey project. They hire an engineering firm that handles everything from initial design to construction
and final testing. Upon completion, the firm hands over a fully operational production line to the customer
(manufacturer), who only needs to "turn the key" to start operations.

In summary, turn-key projects in engineering offer a comprehensive, efficient, and low-risk solution for clients
seeking to develop complex facilities and infrastructure with minimal involvement in the detailed execution
phases.

In this section, you can read how the process of a Turn-Key project “normally takes place.” This is described in
the main lines so you can understand why treating project requirements very seriously is important.

Table 6.1 describes a common delivery and payment method for turnkey projects. After ordering, 30% of the
total amount is paid so the engineering firm can pay for the materials needed to build the production line. The
second 30% is paid after showing the customer that the ordered production line is according to specification in
a milestone called the Factory Acceptance Test (FAT). When the FAT is passed, the customer acknowledges
that the requirements were successfully translated into a working production line.

Of course, during phases 1 to 5, the engineering firm continues to ask the customer questions when
requirements (user or system) are unclear or can be interpreted differently. This creates a trusting relationship
between the engineering firm and the customer.

CUSTOMER ENGINEERING FIRM % PAID V-MODEL PHASES

Placing order 30
Problem analysis 1
Set requirements 2, 3
Design 4, 5
Building solution 6
Testing solution 7, 8
Preparing for FAT
Executing and approving FAT 30 8, 9
Transport to site
Installing at site
Commissioning
Preparing for SAT7
Executing and approving SAT 30 8, 9
Problem free? 10
Table 5.1 - Payment moments in Turn-Key project

• When your customer approves the SAT, your company gets paid for the next 30% of the total project
price. This is an important moment — not only because of payments but also because you gain the
customer's trust that the system requirements, especially the customer (user) requirements, are met so
the system can be used as agreed upfront!
• The last 10% is paid when the customer uses the production line and it runs problem-free for at least a
month!
This example shows the importance of good user and system requirements. With good requirements, the
production line functions as the customer expects, and the engineering firm gets paid for the labour.

7
SAT is the Site Acceptance Test. This is a common abbreviation in industry for the test, done by the customer,
executed at the location where the equipment is going to be used. Mostly at customers location.

- 48 - Version 1.0
Software Design
Software Testing

The better the requirements are, the clearer it is, what should be programmed. And the customer knows how
the requirements are interpreted.

For the customer it is easier to approve the FAT and SAT, which will result in a (almost) problem free delivery of
the machine.

5.7 Software Testing

As previously mentioned in Section 5.2, testing and validating are key principles of the V-Model. The dashed
lines between two blocks, as shown in Figure 5.2 on page 41, represent the testing and validation phases.

Considering the functional decomposition of the ISA-S88 model, the smallest part of the system, the Control
Module (CM), is programmed in phase 6 (Coding) of the V-Model. The CM is then tested (or validated) in phase
7 (Module Testing) to confirm whether it behaves as described in phase 5 (Module Design). If not, it needs to
be fixed.

During model testing the programmed CM is tested to verify it meets the specifications and requirements.
Functional testing involves checking the logic, operations and performance of the CM under various normal and
abnormal conditions. Test cases, scripts or checklists can guide the functional testing.

Once all CMs are tested and validated, they can be utilized in the higher-level Equipment Modules (EMs). The
advantage of testing all CMs first is that when using them at the EM level, there are no concerns about their
functionality. This allows for a focus on testing and validating the functionality of the EM without having
concerns about the CMs' functionality.

Testing CMs, in phase 8 of the V-Model, involves checking the interfaces, protocols and data exchange between
the CMs, EMs and HMIs. The communication between the PLC and other devices (other PLCs or MES systems)
is tested in phase 9. As with the testing of the CMs, test cases, scripts or checklist help testing the functionality
of the EMs.

Arrived at phase 10 (Validating), the system is checked and validated against the user requirements.

The most common mistake is that bugs from other parts of the system disturb functions
that are no longer within you no longer have control over.

It is recommended that each CM be tested before adding them to an EM.

- 49 - Version 1.0
Software Design
Examples

5.8 Examples
In the use case of the final assignment, the valves for inputting and outputting fluid in the tank, as well as the
concept of the ISA-S88 physical module, creating an FC/FB for a valve and calling that in a separate FB for the
equipment module, may seem like excessive software action. While in a simple example, this may appear as an
“exaggeration” of a simple function, in a more complex example like the one below, the approach starts to make
more sense.

Simple Control Module

A simple example of a Control Module is a valve that opens product flow to a tank. Just a few lines of program
code are responsible for the valve's functionality, so testing is done pretty quickly. When it is done, consider
reusing the same programmed function for multiple valves (and it is strongly advised!).

Complicated example of a Control Module

A more complicated example of a Control Module can be a servo motor. Still being a Control Module, there can
be a bunch of software blocks responsible for the functionality of this Control Module. In this specific example,
you could be writing an FB containing (in this case Motion Control blocks like in the library names start with
MC_ not to be confused with CM_ from Control Module):

• MC_Power,
• MC_Reset,
• MC_MoveAbsolute,
• MC_MoveRelative,
• And so on.
And even a state diagram to handle the above block in the correct order, checking if there is a “done” bit to
confirm that the action is done. Error handling can still be part of the Control Module from the servo drive when
something goes wrong.

When using only local variables like “statics,” the FB can be re-used for multiple motors by connecting a different
instance DB to the FB.

Again, when a complete Control Module is programmed, tested, and validated as “Complete,” you can forget
about it, reuse it, and be confident that it “just works.”

On the right side of the V-Model, you are ahead in the “validation phase.” You can be confident in the above-
mentioned FAT and SAT tests.

You will definitely not encounter “unexpected software errors” while performing a “demonstration” for your
customer.

The end goal of a structured program is to be able to reuse the Control Modules and as many Equipment
Modules as needed.

- 50 - Version 1.0
Software Design
Examples

Second more complicated example Control Module “Valve with weighing scale”:
Imagine the simple example with “just one valve”, adding cocoa powder to a mixer tank. But now the same
cocoa powder valve is the end valve of a weighing system, with its own control system, with its own HMI, and
with its own storage tank and dosing screw to dose the exact amount of cocoa powder in a weighing bunker
before dropping the cocoa amount in the tank.

The above is a great example of still having “only one Control Module” in the PLC, controlled by the same
Equipment Module called “EM_CocoaDosing”. It is just calling a different “CM_CocoaDosing” FB.

- 51 - Version 1.0
State Machines and Flowcharts

6 State Machines and Flowcharts

6.1 Flowcharts
A flowchart is a diagram that depicts a process, system or computer algorithm. They are widely used in multiple
fields to document, study, plan, improve and communicate often complex processes in clear, easy-to-
understand diagrams. Flowcharts use rectangles, ovals, diamonds and potentially numerous other shapes to
define the type of step, along with connecting arrows to define flow and sequence. They can range from simple,
hand-drawn charts to comprehensive computer-drawn diagrams depicting multiple steps and routes. If we
consider all the various forms of flowcharts, they are one of the most common diagrams on the planet, used by
both technical and non-technical people in numerous fields.

Flowcharts are sometimes called by more specialised names such as Process Flowchart, Process Map,
Functional Flowchart, Business Process Mapping, Business Process Modelling and Notation (BPMN), or
Process Flow Diagram (PFD). They are related to popular diagrams, such as Data Flow Diagrams (DFDs) and
Unified Modelling Language (UML) Activity Diagrams.

As a visual representation of data flow, flowcharts are useful in writing a program or algorithm and explaining it
to others or collaborating with them. You can use an algorithm flowchart to spell out the logic behind a program
before ever starting to code the automated process. It can help organise big-picture thinking and guide when it
comes to code. More specifically, flowcharts can:

• Demonstrate the way code is organised

• Visualize the execution of code within a program
• Show the structure of a website or application
• Understand how users navigate a website or program

Often, programmers write pseudocode, a combination of natural language and computer

language that people can read. This may allow greater detail than the flowchart and serve
either as a replacement for it or as a next step to actual code.

draw.io is a free online diagram software for making flowcharts and process diagrams.

Use the symbols shown in Figure 6.1, when creating flowcharts. An example of a simple flowchart is shown in
Figure 6.2.

- 52 - Version 1.0
State Machines and Flowcharts
Flowcharts

Figure 6.1 - Flowchart symbols according ISO5807:1985

Figure 6.2 - Flowchart example Heater

- 53 - Version 1.0
State Machines and Flowcharts
State Machines

6.2 State Machines

A state machine is a behaviour model. It consists of a finite number of states and is called a finite-state machine
(FSM). The machine performs state transitions and produces outputs based on the current state and a given
input.

The basic building blocks of a state machine are states and transitions. A state is a situation in which a system
depends on previous inputs and causes a reaction to following inputs. One state is marked as the initial state.
This is where the machine's execution starts. A state transition defines the input by which a state is changed
from one state to another. States and transitions produce outputs depending on the state machine type.

The behaviour of state machines can be observed in many devices that perform a predetermined sequence of
actions, depending on the sequence of events with which they are presented. A simple example is vending
machines, which dispense products when the proper combination of coins is deposited.

State

A state is a description of the status of a system that is waiting to execute a transition.

Transition

A transition is a set of actions to be executed when a condition is fulfilled, or an event is received.

Figure 6.3 – State machine definitions

A simple example of a state machine is the traffic light. Figure 6.4 shows how a state machine of a simple traffic
light could be.

Its initial state is the green light. The request button will be pressed when a pedestrian wants to cross the street.
The light changes from the green state to the orange. The traffic light will be in that state for 5 seconds before
transitioning to the red light state. The pedestrian has 25 seconds to cross the street before the red light turns
green again.

- 54 - Version 1.0
State Machines and Flowcharts
State Machines

Figure 6.4 – A simple pedestrian traffic light state machine

- 55 - Version 1.0
Program Blocks

7 Program Blocks

Figure 7.1 - Operating system and user program (Taken from: Siemens Programming guideline v1.6)

For SIMATIC controllers, the user program is always executed cyclically. The "Main” cycle OB already exists in
the "Program blocks” folder after a controller was created in STEP 7. The block is processed by the controller
and recalled in an infinite loop.

BLOCK TYPE EXPLANATION

Organisation Blocks (called OBs) are the interface between the operating system and the user
program. They are called by the operating system and control processes, such as those shown
in Table 8.1. Several OB types are available depending on the controller (PLC type).

A function block (FB) is a subroutine that is executed when called from another code block
(OB, FB, or FC). The calling block passes parameters to the FB and also identifies a specific data
block (DB) that stores the data for the specific call or instance of that FB. Changing the
instance DB allows a generic FB to control the operation of a set of devices. For example, one
FB can control several pumps or valves, with different instance DBs containing the specific
operational parameters for each pump or valve.
A function (FC) is a subroutine that is executed when called from another code block (OB, FB,
or FC). The FC does not have an associated instance DB. The calling block passes parameters
to the FC. The output values from the FC must be written to a memory address or to a global
DB.

Stores data.
Accessible from all blocks in the program.

- 56 - Version 1.0
Program Blocks
Using blocks to structure your program

7.1 Choosing the type of structure for your program

Based on the requirements of your application, you can choose either a linear structure or a modular structure
for creating your user program:

• A linear program executes all of the instructions for your automation tasks in sequence, one after the
other. Typically, the linear program puts all of the program instructions into the OB for the cyclic
execution of the program (OB 1).
• A modular program calls specific code blocks that perform specific tasks. To create a modular
structure, you divide the complex automation task into smaller subordinate tasks that correspond to
the technological functions of the process. Each code block provides the program segment for each
subordinate task. You structure your program by calling one of the code blocks from another block.

By creating generic code blocks that can be reused within the user program, you can simplify the design and
implementation of the user program. Using generic code blocks has several benefits:

• You can create reusable blocks of code for standard tasks, such as for controlling a pump or a motor.
You can also store these generic code blocks in a library that different applications or solutions can
use.
• When you structure the user program into modular components that relate to functional tasks, the
design of your program can be easier to understand and manage. The modular components not only
help standardise the program design but can also help update or modify the program code quicker and
easier.
• Creating modular components simplifies program debugging. By structuring the complete program as
a set of modular program segments, you can test the functionality of each code block as it is developed.
• Creating modular components related to specific technological functions can help simplify and reduce
the time involved with commissioning the completed application.

7.2 Using blocks to structure your program

You create modular code blocks by designing FBs and FCs to perform generic tasks. You then structure your
program by having other code blocks call these reusable modules. The calling block passes device-specific
parameters to the called block. When a code block calls another code block, the CPU executes the program
code in the called block. After the execution of the called block is complete, the CPU resumes the execution of
the calling block. Processing continues with the execution of the instructions after the block call.

A Calling block
B Called (or interrupting) block
① Program execution
② Instruction or event that initiates the execution of another block
③ Program execution
④ Block end (returns to calling block)

Figure 7.2 - Calling sequence (Taken from: Siemens S7-1200 Programmable controller – System Manual)

- 57 - Version 1.0
Program Blocks
Using blocks to structure your program

You can nest the block calls for a more modular structure. In the following example, the nesting depth is 3: the
program cycle OB plus 3 layers of calls to code blocks.

① Start of cycle
② Nesting depth

Figure 7.3 - Nesting depth (Taken from: Siemens S7-1200 Programmable controller – System Manual)

The maximum nesting depth is six.

Safety programs use two nesting levels. The user program therefor has a nesting depth of
four in safety programs.

An educated software engineer knows how to use various ‘Block types’ inside a single project.

• Functional Decomposition of a large project (ISA-S88)

• Easier to program
• Easier to maintain
• Easier to reuse functionality
• Easier when tasks needs to be divided over more software engineers (students) within a team.
You can give your program a good and clear structure with the different block types.

Due to a good and structured program you get many function units that can be multiply reused within a project
and also in other projects. These function units then usually only differ by a different configuration

- 58 - Version 1.0
Program Blocks
Organization Blocks (OB)

7.3 Organization Blocks (OB)

Organization blocks provide structure for your program. They serve as the interface between the operating
system and the user program. OBs are event driven. An event, such as a diagnostic interrupt or a time interval,
causes the CPU to execute an OB. Some OBs have predefined start events and behaviour.

The program cycle OB contains your main program. You can include more than one program cycle OB in your
user program. During RUN mode, the program cycle OBs execute at the lowest priority level and can be
interrupted by all other event types. The startup OB does not interrupt the program cycle OB because the CPU
executes the startup OB before going to RUN mode.

After finishing the processing of the program cycle OBs, the CPU immediately executes the program cycle OBs
again. This cyclic processing is the "normal" type of processing used for programmable logic controllers. For
many applications, the entire user program is located in a single program cycle OB.

You can create other OBs to perform specific functions, such as for handling interrupts and errors, or for
executing specific program code at specific time intervals. These OBs interrupt the execution of the program
cycle OBs.

7.3.1 Create an OB
Use the "Add new block" dialog to create new OBs in your user program.

Interrupt handling is always event-driven. When such an event occurs, the CPU interrupts
the execution of the user program and calls the OB that was configured to handle that
event. After finishing the execution of the interrupting OB, the CPU resumes the execution
of the user program at the point of interruption.

The CPU determines the order for handling interrupt events by priority. You can assign multiple interrupt events
to the same priority class. For more information, refer to the topics on organization blocks (Page 57) and
execution of the user program (Page 56).

Creating additional OBs

You can create multiple OBs for your user program, even for the program cycle and startup OB events. Use the
"Add new block" dialog to create an OB and enter a name for your OB. If you create multiple program cycle OBs
for your user program, the CPU executes each program cycle OB in numerical sequence, starting with the
program cycle OB with the lowest number (such as OB 1). For example: after the first program cycle OB (such
as OB 1) finishes, the CPU executes the program cycle OB with the next higher number.

OBs control the execution of the user program. Specific events in the CPU trigger the execution of an
organisation block. OBs cannot call each other or be called from an FC or FB. Only an event, such as a diagnostic
interrupt or a time interval, can start the execution of an OB. The CPU handles OBs according to their priority
classes, with higher-priority OBs executing before lower-priority OBs. The lowest priority class is 1 (for the main
program cycle), and the highest priority class is 26.

With the TIA Portal, OB numbers are no longer used. In the previous generation PLCs (S7-
300 and S7-400), blocks were called by number. Now, they are called by name (hence the
symbolic addressing).

OB DESCRIPTION

- 59 - Version 1.0
Program Blocks
Organization Blocks (OB)

1 Program cycle
A "Program cycle" OB is executed cyclically and is the main block of the program. This is where you
place the instructions that control your application and call additional user blocks.
100 Startup
A "Startup" OB will execute one time when the operating mode of the PLC changes from STOP to RUN.
After completion, the main "Program cycle" OB will begin executing.
20 Organisation blocks for time delay interrupt
A "Time delay interrupt" OB will interrupt cyclic program execution when a specified delay time has
expired. The delay time is specified in the extended instruction "SRT_DINT" input parameter.
30 Organisation blocks for cyclic interrupts
A "Cyclic interrupt" OB allows you to start programs at periodic intervals independently of cyclic
program execution. The intervals can be defined in this dialog or the OB's properties.
40 Organisation blocks for HSC hardware interrupts
A "Hardware interrupt" OB will interrupt cyclic program execution in reaction to a signal from a hardware
event. The events must be defined in the properties of the configured hardware.
82 Organisation block for diagnostic error interrupt
A "Diagnostic error interrupt" OB will interrupt cyclic program execution if a diagnostics-capable
module, for which the diagnostic error interrupt has been enabled, recognises an error.
80 Organisation block for the time error interrupt
A "Time error interrupt" OB will interrupt cyclic program execution if the maximum cycle time has been
exceeded. The maximum cycle time is defined in the properties of the CPU.
Table 7.1 - Available OBs for a S7-1200 CPU

It is possible to create several Main OBs in a program. The OBs are processed sequentially by OB number, as
shown in Figure 7.4.

Figure 7.4 – Processing sequence of multiple Main OBs (Taken from: Siemens Programming guideline
v1.6)

Figure 7.5 shows how these OBs are related to which PLC state.

- 60 - Version 1.0
Program Blocks
Organization Blocks (OB)

Figure 7.5 - OBs available in the S7-300, S7-400, S7-1200 and S7-1500 PLCs

A project must have, at a minimum, an organisation block for cyclic program processing.

Figure 7.6 - OBs available (origin S7-300/S7-400 PLCs)

- 61 - Version 1.0
Program Blocks
Organization Blocks (OB)

• Depending on the controller type, many different OB types are available.

o OB1 is the cyclic program execution program
o The controller's operating system calls other OBs.
o Several Main OBs can be created in a program. The OBs are processed sequentially by OB
number.
o TIA portal can automatically give an OB number

7.3.2 Event execution priorities and queuing

Events control the CPU processing. An event triggers an interrupt OB to be executed. You can specify the
interrupt OB for an event during the creation of the block, during the device configuration, or with an ATTACH or
DETACH instruction. Some events happen regularly, such as the program cycle or cyclic events. Other events
happen only a single time, such as startup events and time delay events. Some events occur when the hardware
triggers an event, such as an edge event on an input point or a high-speed counter event. Events like the
diagnostic and time errors only happen when an error occurs. The event priorities and queues determine the
processing order for the event interrupt OBs.

The CPU processes events in order of priority, where 1 is the lowest priority and 26 is the highest priority. Before
V4.0 of the S7-1200 CPU, each type of OB belonged to a fixed priority class (1 to 26). From V4.0 forward, you
can assign a priority class to each OB that you can configure. You configure the priority number in the attributes
of the OB properties.

OBs execute the events that trigger them in priority order. From V4.0 forward, you can configure OB execution
to be interruptible or non-interruptible. Note that program cycle OBs are always interruptible, but you can
configure all other OBs to be interruptible or non-interruptible.

If you set interruptible mode, if an OB is executing and a higher-priority event occurs before the OB completes
its execution, the running OB is interrupted to allow the higher-priority event OB to run. The higher-priority event
runs, and the interrupted OB continues at its completion. When multiple events occur while an interruptible OB
executes, the CPU processes those events in priority order.

If you do not set interruptible mode, an OB runs to completion when triggered, regardless of any other events
that trigger when running. Consider the following two cases where interrupt events trigger a cyclic OB and a
time delay OB. In both cases, the OB (OB201) time delay has no process image partition assignment and
executes at priority 4. The cyclic OB (OB200) has a process image partition assignment of PIP1 and executes
at priority 2. Figure 7.7 and Figure 7.8 show the difference in execution between non-interruptible and
interruptible execution modes:

Figure 7.7 – Non-interruptible execution mode

- 62 - Version 1.0
Program Blocks
Organization Blocks (OB)

Figure 7.8 – Interruptable execution mode

OB execution

If you configure the OB execution mode to be non-interruptible, then a time error OB

cannot interrupt OBs other than program cycle OBs. Prior to V4.0 of the S7-1200 CPU, a
time error OB could interrupt any executing OB. From V4.0 forward, you must configure
OB execution to be interruptible if you want a time error OB (or any other higher priority
OB) to be able to interrupt executing OBs that are not program cycle OBs.

The CPU limits the number of pending (queued) events from a single source, using a different queue for each
event type. Upon reaching the limit of pending events for a given event type, the next event is lost. You can use
a time error interrupt OB to respond to queue overflows.

Each CPU event has an associated priority. The CPU generally services events in order of priority (highest priority
first). The CPU services events of the same priority on a "first-come, first-served" basis.

- 63 - Version 1.0
Program Blocks
Organization Blocks (OB)

EVENT QUANTITY ALLOWED DEFAULT OB PRIORITY

Program Cycle 1 program cycle event 14
Multiple OBs allowed
Startup 1 startup event1 14
Multiple OBs allowed
Time delay Up to 4 time events 3
1 OB per event
Cyclic interrupt Up to 4 events 8
1 OB per event
Hardware interrupt Up to 50 hardware interrupts events2 18
1 OB per event, but you can use the same OB for 18
multiple events
Time error 1 event (only if configured) 3 22 or 264
Diagnostic error 1 event (only if configured) 5
Pull or plug of modules 1 event 6
Rack or station failure 1 event 6
Time of day Up to 2 events 2
Status 1 event 4
Update 1 event 4
Profile 1 event 4
Table 7.2 - OB Events
1 The start and program cycle events never occur simultaneously because the startup event runs to completion
before the program cycle event starts.
2 Over 50 hardware interrupt event OBs using the DETACH and ATTACH instructions.
3 You can configure the CPU to stay in RUN if the scan cycle exceeds the maximum scan cycle time, or you can
use the RE_TRIGR instruction to reset the cycle time. However, the CPU goes to STOP mode the second time
that one scan cycle exceeds the maximum scan cycle time
4 The priority for a new V4.0 or V4.1 CPU is 22. If you exchange a V3.0 CPU for a V4.0 or V4.1 CPU the priority is
26: the priority that was in effect for V3.0. In either case, the priority field is editable and you can set the priority
to any value in the range 22 to 26.

Interrupt latency
The interrupt event latency (the time from notification of the CPU that an event has occurred
until the CPU begins execution of the first instruction in the OB that services the event) is
approximately 175 μsec, provided that a program cycle OB is the only event service routine
active at the time of the interrupt event.

- 64 - Version 1.0
Program Blocks
Function (FC)

7.4 Function (FC)

A function (FC) is like a subroutine, and is a code block that typically performs a specific operation on a set of
input values. The FC stores the results of this operation in memory locations. For example, use FCs to perform
standard and reusable operations (such as for mathematical calculations) or technological functions (such as
for individual controls using bit logic operations). An FC can also be called several times at different points in a
program. This reuse simplifies the programming of frequently recurring tasks.

An FC does not have an associated instance data block (DB). The FC uses the local data stack for the temporary
data used to calculate the operation. The temporary data is not saved. To store data permanently, assign the
output value to a global memory location, such as M memory or to a global DB (see Section 7.6, on page 72).

Functions can be used, for example, for the following purposes:

• Math functions – that return a result dependent on input values.

• Technological functions – such as individual controls with binary logic operations.
• A function can also be called several times at different points within a program.

7.4.1 Create an FC
For example, we want to create a function for a motor controller. With the following steps this is achieved.

• Create a new FC, through the Add new block in the Program block folder in the Project tree.
• Rename the block to, for example, Motor_Manual, set the language to FBD and keep the automatic
assignment of the number, as shown in Figure 7.9.

Figure 7.9 – Create an FC

- 65 - Version 1.0
Program Blocks
Function (FC)

• When the block is opened (automatically, or manually), the editor is opened. You can find the interface
description of your function in the upper section of your programming view.
• A binary output signal is needed for controlling the motor. For this reason, we first create the local output
tag #Conveyor_motor_manual_mode of the type BOOL. Enter the comment for the parameter, as shown
in Figure 7.10.

Figure 7.10 – FC with configured interface

• Add the parameter #Manual_mode_active as the input interface under Input and confirm the entry. Data
type BOOL is assigned automatically. This will be retained. Next, enter the comment.
• Continue by adding the parameters #Pushbutton_manual_mode, #Enable_OK and
#Safety_shutoff_active as additional binary input parameters and check their datatypes. Add the
comments, as shown in Figure 7.10.
• For purposes of documentation, assign the block title, a block comment and a helpful name for Network
1.

- 66 - Version 1.0
Program Blocks
Function (FC)

7.4.2 Programming the FC

• Below the interface description, you see a toolbar in the programming window with various logic
functions and below that an area with networks. We have already specified the block title and the title
for the first network there. Programming is performed within the networks using individual logic blocks.
Distribution among multiple networks helps to preserve the clarity of the program. In the following, you
will get to know the various ways you can insert logic blocks.

• On the right side of your programming window, in the Task card Instructions is a list of instructions you
can use in the program. Under Basic instructions − Bit logic operations, find the function
(Assignment) and use a drag & drop operation to move it to Network 1 (green line appears, mouse
pointer with + symbol), as shown in Figure 7.11.

Figure 7.11 – Adding a basic instruction

• Now drag and drop to move the output parameter #Conveyor_motor_manual_mode onto the <??.?>
above the block you just inserted. The best way to select a parameter in the interface description is by
grabbing it at the blue symbol .
• This determines that the #Conveyor_motor_manual_mode parameter is written by this block. Still
missing, however, are the input conditions so that this actually happens. For this, use drag & drop to
move input parameter #Manual_mode_active to the left side of the assignment block.
• The input of the assignment block will also be logically combined with other parameters by an AND
logic operation. To do this, first click the input of the block to which #Manual_mode_active is already
connected, so that the input line as a blue background, as shown in Figure 7.11.

- 67 - Version 1.0
Program Blocks
Function (FC)

Figure 7.12 – Adding an AND function to the output

• Click the icon in your logic toolbar to insert an AND logic operation between the
#Manual_mode_active tag and your assignment block.
• Double-click the second input of the & logic operation <??.?> and enter the letter "P" in the field that
appears in order to see a list of available tags starting with "P". Click the #Pushbutton_manual_mode
tag and apply with Enter, as shown in Figure 7.12.

Figure 7.13 – Selecting a tag from the Tag table

• To ensure that the output can only be controlled when the enable conditions are met and the safety
shutoff is not active, the #Enable_OK and #Safety_shutoff_active input tags are logically combined with
the AND logic operation. To do this, click twice on the yellow star of your AND block to add two
additional inputs.
• Add input tags #Enable_OK and #Safety_shutoff_active to your newly created inputs of the AND block.

• Negate the input connected to parameter #Safety_shutoff_active by selecting it and clicking .

Figure 7.14 shows the end result.

- 68 - Version 1.0
Program Blocks
Function (FC)

Figure 7.14 – A complete network

7.4.3 Changing between languages

The languages FBD and LAD are interchangeable. A block programmed in FBD can be easily be converted to
LAD and vice versa. One of the methods is changing the language in the properties of a block, as shown in
Figure 7.15.

Figure 7.15 – Change the language from FBD to LAD

The program has the following representation in LAD

Figure 7.16 – The LAD network

- 69 - Version 1.0
Program Blocks
Function Block (FB)

7.5 Function Block (FB)

A function block (FB) is like a subroutine with a memory. FBs have variable memory that is located in a data
block (DB), or "instance" DB. The instance DB provides a block of memory that is associated with that instance
(or call) of the FB and stores data after the FB finishes. You can associate different instance DBs with different
calls of the FB. The instance DBs allow you to use one generic FB to control multiple devices. You structure your
program by having one code block make a call to an FB and an instance DB. The CPU then executes the program
code in that FB, and stores the block parameters and the static local data in the instance DB. When the execution
of the FB finishes, the CPU returns to the code block that called the FB. The instance DB retains the values for
that instance of the FB. These values are available to subsequent calls to the function block either in the same
scan cycle or other scan cycles.

Figure 7.17 shows an OB that calls one FB three times, using a different data block for each call. This structure
allows one generic FB to control several similar devices, such as motors, by assigning a different instance data
block for each call for the different devices. Each instance DB stores the data (such as speed, ramp-up time,
and total operating time) for an individual device. In this example, FB 22 controls three separate devices, with
DB 201 storing the operational data for the first device, DB 202 storing the operational data for the second
device, and DB 203 storing the operational data for the third device.

Figure 7.17 – FB and instance DBs (Taken from: Siemens S7-1200 Programmable controller – System
Manual)

7.5.1 Reusable code blocks with associated memory

You typically use an FB to control the operation for tasks or devices that do not finish their operation within one
scan cycle. To store the operating parameters so that they can be quickly accessed from one scan to the next,
each FB in your user program has one or more instance DBs. When you call an FB, you also open an instance
DB that stores the values of the block parameters and the static local data for that call or "instance" of the FB.
These values are stored in the instance DB after the FB finishes.

- 70 - Version 1.0
Program Blocks
Function Block (FB)

7.5.2 Assigning the start value in the instance DB

You can assign start values to the parameters in the FB interface. These values are transferred to the associated
instance DB. If you do not assign parameters, the values currently stored in the instance DB will be used. In
some cases, you must assign parameters.

You can associate different instance DBs with different calls of the FB. The instance DBs allow you to use one
generic FB to control multiple devices. You structure your program by having one code block make a call to an
FB and an instance DB. The CPU then executes the program code in that FB and stores the block parameters
and the static local data in the instance DB. When the execution of the FB finishes, the CPU returns to the code
block that called the FB. The instance DB retains the values for that instance of the FB. By designing

the FB for generic control tasks, you can reuse the FB for multiple devices by selecting different instance DBs
for different calls of the FB.

Function Blocks (FBs) are blocks with cyclic data storage, in which values are permanently stored. The cyclic
data storage is realized in an instance DB.

Figure 7.18 – Calling a function block (from: Siemens Programming guideline v1.6)

Use function blocks to create subprograms and structure the user program. A function block can also be called
several times in different locations of the user program, making programming frequently recurring program
parts easier.

If function blocks are applied multiple times in the user program, use separate instances, preferably multi-
instances.

- 71 - Version 1.0
Program Blocks
Datablock (DB)

7.6 Datablock (DB)

Variable data is located in Data Blocks (DBs) that are available to the entire user program, as shown in Figure
7.19.

Figure 7.19 – Global DB as central data memory (from: Siemens Programming guideline v1.6)

The data stored in a DB is not deleted when the execution of the associated code block ends. There are two
types of DBs:

• A global DB stores data for the code blocks in your program. OB, FB, or FC can access the data in a
global DB.
• An instance DB stores the data for a specific FB. The data structure in an instance DB reflects the
parameters (Input, Output, and InOut) and the static data for the FB. The Temp memory for the FB is not
stored in the instance DB, see Section 7.5 on page 70 and Section 7.6.2 on page 73.

Although the instance DB reflects the data for a specific FB, any code block can access
the data in an instance DB.

7.6.1 Global DB
As already mentioned, the data stored in a global DB is accessible by any OB, FB or FC. In a DB, different data
types can be used, the native datatypes as mentioned in Chapter 10 as your own created datatypes, UDTs, as
described in Section 10.10 on page 116.

- 72 - Version 1.0
Program Blocks
Datablock (DB)

7.6.2 Instances
The call of a Function Block is called instance. The data with which the instance is working is saved in an
instance DB. Instance DBs are always created according to the specifications in the FB interface and can
therefore not be changed in the instance DB.

Figure 7.20 – Structure of the interface of an FB (Taken from: Siemens Programming guideline v1.6)

The instance DB consists of a permanent memory with input, output, InOut, and static interfaces. Temporary
tags are stored in a volatile memory (L stack). The L stack is always only valid for the current processing, so
temporary tags have to be initialised in each cycle.

Instance DBs are permanently assigned to an FB and must not be created manually. They are automatically
generated when calling an FB.

7.6.3 Multi-instances
With multi-instances, called function blocks can store their data in the instance data block of the called function
block. This means that if another function block is called in a function block, it saves its data in the instance DB
of the higher-level FBs. The functionality of the called block is thus maintained even when the calling block is
transferred. The following figure shows an FB that uses another FB ("IEC Timer”). All data is saved in a multi-
instance DB. It is thus possible to create a block with an independent time behaviour, such as a clock generator.

- 73 - Version 1.0
Program Blocks
Datablock (DB)

Figure 7.21 – Multi-instances (from: Siemens Programming guideline v1.6)

7.6.4 Optimized and standard data blocks

You can also configure data block access to optimise it. If the block is not optimised, it is considered a standard
data block. A standard DB is compatible with STEP 7 Classic programming tools and the classic S7‑300 and
S7‑400 CPUs. Data blocks with optimised access have no fixed defined structure. The data elements contain
only a symbolic name in the declaration and no fixed address within the block. The CPU stores the elements
automatically in the available memory area of the block so that there are no gaps in the memory. This makes
for optimal use of the memory capacity.

To set optimised access for a data block, follow these steps:

• Expand the program blocks folder in the STEP 7 project tree.

• Right-click the data block and select "Properties" from the context menu.
• For the attributes, select "Optimized block access".
Note that optimised block access is the default for new data blocks. If you deselect "Optimized block access",
the block uses standard access.

Block access type for an FB and its instance DB

Be sure that if your FB setting is "Optimized block access," the instance DB setting for
that FB is also "Optimized block access." Similarly, if you have not selected "Optimized
block access" for the FB such that the FB is of type standard access, then be sure that
the instance DB is also standard or not optimised block access.
If you do not have compatible block access types, changes to the FB's IN/OUT parameter
values from an HMI during execution could be lost.

- 74 - Version 1.0
Program Blocks
Creating reusable blocks

7.7 Creating reusable blocks

To create OBs, FBs, FCs, and global DBs, use the "Add new block" dialog under "Program blocks" in the Project
navigator.

When you create a code block, you select the programming language for the block. You do not select a language
for a DB because it only stores data.

Selecting the "Add new and open" check box (default) opens the code block in the Project view.

Figure 7.22 – Create blocks

You can store objects you want to reuse in libraries. For each project, there is a project library that is connected to the
project. In addition to the project library, you can create any number of global libraries that can be used over several
projects. Since the libraries are compatible with each other, library elements can be copied and moved from one
library to another.

Libraries are used, for example, to create templates for blocks that you first paste into the project library and then
further develop there. Finally, you copy the blocks from the project library to a global library. You make the global
library available to other colleagues working on your project. They use the blocks and further adapt them to their
individual requirements, where necessary.

For details about library operations, refer to the TIA Portal Information system.

- 75 - Version 1.0
Program Blocks
Creating reusable blocks

7.7.1 Passing parameters to blocks

Function Blocks (FB) and Functions (FC) have three different interface types:

• IN
• IN/OUT
• OUT
FBs and FCs receive parameters through the IN and IN/OUT interface types. The blocks process the parameters
and return values to the caller through the IN/OUT and OUT interface types.

The user program transfers parameters using one of two methods.

Call-by-value
When the user program passes a parameter to a function as "call-by-value", the user program copies the actual
parameter value into the input parameter of the block for the IN interface type. This operation requires additional
memory for the copied value.

Figure 7.23 – Call by value (Taken from: Siemens S7-1200 Programmable controller – System Manual)

When the user program calls the block, it copies the values.

Call-by-reference
When the user program passes a parameter to a function as "call-by-reference", the user program references the
address of the actual parameter for the IN/OUT interface type and does not copy the value. This operation does
not require additional memory.

Figure 7.24 – Call by reference (Taken from: Siemens S7-1200 Programmable controller – System
Manual)

When the user program calls the block, it references the address of the actual parameters.

Generally, use the IN/OUT interface type for structured tags (such as ARRAY, STRUCT,
and STRING) to avoid increasing the required data memory unnecessarily.

- 76 - Version 1.0
Program Blocks
Creating reusable blocks

7.7.2 EN and ENO for LAD, FBD and SCL

Determining "power flow" (EN and ENO) for an instruction

Certain instructions (such as the Math and the Move) provide EN and ENO parameters. These parameters relate
to power flow in LAD or FBD and determine whether the instruction is executed during that scan. SCL also allows
you to set the ENO parameter for a code block.

• EN (Enable In) is a Boolean input. Power flow (EN = 1) must be present at this input to execute the box
instruction. If the EN input of a LAD box is connected directly to the left power rail, the instruction will
always be executed.
• ENO (Enable Out) is a Boolean output. If the box has power flow at the EN input and the box executes
its function without error, then the ENO output passes power flow (ENO = 1) to the next element. If an
error is detected in the execution of the box instruction, power flow is terminated (ENO = 0) at the box
instruction that generated the error.
PROGRAM EDITOR INPUTS/OUTPUTS OPERANDS DATA TYPE
LAD EN, ENO Power flow Bool
FBD EN I, I:P, Q, M, DB, Temp, Power Flow Bool
ENO Power Flow Bool
SCL EN 1
TRUE, FALSE Bool
ENO2 TRUE, FALSE Bool
1
The use of EN is only available for FBs.
2
The use of ENO with the SCL code block is optional. You must configure the SCL compiler to set ENO
when the code block finishes.
Table 7.3 - Operands for EN and ENO (Taken from: Siemens S7-1200 Programmable controller – System Manual)

Configuring SCL to set ENO

To configure the SCL compiler for setting ENO, follow these steps:

1. Select the “Settings” command from the “Options” menu

2. Expand the “PLC programming” properties and select “SCL (Structured Control Language)”
3. Select the “Set ENO automatically” option

Using ENO in program code

You can also use ENO in your program code, for example, by assigning ENO to a PLC tag or by evaluating ENO
in a local block

Examples:
“MyFunction”
( IN1 := … ,
IN2 := … ,
OUT1 => #myOut,
ENO => #statusFlag ); // PLC tag statusFlag holds the value of ENO

- 77 - Version 1.0
Program Blocks
Creating reusable blocks

“MyFunction”
( IN1 := … ,
IN2 := … ,
OUT1 => #myOut,
ENO => ENO ); // block status flag of “MyFunction”
// is stored in the local block
IF ENO = TRUE THEN
// execute code only if MyFunction returns true ENO

Effect of Ret_Val or Status parameters on ENO

Some instructions, such as the communication instructions or the string conversion instructions, provide an
output parameter containing information about the instruction's processing. For example, some instructions
provide a Ret_Val (return value) parameter, typically an Int data type that contains status information ranging
from -32768 to +32767. Other instructions provide a Status parameter, which is usually a Word data type that
stores status information in a range of hexadecimal values from 16#0000 to 16#FFFF. The numerical value
stored in a Ret_Val or a Status parameter determines the state of ENO for that instruction.

• Ret_Val: A value from 0 to 32767 typically sets ENO = 1 (or TRUE). A value from ‑32768 to ‑1 typically sets
ENO = 0 (or FALSE). To evaluate Ret_Val, change the representation to hexadecimal.
• Status: A value from 16#0000 16#7FFF typically sets ENO = 1 (or TRUE). A value from 16#8000 to
16#FFFF typically sets ENO = 0 (or FALSE).
Instructions that take more than one scan to execute often provide a Busy parameter (Bool) to signal that the
instruction is active but has not completed execution. These instructions often also provide a Done parameter
(Bool) and an Error parameter (Bool). Done signals that the instruction was completed without error, and Error
signals that the instruction was completed with an error condition.

• When Busy = 1 (or TRUE), ENO = 1 (or TRUE).

• When Done = 1 (or TRUE), ENO = 1 (or TRUE).
• When Error = 1 (or TRUE), ENO = 0 (or FALSE).

- 78 - Version 1.0
Timers, Counters and Edges

8 Timers, Counters and Edges

Timers and counters are essential components used for managing, controlling, and tracking time-based and
repetitive events within industrial automation systems. Timers facilitate scheduling tasks, such as turning a
motor on or off after a set period or creating delays between operations. Counters track events, such as counting
items on a conveyor belt or the number of times an action occurs.

8.1 Timers
Timers and counters play an essential role in software. Timers can determine how long a process can last and
are used for time-controlled processing. There are various timers: Timer ON delay (TON), Timer OFF delay, and
pulsed timer (TP). Table 9.1 shows a small overview of timers that can be used within the TIA Portal.

Figure 8.1 – Different types timers

- 79 - Version 1.0
Timers, Counters and Edges
Timers

TIMER TIMING DIAGRAM

TP: Generate pulse

The TP timer generates a pulse with a preset time.

TON: Generate ON-delay

The TON timer sets output Q to ON after a preset

time delay.

TOF: Generate OFF-delay

The TOF-timer resets output Q to OFF after a

preset time delay.

TONR: Time accumulator

The TONR timer sets output Q to ON after a

preset time delay. Elapsed time is accumulated
over multiple timing periods until the R input is
used to reset the elapsed time.

Table 8.1 - Overview of Timers (Taken from S7-1200 Programmable controller System Manual)

- 80 - Version 1.0
Timers, Counters and Edges
Timers

8.1.1 Timer TON – Generate ON-delay

You can use the "Generate on-delay" instruction to delay the setting of the Q output by the programmed time PT.
The instruction is started when the result of the logic operation (RLO) at input IN changes from "0" to "1" (positive
signal edge). The programmed time PT begins when the instruction starts. When PT has elapsed, the output Q
has the signal state "1". Output Q remains set as long as the start input is still "1". When the signal state at the
start input changes from "1" to "0", the Q output is reset. The timer function is started again when a new positive
signal edge is detected at the start input.

The current time value can be queried at the ET output. The timer value starts at T#0s and ends when the value
of the time duration PT is reached. The ET output is reset as soon as the signal state at the IN input changes to
"0". If the instruction is not called in the program because it is skipped, the ET output returns a constant value
as soon as the time PT has expired.

The "Generate on-delay" instruction can be placed within or at the network's end. It requires a preceding logic
operation.

Each call of the "Generate on-delay" instruction must be assigned to an IEC timer in which the instance data is
stored.

PARAMETERS DECLARATION DATATYPE MEMORY AREA DESCRIPTION

IN Input BOOL I, Q, M,D, L or Start input
constant
PT Input TIME I, Q, M,D, L or Duration of the on-delay. The value of the PT
constant parameter must be positive.
Q Output BOOL I, Q, M, D, L, P Output that is set when the time PT expires.
ET Output BOOL TIME Current time value
Table 8.2 - Parameters of TON

Figure 8.2 – Timing diagram of TON timer

- 81 - Version 1.0
Timers, Counters and Edges
Timers

Example

Figure 8.3 – Timing diagram of TON timer

PARAMETER OPERAND VALUE

IN Tag_Start Signal transition “0” => “1”
PT Tag_PresetTime T#10s
Q Tag_Status FALSE; after 10 s => TRUE
ET Tag_ElapsedTime From T#0s => T#10s
Table 8.3 – Example values of TON

When the signal state of the "Tag_Start" operand changes from "0" to "1", the time programmed for the PT
parameter is started. When the time duration expires, the "Tag_Status" operand is set to the signal state "1". The
Tag_Status operand remains set to "1" as long as the Tag_Start operand has signal state "1". The current time
value is stored in the "Tag_ElapsedTime" operand. When the signal state at the operand "Tag_Start" changes
from "1" to "0", the "Tag_Status" operand is reset.

When you place timer instructions in an FB, you can select the "Multi-instance data block"
option.
The timer structure names can be different with separate data structures, but the timer
data is contained in a single data block and does not require a separate data block for
each timer. This reduces the processing time and data storage necessary for handling
the timers.
There is no interaction between the timer data structures in the shared multi-instance
DB.

- 82 - Version 1.0
Timers, Counters and Edges
Timers

8.1.2 Timer TOF – Generate OFF-delay

Using the programmed time PT, you can use the "Generate off-delay" instruction to reset the Q output. The Q
output is set when the result of the logic operation (RLO) at input IN changes from "0" to "1" (positive signal
edge). When the signal state at input IN changes back to "0" (negative signal edge), the programmed time PT
starts. Output Q remains set as long as the time duration PT is running. When the PT time duration expires, the
Q output is reset. The timer is reset if the signal state at input IN changes to "1" before the PT time duration
expires. The signal state at the output Q continues to be "1".

The current time value can be queried at the ET output. The timer value starts at T#0s and ends when the value
of the time duration PT is reached. When the PT time duration expires, the ET output remains set to the current
value until input IN returns to "1". If input IN switches to "1" before the duration PT has expired, the ET output is
reset to the value T#0s. If the instruction is not called in the program because it is skipped, for example, the ET
output returns a constant value as soon as the time has expired.

The "Generate off-delay" instruction can be placed within or at the network's end. It requires a preceding logic
operation.

Each call of the "Generate off-delay" instruction must be assigned to an IEC timer in which the instance data is
stored.

PARAMETERS DECLARATION DATATYPE MEMORY AREA DESCRIPTION

IN Input BOOL I, Q, M,D, L or Start input
constant
PT Input TIME I, Q, M,D, L or Duration of the off-delay. The value of the PT
constant parameter must be positive.
Q Output BOOL I, Q, M, D, L, P Output that is reset when the time PT expires.
ET Output BOOL I, Q, M, D, L, P Current time value
Table 8.4 - Parameters of TOF

Figure 8.4 – Timing diagram of TOF timer

- 83 - Version 1.0
Timers, Counters and Edges
Timers

Example

Figure 8.5 – Timing diagram of TOF timer

PARAMETER OPERAND VALUE

IN Tag_Start Signal transition “0” => “1”
PT Tag_PresetTime T#10s
Q Tag_Status TRUE; after 10s when IN changes from “1” to “0” FALSE
ET Tag_ElapsedTime From T#10s => T#0s
Table 8.5 – Example values of TOF

When the signal state of the operand "Tag_Start" changes from "0" to "1", the "Tag_Status" operand is set to
signal state "1". When the signal state of the "Tag_Start" operand changes from "1" to "0", the time programmed
for the PT parameter is started. As long as the time runs, the "Tag_Status" operand remains TRUE. When the
time has expired, the "Tag_Status" operand is reset to FALSE. The current time value is stored in the
"Tag_ElapsedTime" operand.

- 84 - Version 1.0
Timers, Counters and Edges
Timers

8.1.3 Timer TP – Generate pulse

You can use the "Generate pulse" instruction to set the Q output for a programmed duration. The instruction is
started when the result of the logic operation (RLO) at input IN changes from "0" to "1" (positive signal edge).
The programmed time PT begins when the instruction starts. Output Q is set for the duration of PT, regardless
of the subsequent course of the input signal. While PT is running, detecting a new positive signal edge at the IN
input does not influence the signal state at the Q output.

You can scan the current time value at the ET output. The timer value starts at T#0s and ends when the value
of the time duration PT is reached. When the time PT has elapsed and the signal state at input IN is "0", the ET
output is reset. If the instruction is not called in the program because it is skipped, the ET output returns a
constant value as soon as the time PT has expired.

The "Generate pulse" instruction can be placed within or at the network's end. It requires a preceding logic
operation.

Each call of the "Generate pulse" instruction must be assigned to an IEC timer where the instance data is stored.

PARAMETERS DECLARATION DATATYPE MEMORY AREA DESCRIPTION

IN Input BOOL I, Q, M,D, L or Start input
constant
PT Input TIME I, Q, M,D, L or Duration of the pulse. The value of PT
constant parameter must be positive.
Q Output BOOL I, Q, M, D, L, P Pulse output
ET Output TIME I, Q, M, D, L, P Current time value
Table 8.6 - Parameters of TOF

Figure 8.6 – Timing diagram of TP timer

Example

Figure 8.7 – Timing diagram of TP timer

- 85 - Version 1.0
Timers, Counters and Edges
Counters

PARAMETER OPERAND VALUE

IN Tag_Start Signal transition “0” => “1”
PT Tag_PresetTime T#10s
Q Tag_Status TRUE; after 10s when IN changes from “1” to “0” FALSE
ET Tag_ElapsedTime From T#10s => T#0s
Table 8.7 – Example values of TP

When the signal state of the operand "Tag_Start" changes from "0" to "1", the "Tag_Status" operand is set to
signal state "1". When the signal state of the "Tag_Start" operand changes from "1" to "0", the time programmed
for the PT parameter is started. The "Tag_Status" operand remains TRUE as long as the time runs. When the
time has expired, the "Tag_Status" operand is reset to FALSE. The current time value is stored in the
"Tag_ElapsedTime" operand.

8.2 Counters
Counters track and control repetitive events or operations within industrial automation systems. They facilitate
counting events, such as the number of items passing on a conveyor belt or the number of times a specific
action occurs. In the instruction set of a PLC, there are several types of counters, including up-counters, down-
counters, and up/down counters, each serving unique purposes depending on the application's requirements.

An overview of counters is shown in Table 8.8. In the following sections, these counters are described.

LAD / FBD SCL DESCRIPTION

“Counter name”.CTU( Use the counter instructions to count internal program
CU:=_bool_in, events and external process events. Each counter uses a
R:=_bool_in,
PV:=_in, structure stored in a data block to maintain counter data.
Q=>_bool_out, You assign the data block when the counter instruction is
CV=>_out); placed in the editor.

“Counter name”.CTD( CTU is a count-up counter

CD:=_bool_in, CTD is a count-down counter
LD:=_bool_in, CTUD is a count-up-and-down counter
PV:=_in,
Q=>_bool_out,
CV=>_out);

“Counter name”.CTUD(
CU:=_bool_in,
CD:=_bool_in,
R:=_bool_in,
LD:=_bool_in,
PV:=_in,
QU=>_bool_out,
QD=>_bool_out,
CV=>_out);
Table 8.8 - Overview of counters

- 86 - Version 1.0
Timers, Counters and Edges
Counters

8.2.1 Count up counter

A CTU counter, also called a count up counter is an instruction that counts up with each “0” to “1” transition of
the count up (CU) parameter. When the count value parameter (CV) reaches the preset value (PV), the output
parameter (Q) transitions “0” to “1”. CV continues to increment with each “0” to “1” transition of CU until the high
limit of the data type selected is reached.

You can query the counter status in the Q output. The PV parameter determines the signal state at the Q output.
If the current counter value is greater than or equal to the value of the PV parameter, the Q output is set to signal
state "1". In all other cases, the Q output has a signal state of "0".

When the reset parameter (R) transitions from “0” to “1”, CV and Q are reset to “0”.

COUNTER OPERATION
The CTU counter counts up by 1 when the
value of parameter CU changes from 0 to 1.
The CTU timing diagram shows the operation
for an unsigned integer count value (where PV
= 3).
• If the value of parameter CV (current
count value) is greater than or equal to
the value of parameter PV (preset count
value), then the counter output
parameters Q = 1.
• If the value of the reset parameter R
changes from 0 to 1, then the current
count value is reset to 0.
Table 8.9 – Operation of the Count Up Counter

PARAMETERS DECLARATION DATATYPE MEMORY AREA DESCRIPTION

CU Input BOOL I, Q, M, D, L Count up input
R Input BOOL I, Q, M, D, L, P Reset input
PV Input INT I, Q, M, D, L, P Value at which the Q output is set
Q Output BOOL I, Q, M, D, L Counter status
CV Output INT I, Q, M, D, L, P Current counter value
Table 8.10 - Parameters of CTU

- 87 - Version 1.0
Timers, Counters and Edges
Counters

8.2.2 Count down counter

A CTD counter, also called a count down counter, is an instruction that counts down with each 0 to 1 transition
of the count down parameter (CD). When the LOAD parameter transitions from 0 to 1, the count value parameter
(CV) is set equal to the preset value (PV), and the output parameter (Q) is reset to 0. Each 0 to 1 transition of
CD decrements CV by 1. When CV reaches 0, Q is set to 1. CV continues to decrement by 1 with each 0 to 1
transition of CD until the low limit of the data type is reached.

You can query the counter status in the Q output. If the current counter value is less than or equal to zero, the Q
output is set to signal state "1". In all other cases, it has a signal state of "0".

COUNTER OPERATION
The CTD counter counts down by 1 when the value of
parameter CD changes from 0 to 1. The CTD timing
diagram shows the operation for an unsigned integer
count value (where PV = 3).
• If the value of parameter CV (current count value) is
equal to or less than 0, the counter output
parameter Q = 1.
• • If the value of parameter LOAD changes from 0 to
1, the value at parameter PV (preset value) is loaded
to the counter as the new CV (current count value).
Table 8.11 – Operation of the Count Down Counter

PARAMETERS DECLARATION DATATYPE MEMORY AREA DESCRIPTION

CD Input BOOL I, Q, M, D, L Count down input
LD Input BOOL I, Q, M, D, L, P Load input
PV Input INT I, Q, M, D, L, P Value to which the CV output is set with
LD = 1
Q Output BOOL I, Q, M, D, L Counter status
CV Output INT I, Q, M, D, L, P Current counter value
Table 8.12 - Parameters of CTD

- 88 - Version 1.0
Timers, Counters and Edges
Counters

8.2.3 Count up and down counter

A CTUD counter also called a count up and down counter, is an instruction that counts up with each 0 to 1
transition of the count up parameter (CU) and counts down with each 0 to 1 transition of the count down
parameter (CD). If both CU and CD transition from 0 to 1 at the same time, the count does not change.

The current value of the count is available at the count value parameter (CV). The maximum and minimum
values of CV and the present value parameter (PV) are determined by the data type selected for the counter.

A 0 to 1 transition of the LOAD parameter sets CV equal to PV. A 0 to 1 transition of the reset parameter (R)
resets CV to 0. QU is equal to 1 if CV is greater than or equal to PV. QD is equal to 1 if CV is less than or equal
to 0.

COUNTER OPERATION
The CTUD counter counts up or down by 1 on the 0
to 1 transition of the count up (CU) or count down
(CD) inputs. The CTUD timing diagram shows the
operation for an unsigned integer count value
(where PV = 4).
• If the value of parameter CV is equal to or
greater than the value of parameter PV,
then the counter-output parameter QU = 1.
• If the value of parameter CV is less than or
equal to zero, then the counter output
parameter QD = 1.
• If the value of parameter LOAD changes
from 0 to 1, then the value of parameter PV
is loaded to the counter as the new CV.
• If the value of the reset parameter R
changes from 0 to 1, the current count value
is reset to 0.
Table 8.13 – Operation of the Count Up and Down Counter

PARAMETERS DECLARATION DATATYPE MEMORY AREA DESCRIPTION

CU Input BOOL I, Q, M, D, L or Count up input
constant
CD Input BOOL I, Q, M, D, L or Count down input
constant
R Input BOOL I, Q, M, D, L, P Reset input
or constant
LD Input BOOL I, Q, M, D, L, P Load input
or constant
PV Input INT I, Q, M, D, L, P Value at which the QU output is set or value
or constant to which the CV output is set with LD = 1
QU Output BOOL I, Q, M, D, L Count Up counter status
QD Output BOOL I, Q, M, D, L Count Down counter status
CV Output INT I, Q, M, D, L, P Current counter value
Table 8.14 - Parameters of CTUD

The counter value can be incremented until it reaches the high data type limit specified at the CV output. When
the high limit is reached, the counter value is no longer incremented on a positive signal edge. The counter value
is no longer decremented once the low limit of the specified data type has been reached.

When the signal state at the LD input changes to "1", the counter value at the CV output is set to the value of the
PV parameter. As long as the LD input has signal state "1", the signal state at the CU and CD inputs has no effect
on the instruction.

- 89 - Version 1.0
Timers, Counters and Edges
Counters

The counter value is set to zero when the signal state at the R input changes to "1". As long as the R input has
signal state "1", a change in the signal state of the CU, CD and LD inputs has no effect on the "Count up and
down" instruction.

You can query the status of the up counter using the QU output. If the current counter value is greater than or
equal to the value of the PV parameter, the QU output is set to signal state "1". In all other cases, the QU output
has a signal state of "0".

You can query the status of the down counter using the QD output. If the current counter value is less than or
equal to zero, the QD output is set to signal state "1." In all other cases, it has a signal state of "0".

- 90 - Version 1.0
Timers, Counters and Edges
Clock and system memories

8.3 Clock and system memories

You use the CPU properties to enable bytes for "system memory" and "clock memory". Your program logic can
reference the individual bits of these functions by their tag names.

• You can assign one byte in M memory for system memory. The byte of system memory provides the
following four bits that your user program can reference by the following tag names:
o First cycle: (Tag name "FirstScan") bit is set to 1 for the duration of the first scan after the
startup OB finishes. (After executing the first scan, the "first scan" bit is set to 0.)
o Diagnostics status changed: (Tag name: "DiagStatusUpdate") is set to 1 for one scan after the
CPU logs a diagnostic event. Because the CPU does not set the "DiagStatusUpdate" bit until the
end of the first execution of the program cycle OBs, your user program cannot detect if there
has been a diagnostic change either during the execution of the startup OBs or the first
execution of the program cycle OBs.
o Always 1 (high): (Tag name "AlwaysTRUE") bit is always set to 1.
o Always 0 (low): (Tag name "AlwaysFALSE") bit is always set to 0.
• You can assign one byte in M memory for clock memory. Each bit of the byte configured as clock
memory generates a square wave pulse. The clock memory byte provides 8 different frequencies, from
0.5 Hz (slow) to 10 Hz (fast). You can use these bits as control bits, especially when combined with
edge instructions, to trigger actions in the user program on a cyclic basis.

The CPU initialises these bytes when transitioning from STOP to STARTUP mode. The bits of the clock memory
change synchronously to the CPU clock throughout the STARTUP and RUN modes.

Risks with overwriting the system memory or clock memory bits Overwriting the system
memory or clock memory bits can corrupt the data in these functions and cause your
user program to operate incorrectly, which can damage equipment and injure personnel.
Because the clock and system memory are unreserved in M memory, instructions or
communications can be written to these locations and corrupt the data.
To ensure the proper operation of these functions, avoid writing data to these locations,
and always implement an emergency stop circuit for your process or machine.

The clock memory can be set through the hardware configuration of the PLC: Device configuration -> Device
view -> properties -> System and clock memory.

The clock memory configures a byte that cycles the individual bits on and off at fixed intervals. Each clock bit
generates a square wave pulse on the corresponding M memory bit. These bits can be used as control bits,
especially when combined with edge instructions, to trigger actions in the user code on a cyclic basis.

- 91 - Version 1.0
Timers, Counters and Edges
Clock and system memories

Figure 8.8 – Clock memory

BIT NUMBER 7 6 5 4 3 2 1 0
Period (s) 2.0 1.6 1.0 0.8 0.5 0.4 0.2 0.1
Frequency 0.5 0.625 1 1.25 2 2.5 5 10
(Hz)
Table 8.15 - Clock memory

Always recompile and download the hardware when activating or changing the clock's
or system memory's properties.

The system memory configures a byte with bits that turn on (value = 1) for a specific event.

Figure 8.9 – System memory

7 6 5 4 3 2 1 0
Reserved Always OFF Always Diagnostic status First scan indicator
Value 0 Value 0 ON indicator 1: First scan after startup
Value 1 1: Change 0: Not first scan
0: No change
Table 8.16 - System memory

- 92 - Version 1.0
Timers, Counters and Edges
Rising and Falling edges

8.4 Rising and Falling edges

Edge detection is used to detect transitions or changes in the state of a signal. Edges are used to detect if a
particular event occurs, such as a sensor detecting the presence of an object. This detection can then trigger
subsequent actions in the program.

For example:

Consider a conveyor belt system where objects need to be counted as they pass by a photoelectric sensor. A
Rising Edge Detection function can be used to detect the moment an object breaks the beam of the sensor,
ensuring that each object is counted once as it passes.

Table 8.17 shows an overview of edge detection in LAD and FBD. These specific functions are not available
within SCL, you have to write code to replicate this function within your application.

LAD FBD DESCRIPTION

Scan operand for positive signal edge.
LAD: The state of this contact is TRUE when a positive transition (OFF-to- ON) is
detected on the assigned "IN" bit. The contact logic state is then combined with the
power flow in state to set the power flow out state. The P contact can be located
anywhere in the network except the end of a branch.
FBD: The output logic state is TRUE when a positive transition (OFF-to-ON) is detected
on the assigned input bit. The P box can only be located at the beginning of a branch.

Scan operand for negative signal edge.

LAD: The state of this contact is TRUE when a negative transition (ON-to- OFF) is
detected on the assigned input bit. The contact logic state is then combined with the
power flow in state to set the power flow out state. The N contact can be located
anywhere in the network except the end of a branch.
FBD: The output logic state is TRUE when a negative transition (ON-to- OFF) is detected
on the assigned input bit. The N box can only be located at the beginning of a branch.
Set operand on positve signal edge.
LAD: The assigned bit "OUT" is TRUE when a positive transition (OFF-to- ON) is detected
on the power flow entering the coil. The power flow in state always passes through the
coil as the power flow out state. The P coil can be located anywhere in the network.
FBD: The assigned bit "OUT" is TRUE when a positive transition (OFF-to- ON) is detected
on the logic state at the box input connection or on the input bit assignment if the box
is located at the start of a branch. The input logic state always passes through the box
as the output logic state. The P= box can be located anywhere in the branch.
Set operand on negative signal edge.
LAD: The assigned bit "OUT" is TRUE when a negative transition (ON-to- OFF) is
detected on the power flow entering the coil. The power flow in state always passes
through the coil as the power flow out state. The N coil can be located anywhere in the
network.
FBD: The assigned bit "OUT" is TRUE when a negative transition (ON-to- OFF) is
detected on the logic state at the box input connection or on the input bit assignment
if the box is located at the start of a branch. The input logic state always passes through
the box as the output logic state. The N= box can be located anywhere in the branch.
Table 8.17 - Positive and negative transition detection (From: S7-1200 programmable controller system manual)

- 93 - Version 1.0
Timers, Counters and Edges
Rising and Falling edges

LAD / FBD DESCRIPTION

Scan RLO (the result of logic operation) for positive signal edge.
The Q output power flow or logic state is TRUE when a positive transition (OFF-to-ON) is
detected on the CLK input state (FBD) or CLK power flow in (LAD).
In LAD, the P_TRIG instruction cannot be located at the beginning or end of a network. In
FBD, the P_TRIG instruction can be located anywhere except the end of a branch.
Scan RLO for a negative signal edge.
The Q output power flow or logic state is TRUE when a negative transition (ON-to-OFF) is
detected on the CLK input state (FBD) or CLK power flow in (LAD).
In LAD, the N_TRIG instruction cannot be located at the beginning or end of a network. In
FBD, the N_TRIG instruction can be located anywhere except the end of a branch.
Table 8.18 - P_TRIG and N_TRIG instructions (From: S7-1200 programmable controller system manual)

LAD / FBD SCL DESCRIPTION

"R_TRIG_DB"( Set tag on positive signal edge.
CLK:=_in_, The assigned instance DB stores the previous state of the CLK
Q=> _bool_out_); input. The Q output power flow or logic state is TRUE when a
positive transition (OFF-to-ON) is detected on the CLK input state
(FBD) or CLK power flow in (LAD).
In LAD, the R_TRIG instruction cannot be located at the beginning
or end of a network. In FBD, the R_TRIG instruction can be located
anywhere except the end of a branch.
"F_TRIG_DB"( Set tag on negative signal edge.
CLK:=_in_, The assigned instance DB stores the previous state of the CLK
Q=> _bool_out_); input. The Q output power flow or logic state is TRUE when a
negative transition (ON-to-OFF) is detected on the CLK input state
(FBD) or CLK power flow in (LAD).
In LAD, the F_TRIG instruction cannot be located at the beginning
or end of a network. In FBD, the F_TRIG instruction can be located
anywhere except the end of a branch.
Table 8.19 - R_TRIG and F_TRIG instructions (From: S7-1200 programmable controller system manual)

For R_TRIG and F_TRIG, when you insert the instruction in the program, the "Call options" dialog opens
automatically. In this dialog, you can assign whether the edge memory bit is stored in its own data block (single
instance) or as a local tag (multiple instance) in the block interface. If you create a separate data block, you will
find it in the project tree in the "Program resources" folder under "Program blocks > System blocks".

PARAMETER DATA TYPE DESCRIPTION

M_BIT Bool Memory bit in which the previous state of the input is saved
IN Bool Input bit whose transition edge is detected
OUT Bool Output bit, which indicates a transition edge, was detected
CLK Bool Power flow or input bit whose transition edge is detected
Q Bool Output which indicates an edge was detected
Table 8.20 - Data types for the parameters

All edge instructions use a memory bit (M_BIT: P/N contacts/coils, P_TRIG/N_TRIG) or (instance DB bit: R_TRIG,
F_TRIG) to store the previous state of the monitored input signal. An edge is detected by comparing the input
state with the previous state. If the states indicate a change of the input in the direction of interest, then an edge
is reported by writing the output TRUE. Otherwise, the output is written to FALSE.

- 94 - Version 1.0
Timers, Counters and Edges
Rising and Falling edges

Edge instructions evaluate the input and memory-bit values each time they are executed,
including the first execution. You must account for the initial states of the input and
memory bit in your program design either to allow or to avoid edge detection on the first
scan.
Because the memory bit must be maintained from one execution to the next, you should
use a unique bit for each edge instruction and not use this bit anywhere else in your
program. It would be best if you also avoided temporary memory and memory that can
be affected by other system functions, such as an I/O update. Use only M, global DB, or
static memory (in an instance DB) for M_BIT memory assignments.

- 95 - Version 1.0
Analogue signals

9 Analogue signals
In contrast to a binary signal, which can assume only two signal states (“Voltage present +24V” and “Voltage
not present 0V”), analogue signals can take any value within a defined range. A typical example of an analogue
sensor is a potentiometer. Depending on the position of the knob, any resistance can be set up to the maximum
value.

Examples of analogue quantities are:

• Temperature -50 to +150ºC

• Flow rate 0 to 200 l/min
• Speed -500 to +50 rpm
• Etc.

9.1 Measuring transducers

These quantities are converted to electrical voltages, currents or resistances with the help of a measuring
transducer. If, for example, a speed is to be measured, the speed range of 500 to 1500 rpm can be converted to
a voltage range of 0 to +10 V using a measuring transducer. At a measured speed of 865 rpm, the measuring
transducer would output a voltage value of +3.65 V.

Figure 9.1 – Analog signal example 0 ... + 10V

- 96 - Version 1.0
Analogue signals
Analogue modules – A/D converter

9.2 Analogue modules – A/D converter

These electrical voltages, currents or resistances are then connected to an analogue module that digitises this
signal for further processing in the PLC.

If analogue quantities are processed with a PLC, the read-in voltage, current or resistance value must be
converted to digital information. The analogue value is converted to a bit pattern. This conversion is referred to
as analog-to-digital conversion (A/D conversion). This means, for example, that the voltage value of 3.65 V is
stored as information in a series of binary digits.

The result of this conversion is always a 16-bit word for SIMATIC products. The integrated ADC (analog-to-digital
converter) of the analogue input, the module digitises the analogue signal being acquired and approximates its
value as a stepped curve. The most important parameters of an ADC are its resolution and conversion rate.

Figure 9.2 – Analog signal converted to digital signal

Transmitting analogue signals is done in several ways. The two most used methods are Current-Based and
voltage-based transmitting.

- 97 - Version 1.0
Analogue signals
Analogue modules – A/D converter

9.2.1 Current based

The 4-20 mA analogue signal is a widely used standard in Industrial Automation and Control Systems for
transmitting sensor information over long distances with high accuracy and noise immunity. The principle
involves converting a physical parameter, such as temperature, pressure, or flow, into a corresponding current
signal ranging from 4 mA to 20 mA. The 4 mA value represents the minimum (0%) value, and the 20 mA value
represents the maximum (100%) value.

This range provides several key advantages. The 4 mA baseline allows for detecting circuit issues, such as wire
breaks or disconnections, which would result in a 0 mA signal. This diagnostic feature is critical for maintaining
system reliability. Additionally, current signals are less susceptible to signal degradation and electromagnetic
interference over long cable runs than voltage signals, ensuring accurate data transmission. Using a current
loop also enables multiple devices, such as sensors and controllers, to be connected in series without
significant signal loss, simplifying the wiring and reducing installation costs.

A sensor or transmitter converts the physical parameter into a corresponding 4-20 mA current in practical
applications. The receiving device, typically a PLC, then interprets this current into a meaningful measurement.
For example, in a temperature control system, a temperature sensor might convert a temperature range of 0°C
to 100°C into a 4-20 mA signal. The PLC receives this signal and, based on its programming, can then display
the temperature, log the data, or adjust control outputs to maintain the desired temperature setpoint. This
reliable and straightforward method of analogue signal transmission is foundational in modern industrial
control systems.

• 4-20 mA: This is industrial automation's most commonly used current signal. It provides a range where
4 mA represents the minimum value and 20 mA represents the maximum value. The 4 mA lower limit
allows for detecting wire breaks (which would result in 0 mA).
• 0-20 mA: Less common, but still used in some applications, where 0 mA represents the minimum value
and 20 mA represents the maximum value.

9.2.2 Voltage based

The 0-10V analogue signal is another common standard to represent variable physical parameters like
temperature, pressure, or flow. This method converts the physical parameter into a corresponding voltage signal
ranging from 0 volts (representing the minimum measurable value, or 0%) to 10 volts (representing the
maximum measurable value, or 100%).

This voltage range allows for straightforward interpretation by receiving devices like a PLC. One of the main
advantages of the 0-10V signal is its simplicity and ease of use, especially in short-distance signal transmission
where electromagnetic interference is minimal. Additionally, because voltage signals are common in many
sensors and control devices, the 0-10V range is widely supported and integrated into various equipment, making
it a versatile choice for many applications.

In practical applications, a sensor or transmitter outputs a voltage proportional to the measured parameter. For
instance, in a lighting control system, a light sensor might output a 0-10V signal corresponding to ambient light
levels. The PLC receives this voltage signal and adjusts the lighting intensity accordingly. For example, 0V might
represent complete darkness, while 10V represents full sunlight. The controller can then use this information to
dim or brighten lights to maintain the desired lighting conditions.

While voltage signals are more susceptible to signal degradation and noise over long distances than current
signals, they remain a popular choice for many applications due to their simplicity and direct correlation
between the measured parameter and the voltage output.

- 98 - Version 1.0
Analogue signals
Analogue modules – A/D converter

• 0-10 V: A common voltage signal range used in PLCs where 0 V represents the minimum value and 10
V represents the maximum value.
• 1-5 V: Used in some applications where 1 V represents the minimum value and 5 V represents the
maximum value.
• 0-5 V: Another voltage signal range used, especially in older or simpler systems.

9.2.3 Comparison
The 0-10V signals are straightforward and easy to interpret, as the voltage directly correlates with the measured
parameter. This simplicity makes it easier for technicians and engineers to design, install, and troubleshoot
systems.

The 4-20mA analogue signal is better suited for long-distance transmission due to its superior noise immunity,
minimal signal loss over distance, and built-in diagnostic capabilities. These advantages make 4-20mA the
preferred choice in industrial environments where sensors and controllers are often spread out over large areas,
and maintaining signal integrity and system reliability is crucial.

- 99 - Version 1.0
Analogue signals
Configuring analogue modules in the PLC

9.3 Configuring analogue modules in the PLC

PLCs can be equipped with analogue inputs and outputs or added afterwards with separate modules. Figure
9.3 shows the drag-and-drop action.

Figure 9.3 – Select and add an analogue module

Select the analogue module (6ES7 231-5ND32-0XB0) from the hardware catalogues and drag-and-drop it to its
physical position in the PLC setup.

Figure 9.4 – Properties of an analogue input module

- 100 - Version 1.0

Analogue signals
Configuring analogue modules in the PLC

As mentioned in Section 9.2, analogue signals come in different ‘formats’. The settings of the hardware module
must accommodate these, as shown in Figure 9.4.

The smoothing parameter reduces noise and fluctuations in the analogue signal. Setting the smoothing
parameter to None results in the real-time value being read from the input. While setting the parameter to Strong,
the analogue value will be averaged over 32 PLC cycles, creating a more stable value. Typically, the parameter
is set to Weak.

Each analogue value (“channel”) occupies one input or output word. The format in ‘Int’, an integer. The
addressing of input and output words conforms to the addressing in the device overview. For example:

Figure 9.5 – Addressing analogue I/O

Here, the address of the first analogue input would be %IW64, and the second analogue input would be %IW66.
The addresses of the two analogue outputs would be %QW64 and %QW66.

The analogue value transformation for further processing in the PLC is the same for analogue inputs and
outputs. The digitised value ranges are as shown in Figure 9.6.

Figure 9.6 – Digitising analogue values

These digitised values must often be normalised by further processing them in the PLC appropriately, so their
value is transformed into a meaningful value like, for example, -30 ºC – 100 ºC or 0 to 12500 litres.

This transformation is done with the PLC instructions NORM_X and SCALE_X. They can be found in the
Instruction Library under Conversion operations in the set Basic Instructions, as shown in Figure 9.7

- 101 - Version 1.0

Analogue signals
Scaling with NORM_X and SCALE_X

Figure 9.7 – SCALE_X and NORM_X instruction

9.4 Scaling with NORM_X and SCALE_X

NORM_X

NORM_X scales the input signal “Value” with parameters-assignable data type and value range –
parameterizable through the input parameters “MIN” and “MAX” – to the norm signal 0.0 … 1.0 output at the
output OUT.

SCALE_X

SCALE_X maps the norm signal with a value range of 0.0 … 1.0 at the input “Value” to the value range
parameterizable through the inputs MIN and MAX. The value scaled in such a way is output at output “OUT”(MIN
<= OUT <= MAX).

- 102 - Version 1.0

Analogue signals
Scaling with NORM_X and SCALE_X

Figure 9.8 – SCALE_X and NORM_X instruction explained

By combining these instructions, any value ranges can be mapped or scaled on other value ranges.

SYSTEM VOLTAGE MEASURING RANGE

DECIMAL HEXADECIMAL 0 TO 10V
32767 7FFF 11.851 V Overflow
32512 7F00
32511 7EFF 11.759 V Overshoot range
27649 6C01
27648 6C00 10 V Rated range
20736 5100 7.5V
34 22 12 mV
0 0 0V
Negative values Negative values are not
supported
Table 9.1 - Analog input representation for voltage (CPU 1215C and CPU 1217C) (Taken from: S7-1200 Easy Book, page 397)

- 103 - Version 1.0

Data Types

10 Data Types
Data types are used to specify both the size of a data element and how the data are to be interpreted. Each
instruction parameter supports at least one data type, while some support multiple data types. Hold the cursor
over the parameter field of an instruction to see which data types are supported for a given parameter.

10.1 Introduction
A formal parameter is an identifier on an instruction that marks the location of data to be used by that instruction
(for example, the IN1 input of an ADD instruction). An actual parameter is the memory location (preceded by a
"%" character) or constant containing the data to be used by the instruction (example %MD400
"Number_of_Widgets"). The data type of the actual parameter you specified must match one of the supported
data types of the formal parameter specified by the instruction.

When specifying an actual parameter, you must specify either a tag (symbol) or an absolute (direct) memory
address. Tags associate a symbolic name (tag name) with a data type, memory area, memory offset, and
comment and can be created either in the PLC tags editor or in the Interface editor for a block (OB, FC, FB and
DB). If you enter an absolute address that has no associated tag, you must use an appropriate size that matches
a supported data type, and a default tag will be created upon entry.

All data types except String, Struct, Array, and DTL are available in the PLC tags editor and the block Interface
editors. String, Struct, Array, and DTL are available only in the block Interface editors. You can also enter a
constant value for many of the input parameters.

Table 10.1 shows the data types supported by the S7-1200 Series PLC.

- 104 - Version 1.0

Data Types
Introduction

DATA TYPES DESCRIPTION

Bit and bit-sequence data Bool is a Boolean or bit value.
types Byte is an 8-bit byte value.
Word is a 16-bit value.
DWord is a 32-bit double-word value.

Integer data types USInt (unsigned 8-bit integer) and Sint (signed 8-bit integer) are “short” integers
(8 bits or 1 byte of memory) that can be signed or unsigned.

UInt (unsigned 16-bit integer) and Int (signed 16-bit integer) are integers (16 bits
or 1 word of memory that can be signed or unsigned.

UDInt (unsigned 32-bit integer) and Dint (signed 32-bit integer) are double
integers (32 bits or 1 double-word of memory) that can be signed or unsigned.

Real number data types Real is a 32-bit Real number or floating-point value.
LReal is a 64-bit Real number or floating-point value.

Date and time data types Date is a 16-bit date value (similar to UInt) that contains the number of days since
January 1, 1990. The maximum value is 65378 (16#FF62), which corresponds to
December 31, 2168. All possible Date values are valid.

DTL (date and time long) is a structure of 12 bytes that saves information on date
and time in a predefined structure:
Year (UInt): 1970 to 2554
Month (USInt): 1 to 12
Day (USInt): 1 to 31
Weekday (USInt): 1 (Sunday) to 7 (Saturday)
Hours (USInt): 0 to 23
Minutes (USInt): 0 to 59
Seconds (USInt): 0 to 59
Nanoseconds (UDInt) 0 to 999,999,999

Time is a 32-bit IEC time value (similar to a Dint) that stores the number of
milliseconds (from 0 to 24 days, 20 hours, 31 minutes, 23 seconds and 647ms). All
possible Time values are valid. Time values can be used for calculations, and
negative times are possible.

TOD (time of day) is a 32-bit time-of-day value (similar to Dint) that contains the
number of milliseconds since midnight (from 0 to 89,399,999).

Character and string data Char is an 8-bit single character.

types
String is a variable-length string up to 254 characters.

Array and structure data types Array contains multiple elements of the same data type. Arrays can be created in
the block interface editors for OB, FC, FB, and DB. You cannot create an array in
the PLC tags editor.

Struct defines a data structure consisting of other data types. It can be used to
handle a group of related process data as a single data unit. You declare the name
and internal data structure for the Struct data type in the data block editor of a
block interface editor.

Arrays and structures can also be assembled into a larger structure, which can be
nested up to eight levels deep. For example, you can create a structure of
structures that contain arrays.

- 105 - Version 1.0

Data Types
Introduction

PLC data types A PLC Data type is a user-defined data structure that defines a custom data
structure that you can use multiple times in your program. When you create a PLC
Data type, the new type appears in the data type selector drop-down lists in the
DB editor and code block interface editor.
PLC Data type can be used directly as a data type in a code block interface or in
data blocks.
PLC Data types can be used as a template for creating multiple global data blocks
using the same data structure.
Pointer data types Pointer provides an indirect reference to the address of a tag. It occupies 6 bytes
(48 bits) in memory. It can include the following information to a variable: DB
number (or 0 if the data is not stored in a DB), memory area in the CPU, and the
memory address.

Any provides an indirect reference to the beginning of a data area and identifies
its length. The Any pointer uses 10 bytes in memory and can include the following
information: Data type of the data elements, number of data elements, memory
area or DB number, and the “Byte.Bit” starting of the data.

Variant provides an indirect reference to different data types or parameters tags.

The Variant pointer recognizes structures and individual structural components.
The Variant does not occupy any space in memory.
Table 10.1 - Datatypes in the S7-1200 (Taken from the S7-1200 Easy Book)

Although not available as data types, the following BCD (binary coded decimal) numeric formats are supported
by the conversion instructions:

• BCD16 is a 16-bit value (-999 to 999)

• BCD32 is a 32-bit value (-9,999,999 to 9,999,999)

Complex Data Types

Complex data types contain data structures that can be made up of elementary and/or complex data types.
Complex data types can be used to declare variables only in global data blocks and within blocks for the
declaration of local variables (TEMP, STAT) as well as parameters (IN, OUT and INOUT).

PLC Data Types

The user defines data types that serve as templates for declaring parameters and variables of complex data
types (such as structure variables). UDTs are created with the Data Block editor and contain a data structure
that is made up of elementary and/or complex data types. In the declaration of a variable according to the type
UDTx, a structure variable whose inner data structure is defined by UDTx is created. UDTs can be used to declare
variables in global data blocks and within blocks for the declaration of local variables (TEMP, STAT) as well as
parameters (IN, OUT and INOUT).

When generating data blocks, you can designate PLC data types as a type. You can create several data blocks
based on this type, all of which have the same data structure. These data blocks can be customized by changing
the actual values for the appropriate task. Creating a PLC data type for a lubricating plant depot, for example.
This data type can subsequently be assigned to many data blocks, each containing a different quantity of data.

- 106 - Version 1.0

Data Types
Bool, Byte, Word and DWord data types

10.2 Bool, Byte, Word and DWord data types

DATA BIT NUMBER TYPE NUMBER RANGE CONSTANT EXAMPLES ADDRESS
TYPE SIZE EXAMPLES
Bool 1 Boolean FALSE or TRUE TRUE I 1.0
Binary 2#0 or 2#1 2#0 Q 0.1
Unsigned 0 or 1 1 M50.7
integer DB1.DBX2.3
Octal 8#0 or 8#1 8#1 Tag_name
Hexadecimal 16#0 or 16#1 16#1
Byte 8 Binary 2#0 to 2#1111_111 2#1000_1001 IB2
Unsigned 0 to 255 15 MB10
integer DB1.DBB4
Signed -128 to 127 -63 Tag_name
integer
Octal 8#0 to 8#377 8#17
Hexadecimal B#16#00 to B#16FF, B#16#F
16#00 to 16#FF 16#F
Word 16 Binary 2#0 to 2#1111_1111 2#1101_0010 MW10
_1111_1111 _1001_0110 DB1.DBW2
Unsigned 0 to 65535 61680 Tag_name
integer
Signed -32768 to 32767 72
integer
Octal 8#0 to 8#177_777 8#170_362
Hexadecimal W#16#0 to W#16FF, W#16#F1C0
16#0 to 16#FFFF 16#A67B
DWord 32 Binary 2#0 to 2#1101_0100_1111 MD10
2#1111_1111_1111 _1110_1000_1100 DB1.DBD8
_1111_1111_1111 Tag_name
_1111_1111
Unsigned 0 to 4,294,967,295 15,793,935
integer
Signed -2,147,483,648 to -400,000
integer 2,147,483,647
Octal 8#0 to 8#74_177_417
8#37_777_777_777
Hexadecimal DW#16#0000_0000 to DW#20_F30A
DW16#FFFF_FFFF, 16#B_01F6
16#0000_0000 to
16#FFFF_FFFF
Table 10.2 – Bool, Byte, Word and DWord values (Taken from the S7-1200 Programmable Controller System Manual)

- 107 - Version 1.0

Data Types
Floating-point real data types

10.3 Integer data types

DATA BIT SIZE NUMBER RANGE CONSTANT ADDRESS EXAMPLES
TYPE EXAMPLES
USInt 8 0 to 255 79 MB0
2#01001110 DB1.DBB4
SInt -128 to 127 +50 Tag_name
16#50
UInt 16 0 to 65,535 65,295, 0 MW2
Int -32,768 to 30,000 DB1.DBW2
32,767 +30,000 Tag_name
UDInt 32 0 to 4,294,967,295 4,042,322,160 MD6
DInt -2,147,483,648 to -2,131,754,992 DB1.DBD8
2,147,483,647 Tag_name
Table 10.3 - Integer data types (U = unsigned, S = short, D = double) (Taken from S7-1200 Programmable controller System
Manual)

10.4 Floating-point real data types

Real (or floating-point) numbers are represented as 32-bit single-precision numbers (Real) or 64-bit double-
precision numbers (LReal) as described in the ANSI/IEEE 754-1985 standard. Single-precision floating-point
numbers are accurate up to 6 significant digits, and double precision floating point numbers are accurate up to
15 significant digits. You can specify a maximum of 6 significant digits (Real) or 15 (LReal) when entering a
floating-point constant to maintain precision.

DATA BIT SIZE NUMBER RANGE CONSTANT ADDRESS EXAMPLES

TYPE EXAMPLES
Real 32 -3.402823e+38 to -1.175495e-38 123.456 MD100
±0 -3.4 DB1.DBD8
+1.175495e-38 to 1.0e-5 Tag_name
+3.402823e+38
LReal 64 -1.7976931348623158e+308 to 12345.123456789 DB_name.var_name
-2.2250738585072014e-308 e40 Rules:
±0 1.2E+40 No direct addressing support
+2.2250738585072014e-308 to Can be assigned in an OB, FB
+1.7976931348623158e+308 or FC block interface table
Table 10.4 - Floating-point read data types (L=Long) (Taken from S7-1200 Programmable controller System Manual)

Calculations that involve a long series of values, including very large and very small numbers, can produce
inaccurate results. This can occur if the numbers differ by 10 to the power of x, where x > 6 (Real) or 15 (LReal).
For example (Real): 100 000 000 + 1 = 100 000 000.

Calculations that involve a long series of values, including very large and very small numbers, can produce
inaccurate results. This can occur if the numbers differ by 10 to the power of x, where x > 6 (Real) or 15 (LReal).
For example (Real): 100 000 000 + 1 = 100 000 000.

- 108 - Version 1.0

Data Types
Time and Date data types

10.5 Time and Date data types

DATA TYPE SIZE NUMBER RANGE CONSTANT EXAMPLES
Time 32 bits T#-24d_20h_31m_23s_648 ms to T#5m_30s
T#24d_20h_31m_23s_647 ms T#1d_2h_15m_30s_45 ms
Stored as: -2,147,483,648 ms to TIME#10d20h30m20s630 ms
+2,147,483,647 ms 500h10000 ms
10d20h30m20s630 ms
Date 16 bits D#1990-1-1 to D#2168-12-31 D#2009-12-31
DATE#2009-12-31
2009-12-31
Time_of_Day 32 bits TOD#0:0:0.0 to TOD#10:20:30.400
TOD#23:59:59.999 TIME_OF_DAY#10:20:30.400
23:10:1
DTL (Date and 12 Min.: DTL#1970-01-01-00:00:00.0 DTL#2008-12-16-20:30:20.250
Time Long) bytes Max.: DTL#2262-04-11:23:47:16.854 775 807
Table 10.5 - Time and date data types (taken from S7-1200 Programmable controller System manual)

Time
TIME data is stored as a signed double integer interpreted as milliseconds. The editor format can use
information for day (d), hours (h), minutes (m), seconds (s) and milliseconds (ms). It is not necessary to specify
all units of time. For example, T#5h10s and 500h are valid. The combined value of all specified unit values
cannot exceed the upper or lower limits in milliseconds for the Time data type (-2,147,483,648 ms to
+2,147,483,647 ms).

Date
DATE data is stored as an unsigned integer value which is interpreted as the number of days added to the base
date 01/01/1990, to obtain the specified date. The editor format must specify a year, month and day.

TOD
TOD (TIME_OF_DAY) data is stored as an unsigned double integer, which is interpreted as the number of
milliseconds since midnight for the specified time of day (Midnight = 0 ms). The hour (24hr/day), minute, and
second must be specified. The fractional second specification is optional.

DTL
The DTL (Date and Time Long) data type uses a 12-byte structure to save date and time information. You can
define DTL data in either a block's Temp memory or a database. A value for all components must be entered in
the "Start value" column of the DB editor.

LENGTH FORMAT VALUE RANGE EXAMPLE OF VALUE INPUT

(BYTES)
12 Clock and calendar Min.: DTL#1970-01-01-00:00:00.0 DTL#2008-12-16-20:30:20.250
Year-Month- Max.:DTL#2554-12-31-
Day:Hour:Minute 23:59:59.999 999 999
:Second.
Nanoseconds
Table 10.6 - Size and range for DTL (taken from: S7-1200 Programmable controller System Manual

- 109 - Version 1.0

Data Types
String and WString

Each component of the DTL contains a different data type and range of values. The data type of a specified
value must match the data type of the corresponding components.

BYTE COMPONENT DATA TYPE VALUE RANGE

0 Year UINT 1970 to 2554
1
2 Month USINT 1 to 12
3 Day USINT 1 to 31
4 Weekday * USINT 1 (Sunday) to 7 (Saturday) *
5 Hour USINT 0 to 23
6 Minute USINT 0 to 59
7 Second USINT 0 to 59
8 Nano seconds UDINT 0 to 999,999,999
9
10
11
* The format Year-Month-Day:Hour:Minute:Second.Nanosecond does not include the weekday.
Table 10.7 - Elements of the DTL structure (taken from S7-1200 Programmable controller System Manual)

10.6 Character and String data types

DATA TYPE SIZE RANGE CONSTANT ENTRY EXAMPLES
Char 8 bits 16#00 to 16#FF ‘A’, ‘t’, ‘@’, ‘ä’, ‘Σ’
WChar 16 bits 16#0000 to 16#FFFF ‘A’, ‘t’, ‘@’, ‘ä’, ‘Σ’, Asian characters, Cyrillic characters,
and others
String n + 2 bytes n = (0 to 254 bytes) “ABC”
WString n + 2 words n = (0 to 65534 words) “ä[email protected]”
Table 10.8 - Character and String data types (taken from S7-1200 Programmable controller System Manual)

Char and WChar

A Char occupies one byte in memory and stores a single character coded in ASCII format, including the extended
ASCII character codes. A WChar occupies one word in memory and can contain any double-byte character
representation. The editor syntax uses a single quote character before and after the character. You can use
visible characters and control characters.

10.7 String and WString

The CPU supports the String data type for storing a sequence of single-byte characters. The String data type
contains a total character count (number of characters in the string) and the current character count. The String
type provides up to 256 bytes for storing the maximum total character count (1 byte), the current character
count (1 byte), and up to 254 bytes in the string. Each byte in a String data type can be any value from 16#00 -
16#FF.

The WString data type provides for longer strings of one-word (double-byte) values. The first word contains the
maximum total character count; the next word contains the total character

count, and the following string can contain up to 65534 words. Each word in a WString data type can be any
value from 16#0000 - 16#FFFF.

You can use literal strings (constants) for instruction parameters of type IN using single quotes. For example,
‘ABC’ is a three-character string that could be used as input for parameter IN of the S_CONV instruction. You

- 110 - Version 1.0

Data Types
String and WString

can also create string variables by selecting data type "String" or "WString" in the block interface editors for OB,
FC, FB, and DB. You cannot create a string in the PLC tags editor.

You can specify the maximum string size in bytes (String) or words (WString) by entering square brackets after
the keyword "String" or "WString" after you select one of those data types from the data type drop-down list. For
example, "MyString String[10]" would specify a 10-byte maximum size for MyString. If you do not include the
square brackets with a maximum size, then 254 is assumed for a string and 65534 for a WString. "MyWString
WString[1000]" would specify a 1000-word WString.

The following example defines a String with maximum character count of 10 and current character count of 3.
This means the String currently contains 3 one-byte characters, but could be expanded to contain up to 10 one-
byte characters.

TOTAL CURRENT CHARACTER 1 CHARACTER 2 CHAR 3 .. CHAR 10

CHARACTER CHARACTER
COUNT COUNT

10 3 ‘C’ (16#43) ‘A’ (16#41) ‘T’ (16#54) -

Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 … Byte 11
Table 10.9 - Example of a String data type (taken from S7-1200 Programmable controller System Manual

The following example defines a WString with a maximum character count of 500 and a current character count
of 300. This means the String currently contains 300 one-word characters but could be expanded to contain up
to 500 one-word characters.

Total Current Char Char Char 300 .. Char 500

Character Character 1 2 to 299
count count
10 3 ‘ä’ ASCII ‘M’ -
(16#0084) character (16#004D)
words
Word 0 Word 1 Word 2 Words Word 301 … Word 501
3 to 300
Table 10.10 - Example of a WString data type (taken from S7-1200 Programmable controller System Manual

ASCII control characters can be used in Char, WChar, String and WString data. The following table shows
examples of control character syntax.

- 111 - Version 1.0

Data Types
String and WString

Control ASCII Hex ASCII Hex Control function Examples

characters value (Char) value
(WChar)
$L or $l 16#0A 16#000A Line Feed ‘$LText’
‘$0AText’
$N or $n 16#0A and 16#000A Line Break ‘$NText’
16#0D and The new line shows ‘$0A$0DText’
16#000D two characters in
the string
$P or $p 16#0C 16#000C Form Feed ‘$PText’
‘$0CText’
$R r $r 16#0D 16#000D Carriage Return ‘$RText’
(CR) ‘$0DText’
$T or $t 16#09 16#0009 Tab ‘$TText’
‘$09Text’
$$ 16#24 16#0024 Dollar sign ‘$100$$’
‘$100$24’
$’ 16#27 16#0027 Single quote ‘$’Text’
‘$27Text$27’
Table 10.11 - Valid ASCII control characters (taken from:...)

- 112 - Version 1.0

Data Types
Array data type

10.8 Array data type

You can create an array that contains multiple elements of the same data type. Arrays can be created in the
block interface editors for OB, FC, FB, and DB. You cannot create an array in the PLC tags editor.

A tag of the ARRAY data type represents a structure consisting of a fixed number of components of the same
data type. The index limitations are defined in square brackets, and the data type is defined after the keyword
"of" when creating an ARRAY tag. The ARRAY limitations can be established statically with integers, global and
local constants, formal block parameters, or dynamically with ARRAY [*]. The low limit must be equal to or less
than the high limit. An ARRAY can have up to six dimensions, each with its own set of bounds separated by a
comma.

To create an array from the block interface editor, name the array and choose data type "Array
[lo .. hi] of type", then edit "lo", "hi", and "type" as follows:
• lo - the starting (lowest) index for your array
• hi - the ending (highest) index for your array
• type - one of the data types, such as BOOL, SINT, UDINT

DATA TYPE ARRAY SYNTAX

ARRAY Name [index1_min..index1_max, index2_min..index2_max] of <data type>
• All array elements must be the same data type.
• The index can be negative, but the lower limit must be less than or equal to the upper limit.
• Arrays can have one to six dimensions.
• Multi-dimensional index min ... max declarations are separated by comma characters.
• Nested arrays, or arrays of arrays, are not allowed.
• The memory size of an array = (size of one element * total number of elements in array)

Array index Valid index data types Array index rules

Constant or USInt, SInt, UInt, Int, UDInt, • Value limits: -32768 to +32767
variable DInt • Valid: Mixed constants and variables
• Valid: Constant expressions
• Not valid: Variable expressions

10.8.1 Array Addressing

Fixed or variable indexes are used to address ARRAY components. ARRAY tag components can be considered
like tags of the same data type.

Let us create an array of ten integers, ten reals, and ten Booleans. Open TIA Portal, create a new data block and
customise the array as shown in the image below.

- 113 - Version 1.0

Data Types
Array data type

Figure 10.1 – Tank structure

The limits for creating arrays are described in Table 10.12.

BLOCK FORMAT ARRAY LIMITS

PROPERTY
Standard ARRAY[low limit … high limit] of [-32,768 … 32,767]
Optimised <DataType> [-2,147,483,648 … 2,147,483,647] of <DataType>
Table 10.12 - Array creating limits

- 114 - Version 1.0

Data Types
Data structure data type

10.9 Data structure data type

You can use the data type "Struct" to define a data structure consisting of other data types. You can use a Struct
data type to handle a group of related process data as a single data unit. You can create Structs in the data
block editor or a block interface editor.

You can assemble arrays and structures into larger structures. For example, you can create a structure of
structures that contain arrays. A structure can be nested up to eight levels deep.

A structure can have components of the STRUCT or ARRAY data types. Using structures, data can be grouped
according to the process control system, and parameters can be transferred as a single data unit.

A STRUCT tag always begins in a non-optimized block at a word limit, at an even-numbered byte. Individual
components are then located in the memory in the sequence in which they were declared. STRUCT tags take up
memory until the next word limit is reached. A nested structure is a substructure of another structure. It is
possible to nest up to 8 buildings deep. The "InOut" section allows for a maximum nesting depth of 9 structures.

Contol Scenario

We have a lubricating plant with three tanks for storing lubricating oil after processing. The system consists of
inputs and outputs. For each of the tanks, the following signals are used:

TAG NAME DATA TYPE

1 High-High Level Switch BOOL
2 High Level Switch BOOL
3 Low Level Switch BOOL
4 Low-Low Level Switch BOOL
5 Outlet Valve BOOL
6 Oil Pressure Transmitter REAL
7 Oil Temperature Transmitter INT
Table 10.13 - Tank Signals

The STRUCT can be created as shown in Figure 10.2.

Figure 10.2 – Tank structure

- 115 - Version 1.0

Data Types
PLC data type

Figure 10.3 –Three tanks within the structure

As we can see from Figure 10.3, different data types are contained in the STRUCT data type. To create other
tank parameters, simply copy one parameter of the tank, paste it, and rename it.

10.10 PLC data type

The PLC data type editor lets you define data structures you can use multiple times in your program. You create
a PLC data type by opening the "PLC data types" branch of the project tree and double-clicking the "Add new
data type" item. Use two single clicks to rename the default name and double-click to open the PLC data type
editor on the newly created PLC data type item.

You create a custom PLC data type structure using the same editing methods in the data block editor. Add new
rows for any necessary data types to achieve your desired structure.

If you create a new PLC data type, then the new PLC type name appears in the data type selector drop-down
lists in the DB editor and code block interface editor.

You can potentially use PLC data types in the following ways:

• As a data type in a code block interface or data blocks

• As a template for the creation of multiple global data blocks that use the same data structure
• As a data type for PLC tag declarations, the I and Q memory areas of the CPU
For example, a PLC data type could be a recipe for mixing colours. You can then assign this PLC data type to
multiple data blocks. You can adjust the variables within each data block to create a specific colour.

- 116 - Version 1.0

Data Types
PLC data type

10.10.1 Creating User Defined Types (UDT)

Let us start by creating a new PLC data type. Under project tree, navigate to PLC data type and create a new
one.

Create the following tags as shown in Figure 10.4.

Figure 10.4 – Creating PLC Datatype (UDT)

After creating this, the UDT can be exported and imported into another PLC project. A common practice is to
save them as libraries for reusability.

We can go on to create a data block for our three tanks and use the UDT. Remove the optimised block access.

Each of the three tanks can use the same UDT for their Ios (take note of the data type). Instead of creating
different tags for all tags, a simple UDT has solved this problem. Let us use the UDT in a simple program. The
result can be seen in Figure 10.5.

- 117 - Version 1.0

Data Types
PLC data type

Figure 10.5 – Three tanks in a single DB using UDTs

10.10.2 Testing the UDT

We will create a function that holds some calculations for our Lubrication plant. Create a new function with the
following parameters. Make the parameters an internal parameter local to the function.

Figure 10.6 – Creating PLC Datatype (UDT)

- 118 - Version 1.0

Data Types
PLC data type

Here, we have created lamps as output for warning, an outlet valve for discharge, and temperature inclusive of
room temperature and pressure in the PSI unit.

Notice that the Tank operation parameter that uses our created UDT is under the INOUT type. This is because
our UDT comprises input and output parameters.

Figure 10.7 – Creating PLC Datatype (UDT)

Network 1 is used to check for High-High condition level of each tank.

Figure 10.8 – Creating PLC Datatype (UDT)

Network 2 is used to check for Low-Low condition level of each tank

- 119 - Version 1.0

Data Types
PLC data type

Figure 10.9 – Creating PLC Datatype (UDT)

Network 3 calculates Pressure from Bar to PSI and Temperature from Fahrenheit to Celsius. It also shows the
control for activating the outlet valve through the discharge bit.

Dragging the function from the project tree to the programming area of OB1 shows the block as shown in Figure
10.10.

Figure 10.10 – Function after drag and drop

Complete the tagging of the FC as shown in Figure 10.11.

- 120 - Version 1.0

Data Types
PLC data type

Figure 10.11 – Adding all the inputs and outputs

Tank operation takes the Tank one DB parameters for tank controls. Red Lamp M40.0 will be tagged to a physical
lamp, same as Amber lamp M40.1. Temp_to_cel takes the temperature-converted output. Pressure_to_PSI
takes the converted pressure. The outlet valve is the physical valve used to discharge the liquid.

Replace the same for Tank 2 and 3 by changing the parameters to their respective tank DB number.

Figure 10.12 – Inputs and outputs for Tank 2

Figure 10.13 – Inputs and outputs for Tank 3

- 121 - Version 1.0

Data Types
PLC data type

Figure 10.14 – Overview of DB with all three tanks

Figure 10.15 – Monitoring Tank 1

- 122 - Version 1.0

Data Types
PLC data type

Figure 10.16 – Monitoring Tank 2

Figure 10.17 – Monitoring Tank 3

- 123 - Version 1.0

Data Types
Variant pointer data type

We can see that the outlet valves for Tank 1 and Tank 3 are opened while 2 is closed. We can also see the
converted Temperature and Pressure valves for all tanks. The Tank 2 red lamp is on due to the activation of the
High-High sensor.

This can also be done by creating the tans for the different tanks, but that would be more cumbersome; UDT
has simplified it. Additionally, if more tanks are added in the future, it would just be a matter of creating a DB
tank parameter with the UDT.

Difference between STRUCT and UDT

At face value, a STRUCT and a UDT have many similarities, but there are some differences between as
highlighted in Table 10.14.

STRUCT UDT
1 A STRUCT cannot be versioned and UDT can be versioned and translated into a library
translated into a library for archiving and for archiving and reusability
reusability.
2 The maximum number for nested A total of 64dK FCs, FBs, DBs, and PLC data types can
structures is 8, while for the INOUT be defined (the total number is restricted
parameter is 9. accordingly for CPUs, however). Each structure
description (for example, a DB or a PLC data type
(UDT)) can have up to 16K components per hierarchy
level.
3 A structure is better for one-off UDTs are better used for repetitive structures.
declarations in a program.
Table 10.14 - Difference between structures and UDTs

10.11 Variant pointer data type

The data type Variant can point to variables of different data types or parameters. The Variant pointer can point
to structures and individual structural components. It does not occupy any space in memory.

LENGTH (BYTE) REPRESENTATION FORMAT EXAMPLE ENTRY

0 Symbolic Operand MyTag
DB_name.Struct_name.element_name MyDB.Struct1.pressure1
Absolute Operand %MW10
DB_number.Operand Type Length P#DB10.DBX10.0 INT 12
Table 10.15 - Properties of the Variant pointer

- 124 - Version 1.0

Data Types
Accessing a "slice" of a tagged data type

10.12 Accessing a "slice" of a tagged data type

PLC tags and data block tags can be accessed at the bit, byte, or word level depending on their

size. The syntax for accessing such a data slice is as follows:

• "<PLC tag name>".xn (bit access)

• "<PLC tag name>".bn (byte access)
• "<PLC tag name>".wn (word access)
• "<Data block name>".<tag name>.xn (bit access)
• "<Data block name>".<tag name>.bn (byte access)
• "<Data block name>".<tag name>.wn (word access)

A double word-sized tag can be accessed by bits 0 - 31, bytes 0 - 3, or word 0 - 1. A word-sized tag can be
accessed by bits 0 - 15, bytes 0 - 1, or word 0. A byte-sized tag can be accessed by bits 0 - 7, or byte 0. Bit, byte,
and word slices can be used anywhere that bits, bytes, or words are expected operands.

Valid data types that can be accessed by slice are Byte, Char, Conn_Any, Date, DInt,
DWord, Event_Any, Event_Att, Hw_Any, Hw_Device, HW_Interface, Hw_Io, Hw_Pwm,
Hw_SubModule, Int, OB_Any, OB_Att, OB_Cyclic, OB_Delay, OB_WHINT, OB_PCYCLE,
OB_STARTUP, OB_TIMEERROR, OB_Tod, Port, Rtm, SInt, Time, Time_Of_Day, UDInt, UInt,
USInt, and Word.
PLC Tags of type Real can be accessed by slice, but data block tags of type Real cannot.

- 125 - Version 1.0

Data Types
Converting

10.13 Converting
If you link several operands in an instruction, you must make sure that the data types are compatible. This also
applies to assignments or to supplying block parameters. A conversion must be carried out if the operands are
not the same data type.

There are two options for the conversion:

• Implicit conversion
The conversion takes place automatically when the instruction is executed

• Explicit conversion
You can use explicit conversion instructions before the actual instruction is executed.

The data type conversion options described always refer to the latest CPU version (V.4).
Conversions marked as possible may not be available in CPU versions 1 – 3.

Converting bit strings in SCL

All bit strings (BYTE, WORD and DWORD) are handled like the corresponding unsigned
integers (USINT, UINT and UDINT) in expressions. Therefore, implicit conversions from
DWORD to REAL is carried out like a conversion from UDINT to REAL, for example

10.13.1 Implicit conversion

An implicit conversion is executed automatically if the data types of the operands are compatible. This
compatibility test can be carried out according to criteria that are more or less strict:
• With IEC8 check (default):
If IEC check is set, the following rules are applied:
- Implicit conversion of BOOL to other datatypes is not possible
- Only the REAL, BYTE, WORD, DINT, INT, SINT, UDINT, UINT, USINT, TIME, DT, STRING, CHAR and
WCHAR data types can be converted implicitly.
- The bit length of the source data type must not exceed the bit length of the target data type. For
example, an operand of data type WORD cannot be declared at a parameter at which data type BYTE
is expected.
• Without IEC check:
If IEC check is not set, the following rules are applied:
- Implicit conversion of the BOOL to other datatypes is not possible.
- Only the REAL, BYTE, WORD, DINT, INT, SINT, UDINT, UINT, USINT, TIME, DT, STRING, CHAR and
WCHAR data types can be converted implicitly.

8
The data types of the operands used are checked for compatibility. This compatibility test can be carried out
according the criteria that are more or less strict. If “IEC check for code blocks” is activated, stricter criteria are
applied.

- 126 - Version 1.0

Data Types
Converting

- The bit length of the source data type must not exceed the bit length of the target data type. For
example, an operand of data type WORD cannot be declared at a parameter at which data type BYTE
is expected.
- The bit length of an operand entered in-out parameters (InOut) must be the same as the
programmed bit length for the parameter in question.

Figure 10.18 – Implicit conversion

Implicit conversion without IEC check

The programming editor uses a grey rectangle to mark implicitly converted operands.
The dark grey rectangle signals that an implicit conversion is possible without any
accuracy loss, for example, if you convert the data type SINT to INT. A light grey rectangle
signals that implicit conversion is possible, but errors could occur during runtime. If, for
example, you are converting the data type DINT to INT and an overflow occurs, the enable
output ENO is set to "0".

10.13.2 Explicit conversions

If the operands are incompatible and an implicit conversion is impossible, you can use an explicit conversion
instruction. You can find the conversion instructions in the “Instructions” task card.

The ENO enable output displays a possible overflow. For example, an overflow is created if the value of the
source data type is greater than the target data type's value.

Shifting of bit patterns

The enable output ENO is not set if the explicit conversions involve shifting a bit pattern.

- 127 - Version 1.0

Data Types
Converting

Figure 10.19 – CONV function

- 128 - Version 1.0

Introduction TIA Portal

11 Introduction TIA Portal

11.1 Project View

Figure 11.1 – Example of an ISA-S88 structure in a PLC project (with a different naming convention)

The Project View is divided in several parts, as described below.

• Project Navigation (Project tree)

The project tree contains all an automation solution's components and project data. It can be opened
to open all components.

In this pane, devices and associated objects (such as function blocks) are navigated, and new devices
and objects are added.

• Working area
The objects opened for editing are displayed in the working area. These objects include hardware
components, blocks, PLC tag tables, screens of HMI devices, etc. If several objects are open at the same
time, they are displayed in the taskbar as tabs (individually or grouped according to editors).

• Task cards
This pane contains a collection of tabs (task cards) offering tools related to the activity. The task cards
provided depend on the current activity.

• Details View
This area lists the child objects when an object is selected in the Project Tree. These can be used in the
active working area (by dragging them to the working area using drag & drop).

- 129 - Version 1.0

Introduction TIA Portal
Project View

• Inspector window
This pane changes often and has a multi-tab approach to display information in different categories.
During development, this pane will most often display information such as Compilation status and
properties, which allow the setup of various objects.

Mention the other parts used in Figure 11.1! And reference them as part of an interactive reader.

• Overview window

• Menu and toolbar

• Group opened editors

- 130 - Version 1.0

Introduction TIA Portal
Menu Bar and Toolbar

11.2 Menu Bar and Toolbar

Figure 11.2 – Example of an ISA-88 structure in a PLC project (with a different naming convention)

- 131 - Version 1.0

Introduction TIA Portal
Project Tree

11.3 Project Tree

Figure 11.3 – Project Tree

The "Project tree" window provides access to all components and project data. All components and available
objects of a project appear in the Project tree in a tree structure and can be opened from there by double-clicking
on them.

The following actions can be carried out:

• add new components (controllers, operator panels, etc.)

• editing existing components
• querying and modifying properties of existing components
• diagnosing accessible components

- 132 - Version 1.0

Introduction TIA Portal
Project Tree

For a better overall view, blocks can be arranged in groups you create yourself. This grouping merely provides
an overview of the program and has no impact on its execution. This information is not loaded into the CPU.

All central modules are stored in the folder “Local modules”.

If a device or slave was assigned to a controller or master, it can be found in the folder “Distributed I/O” of that
controller/master.

Hiding/Showing a Structure Section

The black triangle indicates an underlying structure. By clicking on it, the underlying structure can be shown
→ or hidden again → .

Details window
Certain contents of a selected object are displayed in the Details window. Possible contents are, for example,
text lists or tags.

- 133 - Version 1.0

Introduction TIA Portal
Overview Window

11.4 Overview Window

Figure 11.4 – Overview Window

The Overview window is used to supplement the Project tree. The Overview window displays the contents of
the folder currently selected in the Project tree. As well you can also carry out the following actions in the
Overview window:

• Open objects
• Display and edit Properties of objects in the lnspector window
• Rename objects
• Call object-specific actions via the Context menu
• Compare objects
Carry out different object operations, such as inserting objects from the library using drag-and-drop, shifting,
copying, inserting, and deleting objects.

The View can be split to compare the contents of two folders or objects. Using drag-and-drop, objects can be
shifted between the two split windows.

- 134 - Version 1.0

Introduction TIA Portal
Inspector Window

11.5 Inspector Window

Figure 11.5 – Inspector Window

Additional information on a selected object or on actions executed is displayed in the lnspector window.
This symbol in the tab indicates new entries.

If errors are displayed, you can jump to the error location or into the associated editor by
double-clicking on the error information

The lnspector window consists of the following tabs:

• Properties Area
This tab displays the properties of the object selected in the working area, and editable properties can
be changed.

• Info Area
This is the engineering output area. This tab displays further information for the object selected. In
addition, messages relating to executed actions, such as compilation and download of blocks to the
CPU, are output.

"General" tab - general status output

"Cross-references" tab - display of the current locations at which the selected object is used
"Compile" tab - status display of compilation progress
“Syntax" tab - status display for invalid programming commands

- 135 - Version 1.0

Introduction TIA Portal
Window Arrangement

• Diagnostic Area
This tab displays information on system diagnostics and configured alarm events.

“Device information” tab - information about the state of the devices

"Connection information" tab - detailed diagnostics of connections
“Alarm display” tab - display of currently pending CPU alarms
“Monitor value” tab - monitoring of structures in a block

11.6 Window Arrangement

Figure 11.6 – Window arrangement

The positions and characteristics of windows can be configured individually. To enlarge the surface of the
working area, you can hide windows that are seldom required.

The current configuration of the engineering user interface is saved in Windows's user profile. When the project
is saved, the positions and characteristics of windows are automatically saved with it.

11.6.1 Window Arrangement Options

• When the window is ‘Expand permanently’
o fixed location and fixed size on the user interface
o position at left, bottom or right outside of the working area is possible
o always open, reduces the working area
• When the window is ‘Collapse automatically’
o hidden at the edge of the user interface
o position at left, bottom, or right is possible, superimposed on the working area when open
o default status = window closed, and tab displayed at the edge of the user interface
o mouse click on the tab opens the window
o closed automatically the next time there is a click outside the window area

- 136 - Version 1.0

Introduction TIA Portal
Window Arrangement

• ‘Float’ window! It makes sense if a 2nd monitor is used!!

• can be positioned anywhere on the user interface
• permanently covers the user interface area underneath it

By clicking the functions in the window title bar, you can switch between the modes "float" and "embed" or
"collapse automatically" and "expand permanently".

In addition, the windows can be expanded and collapsed via the buttons: .

Hidden windows are opened by clicking on the tab and closed again by clicking outside the window area.

11.6.2 Menu – View

The windows listed below can be opened, closed, or hidden using the “View” menu function or assigned hotkeys.

Figure 11.7 – Menu View

- 137 - Version 1.0

Introduction TIA Portal
Window Arrangement

11.6.3 Window Sections in the Working Area

Figure 11.8 – Window sections in the working area

- 138 - Version 1.0

Introduction TIA Portal
Window Arrangement

The windows of the working area can be arranged as follows:

Maximise (full size) of a working area

(colour depending on View online/offline)

Detach or release a window from the working area

(colour depending on View online/offline)

Embed a window in the working area once again

(colour depending on View online/offline)

Split the working area horizontally into two windows.

Split the working area vertically into two windows.

Keeping the Editor in the Foreground when the Working Area is split

Split working area -> Paperclip -> Editor window “attached” in the foreground.

Figure 11.9 – Splitting windows

If you work with a split working area, you can fix (attach) one of the two working areas by clicking on the “paper-
clip.” This way, when you open a new editor, the first one always remains fixed in the foreground, and the newly
opened one always becomes the second visible editor.

- 139 - Version 1.0

Introduction TIA Portal
Window Arrangement

11.6.4 Windows Layouts Save/Manage/Use

Different user interface arrangements can be saved and used in the engineering view.

Figure 11.10 – Saving and loading window layout

- 140 - Version 1.0

Introduction TIA Portal
Grouping of devices in the project navigation

11.7 Grouping of devices in the project navigation

Figure 11.11 – Grouping of devices

Functions
• grouping of I/O devices/slaves in the project navigation

Benefits
• Technological merging of devices
• Devices are part of large applications can be located more quickly

- 141 - Version 1.0

Introduction TIA Portal
Task Cards

11.8 Task Cards

Figure 11.12 – Task Cards

The available Task Cards (tools) are shown at the screen's right-hand edge and can be opened or closed at any
time.

Which task cards are available depends on the products that have been installed and on the object currently
being edited or opened in the working area. if not all Task Cards are visible, the Task card bar can be shifted
using the cursor buttons at the bottom right.

• Hardware catalogue
Here, all the available hardware components, such as CPUs, modules, etc., can be selected in the
Hardware catalogue.

• Instructions
Instructions for programming blocks;
Code templates and function list wizard for script programming (VBS as well as C scripts with WinCC
Professional)

• Online tools
If an online connection is established, diagnostics and online information can be called, such as the
CPU's current cycle time and the configuration of its load and work memory. The CPU can also be
switched to STOP and RUN mode.

• Toolbox
Configurable screen objects (graphics, display and operator control objects) in different panes (basic
objects, elements, controls, optional customised controls, graphics)

- 142 - Version 1.0

Introduction TIA Portal
Task Cards

• Animations
Templates for the dynamisation of screen objects in different panes (movements, display, tag link for
dynamisation)

• Layout
Tools for adapting the presentation when designing screens during the configuration of HMI devices
(zoom, level assignment, grid alignment, objects outside the area)

• Tasks
Here, classic editor functions are available, such as finding and replacing tags, instructions, etc.

• Libraries
Management of the local project library and global libraries.

- 143 - Version 1.0

Introduction TIA Portal
Reference Data

11.9 Reference Data

11.9.1 Cross-references of PLC Tags

Figure 11.13 – Cross reference of PLC Tags

Introduction
The cross-references list offers an overview of using operands and variables (tags) within the user program.
You can jump directly to the point of use from the cross-references list. The cross-references list contains the
following information:

• Which operand is used in which block with which instruction,

• Which tag is used in which HMI screen,
• Which block is called by which other block
As part of the project documentation, the cross-references supply a comprehensive overview of all operands,
memory areas, blocks, variables (tags) and screens used.

Views
There are two views of the cross-references list which differentiate themselves by which objects are displayed
in the first column:
• Used by:
Displays the referenced objects
Here, the Reference location where the object is used are displayed.
• Used:
Displays the referencing objects.
Here, the users of the object are displayed.
The associated tooltips give further information on the respective objects.

- 144 - Version 1.0

Introduction TIA Portal
Reference Data

Show unused
This is a list of tags declared in the PLC tag table but not used in the user program.

11.9.2 Overlapping Accesses

With Overlapping accesses, finding tags written more than once is easy. It can be used to find if a specific bit in
a word is set somewhere else in your program.

Figure 11.14 – Overlapping access

- 145 - Version 1.0

Introduction TIA Portal
Reference Data

11.9.3 Cross-reference of a Variable (Tag) in the Block Editor

Figure 11.15 – Cross reference

Introduction
ln the lnspector window, the cross-reference information for a selected object is displayed in the tabs "Info >
Cross-references". In this tab, you will see which reference locations and from which other objects every
selected object is used.

In the lnspector window, even those blocks that only exist online are displayed in the Cross-references.

Structure
The cross-reference information is displayed in tabular form in the lnspector window. Each column contains
specific detailed information on the selected object and its use.

- 146 - Version 1.0

Introduction TIA Portal
Reference Data

11.9.4 Go To…

Figure 11.16 – Go to…

- 147 - Version 1.0

Introduction TIA Portal
Reference Data

11.9.5 Assignment of I, Q, M, T, C

Figure 11.17 – Assignment of inputs, outputs, timers, counters and more

Assignment
The assignment list for I/Q/M/T/C can be opened by Right-Clicking on the device Assignment list or by Selecting
Tools > Assignment list from the menu. This assignment list gives you an overview of which bit is used from
which byte of the memory areas input (l), output (Q) and bit memory (M) and which SIMATIC timers and counters
are used. The type of use (reading or writing) is not displayed. The memory areas inputs (l), outputs (Q) and bit
memories (M) are displayed byte-by-byte in lines.

• The bits identified with a small diamond, binary operands, are used explicitly in the program.
• The fields of the individual bits with a grey background identify byte, word, double word or long word
operands used in the user program. The operand dimension (byte, word, double word or long word)
comes from the vertical line in one of the columns “B” (Byte), "W" (Word), "DWORD" (Double word) and
"LWORD” (Long word).
• Bits marked with a diamond and a grey background are used explicitly as a binary operand in the user
program and are used via a byte, word, double-word or long-word operand.

- 148 - Version 1.0

Introduction TIA Portal
Reference Data

11.9.6 Call Structure

The call structure describes the call hierarchy of each block within your user program. It provides an overview
of the blocks used, calls to other blocks, relationships between blocks, data requirements for each block, and
block status. You can open the program editor and edit blocks from the call structure.

Displaying the call structure gives you a list of the blocks used in the user program. STEP 7 highlights the first
level of the call structure and displays any blocks not called by any other block in the program. The first level of
the call structure displays the OBs and any FCs, FBs, and DBs not called by an OB. If a code block calls another
block, the called block is shown as an indentation under the calling block. The call structure only displays those
blocks that are called by a code block.

Figure 11.18 – Call structure of a simple program

Call Structure
The call structure is opened via "Right-click on the device -> Call Structure" or via Menu "Tools > Call Structure"
and shows (describes) the call hierarchy of the blocks within an S7 program. It gives you an overview of which
blocks the individual blocks access or which they call.

• Jumps to the points of use of the blocks

• Dependencies between the blocks
• Local data requirements of the blocks
• Status of the blocks

- 149 - Version 1.0

Introduction TIA Portal
Reference Data

11.9.7 Dependency Structure

Figure 11.19 – Dependency structure

Dependency Structure
The dependency structure is opened via the Menu "Tools > dependency structure" and shows the list of blocks
used in the user program. On the first level (to the very left) is the respective block, and indented underneath it
are the blocks that call this block or use it.
The dependency structure also uses symbols to show the status of the individual blocks. Different symbols
identify objects that cause a time stamp conflict and can lead to program inconsistency. The dependency
structure represents an extension of the cross-reference list for objects.

- 150 - Version 1.0

Introduction TIA Portal
Saving a Project

11.10 Saving a Project

Figure 11.20 – Saving a project

TIA portal does not automatically save the project.

Be aware by closing the project: before closing, SAVE the project!

- 151 - Version 1.0

Introduction TIA Portal
Help Functions

11.11 Help Functions

Figure 11.21 – F1, the Help function

Wide-ranging help functions are available to solve your tasks; these describe basic concepts, actions, and
functions.
• Tooltips provide information on user interface elements, such as instructions, input boxes, buttons, and
symbols.
Some tooltips provide more precise information about cascades. To activate them, click the … in the
tooltip …
• Help on the current context. For example, on menu commands by pressing the <F1> or <Shift+F1> keys.
• In the input boxes (for example, in the Properties in the Inspector window), the roll-out provides
information about the permitted value ranges and data types for the input.

Contents of the Help Functions

Menu function > Help > Show Help
The Help describes concepts, actions and functions. It also contains reference information and examples. The
Help opens up in its window on the right side of the screen. The following functions are available in the
navigation area:
• Table of contents
• Search in the index
• Full text search of the entire Help
• Tips and Tricks

- 152 - Version 1.0

Introduction TIA Portal
Help Functions

11.11.1 Archiving / Retrieving projects

Figure 11.22 – Archive and retrieving

11.11.2 Archiving
Minimising the project files, that is, reducing them to their essential components, can reduce the memory space
requirement of the currently opened project.

When you archive projects, you can choose the following:

• TlA Portal project archives

The project is minimised (all files are reduced to their essential components) and then stored and
compressed in a project archive (file with the ending zap179).

• TlA Portal project minimised

The project is minimised (all files are reduced to their essential components) and then stored as a new
project in a new project directory.

The most recently saved version of the project is archived. The last changes to the
project are also to be included in the archive, so the project must be saved before
archiving.

9
Each version of TIA Portal saves it with a different zap. For example, TIA Portal V15 saves it with zap15,
whereas TIA Portal V17 saves it with zap17.

- 153 - Version 1.0

Introduction TIA Portal
Help Functions

11.11.3 Retrieving
Only project archives (files with the ending zap1x) can be retrieved, that is, unzipped.

- 154 - Version 1.0

Introduction TIA Portal
Help Functions

11.11.4 Undo and Redo

Figure 11.23 – Undo and Redo

Undo concept of the TIA Portal

The drop-down menu shows the user in which editor the "Undo" function is executed. Closed editors are then
automatically opened. Since all actions are only undone up to the selected action, the consistency of the project
is ensured.

- 155 - Version 1.0

Introduction TIA Portal
Help Functions

11.11.5 Keyboard Shortcuts in the Engineering

Central overview of all available shortcuts in TIA Portal

Keyboard commands are implemented in the engineering for essential and frequently used functions.

- 156 - Version 1.0

Introduction TIA Portal
Help Functions

11.11.6 Global Search / Find and Replace in the Editor

Figure 11.24 – Overview Window

Within the TIA Portal, you can use the following search possibilities:

• Search the entire project (toolbar or CTRL+F when the focus is not in the editor (working) area)
• Find and replace within an editor ('Tasks' task card > Find and replace)
• Search the Hardware catalog

Search Entire Project

You can search the entire project for a specific text. For this, a search editor allows you to narrow down the
search. The objects which contain the searched-for text are presented clearly in a table. You can open each
object from the Search editor to look at the relevant location.

The Global Search (Search in the project) can be started using CTRL+F (when the focus/selection is not in the
editor (working) area), the Context menu of the project name, the menu bar, or the menu Edit > Search in the
project.

Search and Replace within an Editor (CTRL+F when the focus is in the editor (working) area). It is possible to
search for texts within an editor. The search function finds all texts within the currently opened editor which
contain the search term. The results are selected one after the other in the opened editor.

Furthermore, you have the following possibilities:

• Refine the search through additional options

• Replace found text

- 157 - Version 1.0

Introduction TIA Portal
Help Functions

11.11.7 Detailed Information in the Overview of Addresses

Figure 11.25 – Overview Window

The ‘Overview of addresses’ menu in the CPU's Properties allows you to display an overview of addresses with
central and distributed I/O.

- 158 - Version 1.0

Introduction TIA Portal
Help Functions

11.11.8 Tag Table

The Tag Table is used for managing and organising variables (Tags). You can create multiple tag tables to
organise the project. For example, if your installation contains a sorting station, you can put all your tags used
in the sorting station in a tag table.

You can drag and drop tags from the table into your programming window when programming. By selecting the
tag table in the Project tree, the tags appear in the Details view. From here, you can drag and drop them.

Figure 11.26 – Create new tag table

Create a new tag table

• In the project view, navigate to your controller's PLC Tags and create a new tag table by double-clicking
Add new tag table.
• Rename the tag table you just created to a logical name, for example, Tag_table_sorting_station, by
right-clicking Tag_table_1 -> Rename -> Tag_table_sorting_station.
• Open this tag table with a double-click.

Create new tags within a tag table

• Add the name Q1 and confirm the entry with the Enter key. If you have not created additional tags, TIA
Portal will automatically assign the datatype BOOL and address %I0.0.
• You can change the address by entering this directly or clicking the drop-down arrow to open the
Addressing menu. Change the operand identifier to, for example, Q and confirm with Enter or by clicking
the check mark, as shown in Figure 11.27.
• Enter the comment for the tag, in this case: Conveyor motor -M1 forwards fixed speed

- 159 - Version 1.0

Introduction TIA Portal
Help Functions

Figure 11.27 – Adding a tag, and changing its properties

Import tag table

• To insert an existing symbol table, right-click on an empty field of the tag table and select Import file in
the shortcut menu (right-click on an empty field).
• Select the desired symbol table (for example, in Excel format (.xlsx) and confirm with Open, as shown
in Figure 11.28.
• When the import is finished, you will see a confirmation window and have the opportunity to view the
import's log file.
• Figure 11.29 shows that some addresses are highlighted in orange. These are duplicate addresses, and
the names of the associated tags are numbered automatically to avoid confusion.
• Delete the duplicate tags by selecting the lines.

- 160 - Version 1.0

Introduction TIA Portal
Help Functions

Figure 11.28 – Importing tags from Excel

Figure 11.29 – Duplicates found

- 161 - Version 1.0

Online & Diagnostics

12 Online & Diagnostics

Various things can cause faults. Two error patterns for faults occur after a changeover to RUN.

• The CPU goes to or stays in the STOP operating state. The yellow STOP LED lights up, and other
indicator LEDs light up on the CPU, power supply unit, IO modules or bus modules. A CPU fault is present
in this case. For example, a module in the automation system might be defective or have an incorrect
parameter assignment, or a bus system fault might be present. In this case, an interruption analysis will
be performed by evaluating the hardware diagnostics and reading the module information from the CPU
diagnostic buffer.
• The CPU is in a faulty RUN operating state. The green RUN LED lights up, and other indicator LEDs light
up or flash on the CPU, power supply unit, IO modules or bus modules. In this case, a fault may be
present in the IO devices or power supply. A visual check will be performed initially to narrow down the
fault area. The indicator LEDs on the CPU and IO devices will be evaluated. The diagnostic data of the
faulty IO and bus modules will be read from the hardware diagnostics. In addition, a fault analysis can
be performed using a watch table on the programming device.

When the CPU is in STOP

For errors detected by the system, the test functions Diagnostics buffer, Block stack, Local data stack, and
Hardware diagnostics give detailed information on the cause of the error and the location of the interruption.
By programming Error OBs, the program can evaluate information on the error that occurred, and the transition
of the CPU into the STOP state can be prevented. If the CPU has stopped, the test functions “Monitor/Modify
Variable” and “Monitor Blocks” make little sense since the CPU neither reads nor outputs process images in the
STOP state and no longer executes the program.

When the CPU is in RUN

Vice versa, as a rule, it makes little sense to use test functions such as Local data stack for troubleshooting
when the CPU is in RUN since program execution has not been interrupted and the system does not provide any
information on the error that occurred. Functional errors can be diagnosed as follows:
• Process Fault (such as a wiring error)
• Wiring test of the inputs: Monitor Variable
• Wiring test of the outputs: Enable Peripheral Outputs (only for CPU-STOP)
• Logical Programming Errors (such as a double assignment)
• All test functions listed, except Enable Peripheral Outputs, can be used for
• searching for logical program errors.
• Force: Forced control of operands regardless of the program logic
• Breakpoints: Program execution in single steps

- 162 - Version 1.0

Online & Diagnostics
Status LEDs

12.1 Status LEDs

The CPU and the I/O modules use LEDs to provide information about either the operating status of the module
or the I/O.

The CPU provides the following status indicators:

• STOP/RUN
- Solid yellow indicates STOP mode
- Solid green indicates RUN mode
- Flashing (alternating green and yellow) indicates that the CPU is in the STARTUP operating state
• ERROR
- Flashing red indicates an error, such as an internal error in the CPU, an error with the memory card,
or a configuration error (mismatched modules)
- Flashing red for three seconds indicates an error that is not ongoing. An example is if the real-time
clock (RTC) resets to the default time due to a power loss.
- Defective state:
o Solid red indicates defective hardware
o All LEDs flash if the firmware detects a defect
• MAINT (Maintenance) flashes whenever you insert a memory card. Power cycle the CPU. The CPU then
changes to STOP mode. After the CPU has changed to STOP mode, perform one of the following
functions to initiate the evaluation of the memory card:
- Change the CPU to RUN mode
- Perform a memory reset (MRES)
- Power-cycle the CPU
DESCRIPTION STOP/RUN ERROR MAINT
YELLOW/GREEN RED YELLOW
Power is off Off Off Off
Startup, self-test, or firmware update Flashing (alternative - Off
yellow and green)
Stop mode On (yellow) - -
Run mode On (green) - -
Remove the memory card On (yellow) - Flashing
Error On (either yellow or Flashing -
green)
Maintenance requested On (either yellow or - On
Forced I/O green)
Battery replacement required (if battery
board installed)
Defective hardware On (yellow) On Off
LED test or defective CPU firmware Flashing (alternating Flashing Flashing
yellow and green)
Unknown or incompatible version of On (yellow) Flashing Flashing
CPU configuration
Table 12.1 - Status LEDs for a CPU

- 163 - Version 1.0

Online & Diagnostics
Status LEDs

The CPU also provides two LEDs that indicate the status of the ProfiNET communications. Open the bottom
terminal block cover to view the ProfiNET LEDs.

• Link (green) turns on to indicate a successful connection

• Rx/Tx (yellow) turns on to indicate transmission activity
The CPU and each digital signal module (SM) provide an I/O Channel LED for each digital input and output. The
I/O Channel (green) turns on or off to indicate the individual input or output state.

Status LEDs on a signal module

In addition, each digital SM provides a DIAG LED that indicates the status of the module:

• Green indicates that the module is operational

• Red indicates that the module is defective or non-operational
Each analogue SM provides an I/O Channel LED for each of the analogue inputs and outputs.

• Green indicates that the channel has been configured and is active
• Red indicates an error condition of the individual analog input or output
In addition, each analog SM provides a DIAG LED that indicates the status of the module:

• Green indicates that the module is operational

• Red indicates that the module is defective or non-operational
The SM detects the presence or absence of power to the module (field-side power, if required).

DESCRIPTION DIAG I/O CHANNEL

RED/GREEN RED/GREEN
Field-side power is off Flashing red Flashing red
Not configured or update in progress Flashing green Off
Module configured with no errors On (green) On (green)
Error condition Flashing red -
I/O error (with diagnostics enabled) - Flashing red
I/O error (with diagnostics disabled) On (green)
Table 12.2 - Status LEDs for a signal module

- 164 - Version 1.0

Online & Diagnostics
Going online and connecting to a CPU

12.2 Going online and connecting to a CPU

You can establish an online connection between the programming device and CPU for loading
programs and project engineering data, as well as for activities such as the following:
• Testing user programs
• Displaying diagnostics and the diagnostics events in the CPU (Page Error! Bookmark not defined.)
• Comparing and synchronising offline to online program blocks (Page 167)
• Displaying and changing the operating mode of the CPU (Page 1110)
• Displaying the module information
• Uploading and downloading program blocks
• Using a watch table (Page 172) to test the user program by monitoring and modifying values
• Using a force table to force values in the CPU (Page 178)
To establish an online connection to a configured CPU, click the CPU from the Project Navigation tree and click
the "Go online" button from the Project View:

Figure 12.1 – Going online

If this is the first time to go online with this CPU. In that case, you must select the type
of PG/PC interface and the specific PG/PC interface from the Go Online dialog before
establishing an online connection to a CPU found on that interface.

If the CPU has protection of confidential PLC configuration data (Page 146), you might be prompted to trust the
CPU. You can display and verify the CPU's certificate and decide whether to trust or abort the CPU's online
connection. After connection, the orange frame indicates an online connection. You can now use the Online &
diagnostics tools from the Project tree and the Online tools task card.

- 165 - Version 1.0

Online & Diagnostics
Going online and connecting to a CPU

12.2.1 Local settings

The Internet Protocol (IP) is the basis for all TCP/IP networks. It creates so-called datagrams (data packets
specially tailored to the Internet Protocol) and handles their transports within the local subnet or their “routing”
(forwarding) to other subnets.

IP addresses are not assigned to a specific computer but rather to its network interfaces. Therefore, a computer
with several network connections (for example, routers) must be assigned an IP address for each connection.

IP addresses consist of 4 bytes. With the dot notation, each byte is expressed by a decimal number between 0
and 255. The four decimal numbers are separated by dots (see picture).

Every Ethernet interface is assigned a fixed address by the manufacturer that is unique worldwide. This address
is referred to as the hardware or MAC address (Media Access Control). It is stored on the network card and
uniquely identifies the Ethernet interface in a local network. Cooperation among the manufacturers ensures that
the address is unique worldwide.

The subnet mask specifies which IP addresses in the local network can be accessed. It separates the IP address
into the network and device parts.

Only IP addresses whose network part is the same can be accessed. e.g.:

Subnet mask = 255.255.255.0 and IP address =192.168.111.10

accessible IP addresses: 192.168.111.1 to 192.168.111.254

The setting of the PG’s IP address can be made as shown in Figure 12.2.

If an online connection is to be established between the programming device and the CPU, both devices must
be assigned the same subnet mask and IP addresses.

Figure 12.2 – Local network settings (in Windows 10)

- 166 - Version 1.0

Online & Diagnostics
Comparing offline and online CPUs

12.3 Comparing offline and online CPUs

You can compare the code blocks in an online CPU with the code blocks in your project. If the code blocks of
your project do not match the code blocks of the online CPU, the "Compare" editor allows you to synchronise
your project with the online CPU by downloading the code blocks of your project to the CPU or by deleting blocks
from the project that do not exist in the online CPU.

Select the CPU in your project.

Use the "Compare Offline/online" command to open
the "Compare" editor. (Access the command either
from the "Tools" menu or by right-clicking the CPU in
your project.)

Click in the "Action" column for an object to select

whether to delete the object, take no action, or
download the object to the device.
Click the "Synchronize" button to load the code
blocks.

Right-click an object in the "Compare to" column and

select "Start detailed comparison" button to show the
code blocks side-by-side.
The detailed comparison highlights the differences
between the code blocks of online CPU and the code
blocks of the CPU in your project.

SYMBOL MEANING
The folder contains objects whose online and offline versions differ.

The result of comparison is unknown

Online and offline versions of the object are identical.

Online and offline versions of the object are different.

Object only exists offline.

Object only exists online.

Table 12.3 – Symbols used when comparing

- 167 - Version 1.0

Online & Diagnostics
Monitoring and modifying values in the CPU

12.4 Monitoring and modifying values in the CPU

STEP 7 provides online tools for monitoring the CPU:
• You can display or monitor the current values of the tags. The monitoring function does not change the
program sequence. It presents you with information about the program sequence and the program's
data in the CPU.
• You can also use other functions to control the sequence and the data of the user program:
• You can modify the tags' values in the online CPU to see how the user program responds.
• You can force a peripheral output (such as Q0.1:P or "Start":P) to a specific value.
• You can enable outputs in STOP mode.

Always exercise caution when using control functions. These functions can seriously
influence the execution of the user/system program.

EDITOR MONITOR MODIFY FORCE

Watch table ✔ ✔ ✘
Force table ✔ ✘ ✔
Program editor ✔ ✔ ✘
Tag table ✔ ✘ ✘
DB editor ✔ ✔ ✘
Table 12.4 - Online capabilities of the STEP 7 editors

- 168 - Version 1.0

Online & Diagnostics
Monitoring and modifying values in the CPU

12.4.1 Monitoring Tags

Figure 12.3 – Monitoring Tags in the tag table

PLC Tags can be monitored directly through the PLC tag table. In so doing, the “Monitor value shows the current
value of the tags in the CPU.

- 169 - Version 1.0

Online & Diagnostics
Monitoring and modifying values in the CPU

12.4.2 Monitoring a Block

The test function Monitor block follows the program execution within a block. At the time of the program
execution, the statuses or contents of the operands used in the block are displayed on the monitor.

Blocks can only be monitored if an online connection to the CPU exists. Furthermore, the offline block must be
identical to the online block. If the offline opened block does not match the block stored online in the CPU, either
the online stored block must be opened, or the offline opened block must be downloaded into the CPUT before
you can monitor, and then you can monitor the block.

In test mode, the statuses of operands and LAD/FBD elements are presented in different colors. You can set
this via Options -> Settings.

Figure 12.4 – Monitoring a block

Block Status
The Monitor Block test function follows the program execution within a block. For this, the states or contents
of the operands used in the block during program execution are displayed on the screen. You can activate the
"Monitor" ("Block Status")test mode for the block that is currently open in the LAD/STL/FBD Editor by clicking
the Glasses icon.

At the beginning of the test function, whether the block to be monitored is opened online or offline in the Editor
is insignificant. Should the block opened offline not match the block saved online in the CPU, you first either
have to open the block saved online or load it offline into the CPU and then monitor it.

ln the test mode, the states of the operands and LAD / FBD elements are displayed in different colours. You
define these by selecting the menu option Options -> Settings.

The Status display is only active when the CPU is in RUN mode, and the instructions to
be monitored are being processed!

- 170 - Version 1.0

Online & Diagnostics
Monitoring and modifying values in the CPU

Modify Tags
When the "Monitor block" test function is activated, tags can be modified to status '0' or '1'. The status is
assigned once. When you use tags that are not Boolean, you can modify them via the menu item Modify
operand.
If the tag whose status was changed is not overwritten by the program, it remains at the assigned status. If, for
example, an output is modified to status '1' and the program does not overwrite this tag, the output remains
switched on or to status '1'.

Figure 12.5 – Modifying tags

- 171 - Version 1.0

Online & Diagnostics
Watch tables

12.5 Watch tables

A watch table allows you to perform monitoring and control functions on data points as the CPU executes your
program. These data points can be process image (I or Q), M, DB or physical inputs (I_:P), depending on the monitor
or control function. You cannot accurately monitor the physical outputs (Q_:P) because the monitor function only
displays the last value written from Q memory and does not read the actual value from the physical outputs.

The monitoring function does not change the program sequence. It presents you with information about the
program sequence and the program's data in the CPU.

Control functions enable the user to control the program's sequence and data. However, you must exercise
caution when using control functions, as they can seriously influence the execution of the user/system program.
The three control functions are Modify, Force, and Enable Outputs in STOP.

With the watch table, you can perform the following online functions:

• Monitoring the status of the tags

• Modifying values for the individual tags
You select when to monitor or modify the tag:

• Beginning of scan cycle: Reads or writes the value at the beginning of the scan cycle
• End of scan cycle: Reads or writes the value at the end of the scan cycle
• Switch to stop
To create a Watch table:
1. Double-click "Add new watch table" to open a new watch table.
2. Enter the tag name to add a tag to the watch table. The following
options are available for monitoring tags:
• Monitor all: This command starts monitoring the visible tags in
the active watch table.
• Monitor now: This command starts monitoring the visible tags in
the active watch table. The watch table monitors the tags
immediately and once only.

You can choose any name for the Watch table. Saved Watch tables can be
reused to monitor and modify variables so that a renewed input of the
variables to be monitored is no longer necessary.
Figure 12.6 - Create a watch table

The following options are available for modifying tags:

• "Modify to 0" sets the value of a selected address to "0".

• "Modify to 1" sets the value of a selected address to "1".
• "Modify now" immediately changes the value for the selected addresses for one scan cycle.
• "Modify with trigger" changes the values for the selected addresses.
• This function does not provide feedback to indicate that the selected addresses were modified. If input
of the change is required, use the "Modify now" function.
• "Enable peripheral outputs" disables the command output disable and is available only when the CPU is
in STOP mode.
You must have an online connection to the CPU to monitor the tags.

- 172 - Version 1.0

Online & Diagnostics
Watch tables

Figure 12.7 – Watch table

You use the buttons at the top of the watch table to select the various functions.

Enter the tag name to monitor and select a display format from the dropdown selection. With an online connection
to the CPU, click the "Monitor" button to display the actual value of the data point in the "Monitor value" field.

You can choose the columns displayed in the Watch table via the menu “View”. The columns have the following
meanings:

COLUMN DESCRIPTION
Name The symbolic name of the variable (tag)
Address The absolute address of the variable (tag)
Symbol comment Comment on the variable (tag) displayed
Display format A data format you can choose per mouse click (such as binary or decimal) in which the content
of the variable (tag) is displayed
Monitor value Variable (tag) value in the selected status format
Modify value Value to be assigned to the variable (tag)
Table 12.5 - Columns in a watch table

- 173 - Version 1.0

Online & Diagnostics
Watch tables

12.5.1 Monitor / Modify Variables (Tags)

Trigger Points
You can define the trigger points for monitoring and modifying through the “Monitor with trigger or Modify with
trigger” columns. The “Trigger Point for Monitoring” specifies when the values of the monitored variables are to
be updated on the screen. The “Trigger Point for Modifying” specifies when the given modified values are to be
assigned to the variables being modified.

Figure 12.8 – Trigger points

Trigger Conditions
The “Trigger Condition for Monitoring” specifies whether the values are to be updated on the screen once only
when the trigger point is reached or permanently (when the trigger point is reached).

The “Trigger Condition for Modifying” specifies whether the given modified values are to be assigned to the
variables being modified once only or permanently (every time the trigger point is reached).

- 174 - Version 1.0

Online & Diagnostics
Watch tables

Triggering determines at what point in the scan cycle the selected address will be monitored or modified.

Trigger Description
Permanent Continuously collects the data
At scan cycle start Permanent: Continuously collects the data at the start of the scan cycle, after
the CPU reads the inputs
Once: Collects the data at the start of the scan cycle, after the CPU reads the
inputs
At scan cycle end Permanent: Continuously collects the data at the end of the scan cycle, before
the CPU writes the outputs
Once: Collects the data once at the end of the scan cycle, before the CPU
writes the outputs
At transition to STOP Permanent: Continuously collects data when the CPU transitions to STOP
Once: Collects the data once after the CPU transitions to STOP
Table 12.6 - Type of triggers

To modify a PLC tag at a given trigger, select either the cycle's start or end.
• Modifying an output: The best trigger event for modifying an output is at the end of the scan cycle,
immediately before the CPU writes the outputs.
Monitor the value of the outputs at the beginning of the scan cycle to determine what value is written to
the physical outputs. Also, monitor the outputs before the CPU writes the values to the physical outputs
to check program logic and compare them to the actual I/O behaviour.

• Modifying an input: The best trigger event for modifying an input is at the start of the cycle, immediately
after the CPU reads the inputs and before the user program uses the input values.
If you suspect values are changing during the scan, you might want to monitor the value of the inputs at
the end of the scan cycle to ensure that it has not changed from the start of the scan cycle. If there is a
difference in the values, your user program might be erroneously writing to the inputs.

To diagnose why the CPU might have gone to STOP, use the "Transition to STOP" trigger to capture the last
process values.

- 175 - Version 1.0

Online & Diagnostics
Snapshots

12.6 Snapshots
Using snapshots is a great way to back up the current values in a DB and make them the start values for a global
DB. For later use, you can capture a snapshot of the actual values of data block tags from an online CPU. Note
the following prerequisites:

• You must have an online connection to the CPU.

• You must have the DB open in STEP 7.

12.6.1 Capturing a snapshot

To capture a snapshot, follow these steps:

1. In the DB editor, click the "Monitor all tags" button: The "Monitor value" column displays the actual
data values.
2. Click the button to capture a snapshot of the actual values and display them in the "Snapshot" column.
You can use this snapshot later to update the actual CPU values or to replace the start values.

12.6.2 Copying the snapshot values to the CPU

To copy the snapshot values to the actual values of the data block tags in the CPU, click the following button:

The online CPU loads the snapshot values into the actual values. The Monitor value column shows the actual
values in the CPU. Subsequent scan cycles might change the CPU values from the snapshot values, but at the
time you make the copy, the CPU loads the snapshot values in a consistent download.

Be aware that if your snapshot contains state information, timer values, or calculated
information, the CPU restores those values as of the time you made the snapshot.

12.6.3 Copying the snapshot values to the start values

To copy the snapshot values to the start values of the data block tags, click the following button: . After you
compile the DB and download it to the CPU, the DB uses the new start values when the CPU goes to RUN mode.

12.6.4 Copying individual snapshots or monitor values to start

values
The data block editor also lets you copy and paste individual values over start values. Right-click a value in any
value column and select Copy to place it in the Windows clipboard. Then, you can right-click on any start value
and select paste to replace that value with the value in the clipboard.

After you compile the DB and download it to the CPU, the DB uses the new start values when the CPU goes to RUN
mode.

- 176 - Version 1.0

Online & Diagnostics
Enabling outputs in STOP mode

12.7 Enabling outputs in STOP mode

The watch table lets you write to the outputs when the CPU is in STOP mode. This functionality allows you to
check the wiring of the outputs and verify that the wire connected to an output pin initiates a high or low signal to
the terminal of the processing device to which it is connected.

Risks in writing to physical outputs in STOP mode.

Even though the CPU is in STOP mode, enabling a physical output can activate the process
point to which it is connected, possibly resulting in unexpected equipment operation.
Unexpected equipment operations can cause death or severe personal injury.
Before writing to an output from the watch table, ensure that changing the physical
output will not cause unexpected equipment operation. Always observe safety
precautions for your process equipment.

You can change the state of the outputs in STOP mode when they are enabled. If the outputs are disabled, you
cannot modify them in STOP mode. To enable the modification in STOP mode of the outputs from the watch table,
follow these steps:

1. Select the "Expanded mode" menu command from the "Online" menu.
2. Select the "Enable peripheral outputs" option of the "Modify" command of the "Online" menu or from the
context menu after right-clicking the row of the Watch table.
You cannot enable outputs in STOP mode if you have configured distributed I/O. When you try to do this, an error
is returned.

Setting the CPU to RUN mode disables the "Enable peripheral outputs" option.

If any inputs or outputs are forced, the CPU cannot enable outputs while in STOP mode. The force function must
first be cancelled.

- 177 - Version 1.0

Online & Diagnostics
Forcing values in the CPU

12.8 Forcing values in the CPU

12.8.1 Using the force table

A force table provides a "force" function that overwrites the value for an input or output point to a specified value for
the peripheral input or peripheral output address. The CPU applies this forced value to the input process image
prior to the execution of the user program and to the output process image before the outputs are written to the
modules.

The force values are stored in the CPU, not the force table.

You cannot force an input (or "I" address) or an output (or "Q" address). However, you can
force a peripheral input or peripheral output. The force table automatically appends a ":P"
to the address (for example: "On":P or "Run":P).

Figure 12.9 – Force table

In the "Force value" cell, enter the value for the input or output to be forced. You can then use the check box in the
"Force" column to enable the forcing of the input or output.

Use the "Start or replace forcing" button to force the tags' values in the force table. Click the "Stop forcing"
button to reset the tags' values.

In the force table, you can monitor the status of the forced value for an input. However, you cannot monitor the
forced value of an output.

When an input or output is forced in a force table, the force actions become part of the
project configuration. If you close STEP 7, the forced elements remain active in the CPU
program until they are cleared. To clear these forced elements, you must use STEP 7 to
connect with the online CPU and then use the force table to turn off or stop the force
function for those elements.

- 178 - Version 1.0

Online & Diagnostics
Forcing values in the CPU

The Force active shows which variable (Tag)

is forced.

Figure 12.10 - Signalling Force in the online editor

You can also view the status of the forced value in the program editor, as shown in Figure 12.10.

12.8.2 Operation of the Force function

The CPU allows you to force input and output point(s) by specifying the physical input or output address (I_:P or
Q_:P) in the force table and then starting the force function.

In the program, reads of physical inputs are overwritten by the forced value, which the program uses in
processing. When the program writes a physical output, the output value is overwritten by the force value, which
appears at the physical output and is used by the process.

When an input or output is forced in the force table, the force actions become part of the user program. Even
though the programming software has been closed, the force selections remain active in the operating CPU
program until they are cleared by going online with the programming software and stopping the force function.
Programs with forced points loaded on another CPU from a memory card will continue to force the points
selected in the program.

If the CPU executes the user program from a write-protected memory card, you cannot initiate or change the
forcing of I/O from a watch table because you cannot override the values in the write-protected user program. Any
attempt to force the write-protected values generates an error. If you use a memory card to transfer a user
program, any forced elements on that memory card will be transferred to the CPU.

Digital I/O points assigned to HSC, PWM, and PTO cannot be forced

The digital I/O points used by the high-speed counter (HSC), pulse-width modulation
(PWM), and pulse-train output (PTO) devices are assigned during device configuration.
When digital I/O point addresses are assigned to these devices, the values of the
assigned I/O point addresses cannot be modified by the force function of the force table.

- 179 - Version 1.0

Online & Diagnostics
Hardware diagnostics

12.9 Hardware diagnostics

12.9.1 Diagnosing Hardware

You must open the "Device configuration" and establish an online connection to use this function. The online
view of the hardware gives information about the modules' status or operating status. A module has diagnostic
information, and when you see the diagnostic symbols, it indicates the associated module's status or the CPU's
operating status.

In the example shown in Figure 12.11, the analogue input module (slot 4) has triggered a diagnostic interrupt,
which has caused the CPU to go into STOP mode.
Both modules have been given symbols accordingly. The CPU's diagnostic buffer is output via the Context menu
and subsequent starting of "Online & diagnostics". For the analogue module, the associated diagnostic data
(see Figure 12.11).

Figure 12.11 – Online diagnostics

- 180 - Version 1.0

Online & Diagnostics
Hardware diagnostics

ICON MEANING
No fault
Maintenance required
Maintenance demanded
Error
Hardware error in lower-level components:
The online and offline versions differ (only in the project tree) in at least one lower-level hardware
component.
Software error in lower-level components:
The online and offline versions differ (only in the project tree) in at least one lower-level hardware
component.
Online and offline versions of the object are different.
Object only exists online.
Object only exists offline.
Online and offline versions of the object are the same.
Table 12.7 – Meaning of online symbols

12.9.2 General

Figure 12.12 – Online diagnostics

Online and Diagnostics

The Module lnformation function reads the most critical data from the directly connected module. You will find
additional information in the individual tabs:

• General: Among other things, the module designation, hardware and firmware versions
• Diagnostic status: Current status of the module

- 181 - Version 1.0

Online & Diagnostics
Hardware diagnostics

• Diagnostics buffer: It contains all diagnostic events in the order they occurred. In the display, all events
are listed in plain language and in the order in which they occurred.
• Cycle time: This displays the selected minimum time and monitoring time, as well as the shortest,
longest, and current cycle times.
• Memory: information about the entire size, including how many bytes are used and how many are free
in the Load memory, Code work memory, Data work memory, and Retain memory.
• Display: General information about the Display used (Article number, Firmware, etc.)

12.9.3 CPU Diagnostics Buffer

Use the diagnostics to review the recent activity in the CPU. The diagnostic buffer is accessible from “Online &
Diagnostic” for an online CPU in the Project Tree. It contains the following entries:

• Diagnostic events
• Changes in the CPU operating mode (transition to STOP or RUN mode)

The first entry contains the latest event. Each entry in the diagnostics buffer includes the date and time the
event was logged and a description. A maximum of 50 entries is supported. Resetting the CPU to the factory
settings deletes the entries.

A maximum of 50 entries is supported. Resetting the CPU to the factory settings deletes the entries in the
diagnostics buffer.

Figure 12.13 – Online diagnostics

- 182 - Version 1.0

Online & Diagnostics
Hardware diagnostics

Diagnostics Buffer
The diagnostics buffer is a buffered memory area on the CPU organised as a circular buffer. It contains all
diagnostics events (error messages, diagnostic interrupts, startup information etc.) of the CPU in the order in
which they occurred. The highest entry is the last event to occur. All events can be displayed on the programming
device in plain language and in the order in which they occurred.

The size of the diagnostics buffer depends on the CPU. Also, not all of it is buffered with Power OFF (only a part
is retentive).

• Number of entries, 1000 to 3200

• Of that, 500 to 1000 retentive

Details on Event
Some additional information is also provided for the selected event in the "Details on event" box:

• Event name and number

• Additional information depending on the event, such as the address of the instruction that caused the
event etc

The IP address must be assigned in the device in order to view the diagnostic events in
the CPU.

- 183 - Version 1.0

Human Machine Interface (HMI)

13 Human Machine Interface (HMI)

Due to production processes are becoming more and more complex and requirements for machine and plant
functionality are increasing, operators need a powerful tool for controlling and monitoring production plants. An
HMI system (human-machine interface) represents the interface between man (operator) and process
(machine/plant). It is the controller that actually controls the process. Hence, there is an interface between the
operator and WinCC (at the HMI device) and an interface between WinCC and the controller.

13.1 Introduction

13.1.1 Data exchange

Data is exchanged between SIMATIC S7 and the HMI system via tags. In the HMI device's configuration, screen
objects such as buttons and input/output fields are linked to HMI tags, which in turn are connected to the CPU's
PLC tags. The HMI system cyclically exchanges the values between these tags. Data is transferred cyclically
between SIMATIC S7 and the HMI system; that is, process variables are cyclically read by the HMI device
depending on the configured update time.

HMI tags can be connected to the global PLC tags or the following global data areas of the CPU:

• Data blocks (DB)

• Bit memories (M)
• Inputs (I) and outputs (Q)
• Peripheral inputs and outputs
HMI systems also recognise local tags without a link to the PLC. These tags are exclusively processed internally
and do not reserve any communication resources.

Operator panels can communicate with the (PLC) controller via the PROFIBUS or Industrial Ethernet bus
systems. The S7 protocol is used for this purpose. Communication is handled by the operating systems of the
S7 CPU and the HMI system. No user programming effort is required. An operator panel can also exchange data
with several (PLC) controllers.

Access to tags in DBs

When reading tags from DBs, ensure the HMI has access to the tags in the DB. This can
be done in the DB itself, as shown in Figure 13.1.

Figure 13.1 – Permissions for HMI

- 184 - Version 1.0

Human Machine Interface (HMI)
WinCC – Basic configuration interface

13.2 WinCC – Basic configuration interface

Figure 13.2 – WinCC primary interface

Project Window
The Project tree displays all devices and their configuration and parameter assignments in a tree structure. The
relevant editors can be opened from there. Furthermore, the "language support" and the "version management"
can also be found here.

Working Area
This is the central configuration area in which the operator panel's objects are edited with the started editor.
Several editors can be opened at the same time.

Properties Window
The Properties window allows you to edit the properties of selected objects (for example, screens, screen
objects, and tags). This window is only available in editors where object properties have to be set.

Toolbox Window
The toolbox window contains all configurable objects that can be configured on screens and permits library
access.

- 185 - Version 1.0

Human Machine Interface (HMI)
Adding an HMI device to the project

13.3 Adding an HMI device to the project

New HMI devices can be added in both the Portal view and Project view. More than anything, attention must be
paid to device data such as the article (order) number and version number.

Portal view

Proj ect view

Figure 13.3 – Adding HMI to a project

- 186 - Version 1.0

Human Machine Interface (HMI)
Adding an HMI device to the project

13.3.1 Configuring the IP Address of a Touch panel

Whether the Devices & Networks editor is in the Devices view or the Network view, the settings of the PROFINET
interface (IP address and subnet mask) can be made in the "Properties" tab in the Inspector window for a
selected HMI device interface.

Select interface
This address must also be
set manually on the TP

Figure 13.4 – Adding HMI to a project

If an online connection between the HMI device and the CPU is to be established, both devices must be assigned
the same subnet mask and IP addresses.

- 187 - Version 1.0

Human Machine Interface (HMI)
Adding an HMI device to the project

Show / Hide
IP addresses

Figure 13.5 – Adding HMI to a project

During networking, devices are connected to a subnet. The device interface must be compatible with the type of
network. The devices are networked with the "Devices & networks" editor in the "Network" view by connecting
the device interfaces using drag & drop.

- 188 - Version 1.0

Human Machine Interface (HMI)
Adding an HMI device to the project

13.3.2 Configuring an HMI Connection

Figure 13.6 – Adding HMI to a project

In configuring the HMI connection(s), the communications partners with which the HMI device will later
exchange data in the process control phase are defined. The HMI device can also connect or exchange data
with several controllers.

Controllers in the same network with which the HMI device does not exchange data can also exist. In this case,
the HMI device is "networked" with these controllers but is not "connected."

- 189 - Version 1.0

Human Machine Interface (HMI)
Downloading an HMI project into the touch panel

13.4 Downloading an HMI project into the touch panel

When you transfer an HMI project to one or more operator panels, the part of the project that has been changed
since the last transfer is automatically compiled before downloading. This ensures that the current project
status is always transferred. It is also possible to activate the option "Overwrite all" before loading starts.

Figure 13.7 – Adding HMI to a project

For commissioning, the project should be completely compiled using the command "Compile > Software
(rebuild all blocks)" in the context menu of the operator panel. If HMI tags linked to PLC tags are also used in
the project, all modified STEP 7 blocks should be compiled using the command "Compile > Software" in the
context menu and then downloaded into the CPU.

It is also advisable to execute the "Compile > Software (rebuild all blocks)" command occasionally to reduce the
time required to compile delta data in current engineering sessions.

- 190 - Version 1.0

Human Machine Interface (HMI)
Downloading an HMI project into the touch panel

Adding an HMI device to your project is easy!

1. Double-click the “Add new device” icon.

2. Click the “SIMATIC HMI” button in the “Add
new device” dialog.
3. Select the specific HMI device from the list.
You can choose to run the HMI wizard to help you
configure the screens for the HMI device.
4. Click “OK” to add the HMI device to your
project.

- 191 - Version 1.0

Human Machine Interface (HMI)
Downloading an HMI project into the touch panel

The TIA Portal adds the HMI device to the project and provides an
HMI wizard that helps you configure all of the screens and
structures for your HMI device.

The TIA Portal creates a simple default HMI screen if you do not run
the HMI wizard. You can add additional screens or objects on
screens later.

Creating a network is easy!

• Go to “Devices and Networks” and select the Network view to

display the CPU and HMI device.
• To create a ProfiNET network, drag a line from the green box
(Ethernet port) on one device to the green box on the other device.

A network connection is created for the two devices.

You can use other options for creating an HMI connection:

• Dragging a PLC tag from the PLC tag table, the program editor
or the device configuration editor to the HMI screen editor
automatically creates an HMI connection.
• Using the HMI wizard to browse for the PLC automatically
creates the HMI connection.

- 192 - Version 1.0

Human Machine Interface (HMI)
Adding elements

13.5 Create an HMI screen

13.6 Adding elements

A meaningful screen needs to contain information and the ability to control something. This is done with control
elements.

The operator can initiate system functions via buttons, such as selecting a screen or setting and resetting a tag.
The "Events" of a button specifies which system function is to be executed for which event.

Tag values are displayed via output fields, and they can also be preset via input fields. The mode can be set in
the Properties window.

The following sections describe some basic control elements and show you how to use their properties. All of
these properties can be combined into elements. For example, you can change the background colour of a
button depending on a value in the PLC.

You can also create elements on your screen by dragging and dropping PLC tags from the Project tree or the
program editor to the HMI screen. The PLC tag becomes an element on the screen. You can then use the
properties to change the parameters for this element.

13.6.1 Buttons
Buttons are used to navigate between screens, activate settings, and so on.

Navigation
Within the Properties of a button, the behaviour of the button is defined. For navigation, an event is configured.
The button is shown in Figure 13.8.The ActivateScreen function is added and configured in the Events tab. When
the button is released, the screen _MixerTank is shown.

Figure 13.8 – Button for screen switching

- 193 - Version 1.0

Human Machine Interface (HMI)
Adding elements

Actions
If a button is used to activate a function in the PLC, such as the booster function of the Milk Pump, another kind
of action is needed. Figure 13.9 shows the action SetBitWhileKeypressed on the event Press. The modified Tag
is MilkBooster_Activate.

Figure 13.9 – Button for modifying value

13.6.2 I/O Fields

I/O Fields are used to show data from the PLC on the HMI or receive data from the user. The I/O Field in Figure
13.10 shows the amount of liquid in the tank.

Figure 13.10 – I/O Field with the general properties

The PLC Tag containing the volume is DB_TankSystem_VolumeTank and has the type Real (floating point). There,
it only shows the value of the Tag; the type is set to Output. When set to Output, a user cannot change the value
from the HMI. If a Tag is used as input, for example, the mixing ratio between milk and water, the Type of the
Tag will be Input.

The parameters shown under Format change the representation of the value. In this case, it is represented as a
decimal. It is formatted as signed and shown as 3 digits before the ‘.’ and 1 digit after the ‘.’ (s999.9).

To show the unit of the volume (litres), go to Appearance on the Properties tab. Under Text, you can add the
unit, as shown in Figure 13.11.

- 194 - Version 1.0

Human Machine Interface (HMI)
Adding elements

Figure 13.11 – I/O Field with the appearance properties

13.6.3 Basic Objects

When a circle is used to show whether a motor is ON or OFF, its properties need to be adjusted. In the Properties
tag, navigate to the Animations tab. From there, you can add a new animation or select the current Appearance.
Select the Tag that contains the status you want to show, in this case, the tag Unit_MixerTankTags_Mixer_Active.

Figure 13.12 – Dynamic background of a circle element

You can add the behaviour of the circle in the table depending on the value of the tag. In this case, when the
value of the tag Unit_MixerTankTags_Mixer_Active is 0, the circle is grey. If it is 1, the circle is green.

- 195 - Version 1.0

PLCSim
Introduction to PLCSim

14 PLCSim
This appendix is an excerpt from the full S7-PLCSIM manual (S7-PLCSIM V17 Programming and Operating
Manual V17). Within this excerpt with STEP7, the TIA Portal programming software is indicated.

14.1 Introduction to PLCSim

S7-PLCSIM supports debugging and validating a single PLC program without requiring actual hardware. It allows
you to use all STEP 7 debugging tools, including the watch table, program status, online and diagnostics
functions, and others.

S7-PLCSIM also provides unique tools, including a SIM table, sequence editor, events editor, and scan control.

S7-PLCSIM operates in conjunction with STEP 7 programming in the TIA Portal. You use STEP 7 to perform the
following tasks:

1. Configure your PLC and any associated modules in STEP 7

2. Program your application logic
3. Download the hardware configuration and program to S7-PLCSIM in either Compact View or Project
View

Input values from the S7-PLCSIM SIM table editor and sequence editor in the Project view
are equivalent to the peripheral inputs on a physical CPU. At the start of each scan cycle,
these values are copied to the process image.
In STEP 7, peripheral input values cannot be modified. However, S7-PLCSIM allows you
to assign inputs in SIM tables and sequence tables, allowing you to simulate program
behaviour with different input values.

- 196 - Version 1.0

PLCSim
S7-PLCSIM concepts

14.2 S7-PLCSIM concepts

14.2.1 Two views: Compact view and Project view

With S7-PLCSIM, you can choose between two user interfaces: Compact and Project. The view you select will
depend on how you want to use S7-PLCSIM in conjunction with TIA Portal.

Compact view
Compact view (Page 199) consists of a tiny window with a limited number of controls and functionality. This
view will be helpful if you want to debug your program in STEP 7 rather than in the S7-PLCSIM Project view.

S7-PLCSIM launches in Compact view by default. You can change this in the Project View main menu under
Options > Settings to make Project View the default view.

Project view
The Project View (Page 201) contains the full functionality of S7-PLCSIM. Project View has the same look and
feel as the user interface on the TIA Portal.

The Project View consists of several components:

• Main menu and main toolbar

• Options and settings (accessed from the main menu)
• Project tree
• SIM table editor
• Sequence editor
• Events editor
• Online tools, including the operator panel and scan control settings

The Project View is helpful to you if you prefer to debug your program using the full functionality of S7-PLCSIM.

Switching between Compact View and Project View

Regardless of which view you selected as the default, you can easily switch between Compact View and Project
View by clicking the “switch views” button.

- 197 - Version 1.0

PLCSim
S7-PLCSIM concepts

14.2.2 Differences between a simulated PLC and a physical PLC

S7-PLCSIM differs from physical PLCs in the following areas. This is an incomplete list, and the whole list can
be found in the S7-PLCSIM manual (Siemens S7-PLCSIM manual V17).

I/O Device support

S7-PLCSIM does not support specialised I/O device functionality. It provides only process images and direct
access simulation of I/O registers.

You can observe this specialised functionality with, for example, analogue output range monitoring. On a
physical device, if the STEP 7 program writes an out-of-range value to an analogue output register, the analogue
module returns a diagnostic error. This does not occur in S7-PLCSIM.

Diagnostics
S7-PLCSIM does not support all error messages written to the diagnostic buffer. For example, S7-PLCSIM does
not simulate messages about bad batteries in the CPU or EPROM errors. However, S7-PLCSIM simulates most
program errors.

Time-based performance
Because S7-PLCSIM is software running on a programming device under the Windows operating system, the
scan cycle time and the exact time of actions in S7-PLCSIM are not the same as if PLC firmware performed
those actions.

If your program is highly dependent on the time that actions execute, do not evaluate your program based only
on the time results of your S7-PLCSIM simulation.

Flashing LEDs
STEP 7 and other tools can only flash LEDs on physical PLCs. You cannot flash the LEDs in either view of S7-
PLCSIM from STEP 7 or any other tool.

Instruction support
S7-PLCSIM supports most instructions for the simulated S7-1200 and S7-1200F, similar to a physical PLC.

You can download all programs that successfully compile to the virtual PLC. However, some instructions called
SFCs (system functions) or SFBs (system function blocks) are only partially supported, and your simulation
might not function as you expect.

S7-PLCSIM validates input parameters and returns valid outputs for programs with partially supported
instructions, but not necessarily what a real PLC with physical I/O would return. For example, S7-PLCSIM does
not support the SIMATIC SD memory card, so program instructions that save data on a memory card do not
save data when a simulation executes.

Timing dependencies
Programs that are very dependent on timing might be challenging to debug with a simulation due to differences
in timing between a software-based simulation and physical hardware.

- 198 - Version 1.0

PLCSim
Working in Compact View

S7-1200: Technology module and technology object support

S7-PLCSIM does not simulate the following technology modules and technology objects:

• Counting
• PID
• Motion control

14.3 Working in Compact View

Compact view is the default view for S7-PLCSIM and uses less screen space than the Project view (see page
201). If you prefer to launch in Project View, you can change the default view from the Project View main menu
under Options > Settings.

You cannot perform project actions or run sequences in Compact View. You must switch to Project View to use
these functions.

When you launch S7-PLCSIM in Compact View, it opens with no project and no simulation, as shown on the left
in Figure 11.24.

Figure 14.1 – PLC SIM Compact views

- 199 - Version 1.0

PLCSim
Working in Compact View

14.3.1 Description of the Compact View user interface

When configured and connected to a CPU, Compact View appears as shown on the right side of Figure 11.24.
The compact view has the following sections, as described in Table 14.1.

SECTION DESCRIPTION
Title bar The title bar displays the S7-PLCSIM logo and three control buttons:
• "Keep on top" button - Causes Compact view to display on top of all other windows
• Minimize button - Standard Windows functionality
• Close button - Standard Windows functionality
CPU name This section of the Compact view shows the name and type of the virtual PLC. Different text is
displayed based on the state of the application:
• "<no simulation>": S7-PLCSIM has no open simulation
• "Unconfigured": S7-PLCSIM has an unconfigured simulation. You have not yet
downloaded a project from STEP 7 to S7-PLCSIM
• CPU name and CPU type: S7-PLCSIM has a configured simulation. The CPU name and
CPU type correspond to the STEP 7 project's device configuration. Example: "PLC_1 [CPU
1517-3 PN/DP]"
The CPU name section also contains the "Switch to Project view" button.
CPU control panel The control panel includes the power button and these LEDs:
• RUN / STOP
• ERROR
• MAINT
Compact view also provides buttons for these functions:
• RUN
• STOP
• PAUSE
• MRES
These controls are only operational when S7-PLCSIM has an active, configured simulation. This
section also displays the IP address for each interface of a simulated CPU.
The functions of the Compact View control panel are the same as those of the operator panel
(Page 206) in the Project View.
Project name The project name section of Compact view displays the name of the S7-PLCSIM project if a
project exists. You do not need an S7-PLCSIM project to run a simulation. When you do not have
an open S7-PLCSIM project, this section displays "<no project>". When you have created or
opened an S7-PLCSIM project, you see the name of your project.
Table 14.1 - PLC Sim Compact view

- 200 - Version 1.0

PLCSim
Working in the Project view

14.4 Working in the Project view

14.4.1 Project view user interface

14.4.2 Project view user interface overview

The project view provides the full functionality of S7-PLCSIM, as shown in Figure 14.2.

Figure 14.2 – PLC SIM Project view

① Title bar It displays the project path and project name and buttons to switch to Compact view,
minimise the application, maximise the application, and close S7-PLCSIM.
② Menu bar Displays menus for project commands, edit commands, execute commands, options
settings, tool commands, window commands, and help commands.
③ Toolbar It provides buttons for projecting commands, editing commands, executing
commands, switching to a Compact view, splitting the display into horizontal or
vertical windows, and recording tool commands.
④ Project tree Displays the project name, SIM tables, sequences, and event tables.
You can drag the right bar of the Project tree to make it wider or narrower.
You can collapse the Project Tree by clicking "Collapse" or "Collapse automatically"
from the top right corner of the Project Tree frame.
⑤ Editor windows It provides editors for SIM tables, sequences, and event tables. You can display two
editors simultaneously, horizontally or vertically.
You can resize columns in SIM tables, sequences, and event tables by double-clicking
the dividing line between columns or by moving the dividing line left or right.
⑥ Editor bar and status bar Displays shortcuts to open editors and the status of the simulated PLC.
with progress display
⑦ Operator panel Displays the operator panel for the simulated CPU with operating mode and scan
control buttons
⑧ Scan control Provides configuration settings for scan control

- 201 - Version 1.0

PLCSim
Working in the Project view

Managing the workspace

If you split the screen vertically or horizontally, each pane contains either a "pin" icon or an "unpin" icon .
Click the "pin" icon to keep one of the panes constant as you view objects in the other pane. For example, if you
have several sequences, you can pin one to keep it visible while you cycle through other sequences in the
unpinned pane. Clicking Ctrl+F6 in an unpinned pane allows you to cycle between sequences (or any other work
area you want to view).

You can float, reposition, and resize editor windows. You can save your layout by clicking the "Save window
settings" button in the upper right corner of each editor.

Switching to Compact view from Project view

You can switch from Project View to Compact View by clicking the "Switch to Compact View" button on the
main toolbar.

14.4.3 The S7-PLCSIM menu bar

The S7-PLCSIM main menu provides the following functions:

MENU DESCRIPTION
Project (Page 203) It contains commands for creating new projects, opening existing projects, closing, deleting,
and saving projects, and exiting S7-PLCSIM. There is also a list of your most recent projects.
Edit (Page 203) Contains editing commands for the selected object.
Execute (Page 204) Switch the simulated PLC to RUN mode or to STOP mode.

Options (Page 204) It opens the settings dialog so you can adjust the application settings.

Tools (Page 204) Contains recording commands

Window (Page 204) Allows you to customise the workspace.

Help (Page 205) It opens the help system, provides a link to the Siemens Industry Online Support website, and
shows installed software details.
Table 14.2 - S7-PLCSim main menu

For most menu commands, S7-PLCSIM provides a toolbar button (Page 205) for the function.

- 202 - Version 1.0

PLCSim
Working in the Project view

Project menu commands

The project commands are as follows:

MENU TEXT DESCRIPTION

New Creates a new project (Page 44) and a new simulated PLC. If the
current project contains unsaved changes, you are asked to save the
project.
Open It allows you to navigate to the project you want to open. If your
current project contains unsaved changes, you are asked to save it.
Close Closes the current simulation project. If it contains unsaved changes,
you are asked to save the project.
Save Saves the simulation project using the current path and file name.
You cannot save a project during a download from STEP 7.
Save as This allows you to save your project with a new name and/or a new
path. "Save as" is disabled during a download from STEP 7.
Delete project Allows you to select a project for deletion.
<List of recent This allows you to open a project that you have recently saved. If
projects> your current project contains unsaved changes, you are asked to
save the project before opening your selected project.
Exit Closes the simulated PLC and the S7-PLCSIM application. If the
current project contains unsaved changes, you are asked to save the
project.

Edit menu commands

The edit functions are as follows:

MENU TEXT DESCRIPTION

Open object This menu item is enabled when an object that can be opened has
application focus. This is true when the focus is on the Project tree,
and one of the following elements is selected:
• The simulated PLC
• A SIM table
• A sequence

Undo Undo the last action.

Redo Redo the action that was undone.
Cut Standard clipboard Cut functionality. Cut is enabled or disabled
based on your current selection.
Copy Standard clipboard Copy functionality. Copy is enabled or disabled
based on your current selection.
Paste Standard clipboard Paste functionality. Paste is enabled or disabled
based on your current selection.
Delete Standard Delete functionality. Delete is enabled or disabled based
on your current selection.
Rename Allows you to rename the selected object. Rename is enabled when
you choose one of the following Project tree elements:
• A SIM table
• A sequence

Properties Not available

- 203 - Version 1.0

PLCSim
Working in the Project view

Execute menu commands

The Execute functions are as follows:

MENU TEXT DESCRIPTION

Start CPU This transitions the simulated PLC to RUN mode. When it is in STOP
mode, you can click the Start CPU button.
Stop CPU This transitions the simulated PLC to STOP mode. You can click the
Stop CPU button when the simulated PLC is in RUN mode.

Options menu commands

The options command are as follows:

MENU TEXT DESCRIPTION

Settings Allows you to make changes to the appearance and behaviour of
(page 208) S7-PLCSIM.

Tools menu commands

The Tools menu commands Record, Stop, and Pause (see page 224) enable you to record a series of actions in
the SIM table editor and save them in a sequence:

MENU TEXT DESCRIPTION

Start recording Starts recording actions in the SIM table editor
Stop recording Stops recording actions in the SIM table editor and creates a new
sequence from the recording
Pause recording Pauses a recording

Window menu commands

The window functions allow you to customise the workspace to fit your needs and to switch the application to
Compact view.

MENU TEXT DESCRIPTION

Close all Closes all open editor windows.
Minimise all It minimises all open editor windows. The editors are still active and
available by using the icons in the editor frame.
Compact view Transitions the application to Compact View. The main S7-PLCSIM
view becomes invisible.
Next editor Used to switch between open editor windows. The order in which
the open editors were opened is the same as the order in which they
were opened. "Next editor" is disabled if only one
editor is open.
Previous editor Used to switch between open editor windows. The order in which
the open editors were opened is the same as the order in which they
were opened. "Previous editor" is disabled if only one editor is open.
Split editor space It creates a vertically split workspace to view two editor windows
vertically concurrently.
Split editor space It creates a horizontally split workspace to view two editor windows
horizontally concurrently.
Unsplit editor Returns a vertically or horizontally split workspace to a single editor
space window.

- 204 - Version 1.0

PLCSim
Working in the Project view

Help menu commands

The help functions are as follows:

MENU TEXT DESCRIPTION

Show help Opens the help system.
Service & Support Provides a link to the Siemens Industry Online Support website.
in Internet
Installed software Displays information about your installed Siemens software,
including S7-PLCSIM and the TIA Portal version numbers.

14.4.4 S7-PLCSIM toolbar

The S7-PLCSIM toolbar provides the same functionality as the main menu and also allows for power on/power
off and CPU family selection.

The toolbar contains the following button groups:

BUTTON GROUP FUNCTION

Project commands (page203)

Edit commands (page203)

Power on or off the simulated CPU.

When powered off, change the CPU family.
Both functions are available on the Operator Panel (page 206) and Compact View (page 199).

Operating mode (Execute menu) (page204)

Undo and redo actions (see page 203)

Recording commands (Tools menu) (page 204)

Contains recording commands
Window display and Compact view selection (page 204)
Allows you to customise the workspace.

- 205 - Version 1.0

PLCSim
Working in the Project view

14.4.5 The Operator panel

The CPU operator panel contains the following:

• A button for powering on and powering off the CPU

• A CPU family drop-down list
• Status LEDs that enable you to see the operating mode and state of the CPU: RUN/STOP, ERROR, or
MAINT
• Buttons that enable you to change the CPU operating mode to RUN or STOP
• A PAUSE button to pause a scan that is running.
• An MRES button for resetting memory
• The CPU IP address or addresses

Button functions
You can use the power button to power off the CPU at any time, regardless of the scan mode (RUN, STOP, HOLD,
PAUSE, or ERROR).

Use the RUN button to place the CPU in RUN when the scan is in STOP or PAUSE mode.

Use the STOP button to place the CPU in STOP when the scan is in RUN, PAUSE, or HOLD mode. Use the PAUSE
button to pause a scan in RUN mode.

You can perform a memory reset of the CPU at any time regardless of the scan mode (RUN, STOP, HOLD, PAUSE,
or ERROR).

14.4.6 Project Tree description

The S7-PLCSIM project tree is similar in design and operation to the project tree in STEP 7. The top-level folder
in the tree represents the project and shows its name.

Figure 14.3 – PLC Sim Project tree

- 206 - Version 1.0

PLCSim
Working in the Project view

The project contains the following sections:

• SIM tables (page 209)

• Sequences (page 219)
• Event tables (Not described here)

SIM tables folder

A project can contain multiple SIM tables. This folder groups the project's SIM tables and provides functions for
working with SIM tables.

• Add new SIM table: Click this node to add a SIM table to your project. S7-PLCSIM creates a SIM table
with a unique name and displays the new, empty SIM table in the SIM table editor.
• Browse: The browse function (page 215) allows you to create a SIM table from a STEP 7 watch table,
force table, or PLC tag table.
• SIM table_1: By default, a new project contains a single SIM table named "SIM table_1".

Sequences folder
This folder contains the project's sequences. A project can contain multiple sequences.

• Add new sequence: Click this node to add a sequence to your project. S7-PLCSIM assigns the sequence
a unique default name and displays the new, empty sequence in the sequence editor.
• Sequence_1: A new project will default contain a single sequence named "Sequence_1".

Event tables folder

This folder contains the project's event tables. A project can contain multiple event tables.

• Add new event table: Click this node to add an event table to your project. S7-PLCSIM assigns the event
table a unique name and displays the new, empty event table in the event table editor.
• Event table_1: By default, a new project contains a single event table named "Event table_1".

- 207 - Version 1.0

PLCSim
S7-PLCSIM settings

14.5 S7-PLCSIM settings

14.5.1 Application settings

You can access the following application settings from the Options > Settings menu command:

Figure 14.4 – Application settings of PLC Sim

The application settings contain the following information:

SETTING DESCRIPTION
User name A user name that you can define and assign to the project. S7-PLCSIM creates
new projects with this user name until you change it.

User interface language Language for the S7-PLCSIM user interface

Mnemonic Specifies the mnemonics for programming:
"German" uses the German mnemonics, for example, "E1.0".
"International" uses international mnemonics, such as "I1.0".

Show a list of recently used projects Number of entries in the list of recently used projects in the "Project" menu

Open cascade automatically in tooltips. After a brief time, the tooltips expand to display a cascade containing
additional help.
If you deselect this option, you must expand the tooltips to see the cascade.

Confirm exit in Compact view if PLC is Selected: If you exit S7-PLCSIM from Compact view and have a configured PLC,
configured. Requires restart of S7-PLCSIM. you must confirm your choice to exit S7-PLCSIM. For this configuration setting
to take effect, you must restart S7-PLCSIM.
Not selected: You can exit from the Compact View without confirming.

Table 14.3 - Application settings

- 208 - Version 1.0

PLCSim
Working with SIM tables

14.6 Working with SIM tables

14.6.1 SIM tables and the SIM table editor

The S7-PLCSIM SIM table editor enables you to modify simulated inputs and read simulated outputs. It is similar
to a STEP 7 watch table, but the focus is on modifying peripheral inputs and reading peripheral outputs.

A simulation project can contain one or multiple SIM tables. You can configure various SIM tables concurrently
for the same simulated PLC.

Tag name and address display

When downloading a program from STEP 7, any open SIM table automatically monitors specified tags and
addresses.

Forced addresses
Forced values supersede typical S7-PLCSIM operations. Be aware that forced values might alter the behaviour
of your simulation.

14.6.2 SIM table editor description

The SIM table editor comprises two sections divided by a horizontal split view. The upper section contains the
SIM table grid, and the lower section includes the control view.

The SIM table grid

The SIM table grid is similar in design to a STEP 7 watch table, as shown in Figure 14.5.

Figure 14.5 – SIM Table grid

A simulation project can contain multiple SIM tables, but each SIM table must have a unique name. You can
rename a SIM table.

- 209 - Version 1.0

PLCSim
Working with SIM tables

SIM table toolbar

The icons on the toolbar perform the following actions:

ICON FUNCTION DESCRIPTION

Insert row Inserts a new, empty row immediately above the current cursor position.

Add row Inserts a new, empty row immediately below the current cursor position.

Modify all selected values. Write values in the "Consistent modify" column for rows with the check box
selected to write those values in consistent or batch mode.
Enable/disable modification By default, you can only write updates to inputs. When you click this button,
of non-inputs. you can also write updates to outputs, memory areas, and data block
addresses.
This button only indicates an editing option - it is not an online action.

Export to Excel (Page 213) Exports the contents of a SIM table in Microsoft Excel .xlsx file format.

Import from Excel (Page 213) Imports the contents of a Microsoft Excel .xlsx file into a SIM table.

Load project tags (Page 212) Load all tags downloaded from your STEP 7 project into the open SIM table.
This button is disabled if there are no currently downloaded tags.

Save window settings This function saves any changes you have made to the appearance of the SIM
table editor, such as column widths. The saved settings also apply to new SIM
tables that you create.
Table 14.4 - SIM Table toolbar

SIM table grid columns

The following table describes the SIM table columns:

Column Description
Indicator This column shows information about your SIM table entry.
(no column header) A purple tag icon appears in this column when a valid tag name is entered or when
you enter an address for a valid tag name from your downloaded
STEP 7 program.
If you have a Fail-Safe tag, the purple tag displays on a yellow background, just as it
does in the TIA Portal.
A red "X" appears if your entry has an error. An error message will display.

A force indicator displays if the address is forced in any way. For example, a
partially forced address displays the same force icon in the SIM table as an entirely
forced address.
Name Displays the tag name.
Address Displays the tag address.
Display format Different display formats are available and depend on the type of entry. Some examples include
Bool, Hex, and signed decimal (DEC +/-).
Monitor/Modify value Displays the entry's current value.
Bits If the address is a bit or byte address, a series of check boxes (one box per bit) will display in
the field. From left to right, the bit order is 7, 6, 5, 4, 3, 2, 1, 0.
Consistent modify This value is written to the PLC when you click the "Modify all selected values" button.
Select the check box in this column if you want the values in the row to be modified when you
click the "Modify all selected values" button on the toolbar.

Comment You can add a comment here to provide documentation for the SIM table entry.
Table 14.5 - SIM Table columns

- 210 - Version 1.0

PLCSim
Working with SIM tables

In the SIM table editor, you can reorder columns. To do so, drag a column header to its new position.

SIM table view shortcut menu

Right-click inside the SIM table grid to display the following context menu:

Figure 14.6 – Context menu of SIM Table grid

The context menu commands provide editing functions and SIM table functions.

For commands corresponding to buttons on the toolbar, the behaviour of these context menu commands is the
same as for the buttons.

The Delete command lets you delete a SIM table row or a value in an editable field.

The Rename command allows you to rename editable values in SIM table fields.

Control view
The SIM table control view contains two controls that you can use to adjust values easily:

• A slider for adjusting analogue values

• A push button for adjusting Boolean values
Note that you can also adjust these values in the table grid.

The slider and push button controls are described in detail in "Working with analogue and Boolean values in
Control view (Page 59)".

Undo and redo button behaviour.

You can undo and redo many actions in the SIM table. However, the following actions do not have undo and
redo support:

• Edit text for "Monitor/modify value"

• Clicking the "bits" checkboxes in the table view
• Modify all selected values (toolbar button)
• Export to Excel (toolbar button)
• Enable/disable modification of non-inputs (toolbar button)
Note that additional actions, such as downloading a program from STEP 7, might erase the contents of the
undo/redo queue.

- 211 - Version 1.0

PLCSim
Working with SIM tables

14.6.3 Creating and populating a SIM table

Overview of creating and populating a SIM table

You have the following options for adding or inserting rows in a SIM table or for creating an entire SIM table:

• Loading the tags (Page 212) from the STEP 7 project

• Copy and paste all, or a portion of, a STEP 7 tag table, watch table, or force table
• Import (Page 213) all, or a portion of, a STEP 7 tag table, watch table, or force table
• Use auto-fill (Page 214) to create additional rows based on a selected tag or address
• Browse (Page 215) and select a STEP 7 tag table, watch table, or force table
• Entering tag names manually

SIM table: load project tags from STEP 7

To load your STEP 7 tags into an open SIM table, use the "Load project tags" button on the SIM table editor
toolbar.

This button loads all the tags from your most current STEP 7 download.

If the most recent download did not have tags, the "Load project tags" progress indicator disappears quickly.
S7-PLCSIM loads no tags.

Monitoring and modifying values in table view

The "Monitor/Modify value" column displays the current value in the format you selected in the "Display format"
column. You can modify values in the SIM table individually, using this column, or in a consistent (batch) mode
using the "Consistent modify" column.

Some SIM table values might only update if the virtual PLC is in RUN mode. The SIM table monitors and updates
even as you enter new values.

Bit and byte value display

A check box appears in the "Bits" column if the address is a bit address.

If the address is a byte address, eight check boxes (one check box per bit) appear in the "Bits" column. The order
of the bits, from left to right, is: 7, 6, 5, 4, 3, 2, 1, 0.

The following image shows the representation of bits and bytes in a SIM table:

Figure 14.7 – Bit and Byte value representation

Expanding byte addresses

When you enter a byte address, a triangle icon appears beside the entry's name. The triangle icon indicates
that you can expand the entry.

When you click the triangle icon, the byte address expands to show separate entries for each bit in the byte. The
names and addresses for these "expanded" entries are read-only.

- 212 - Version 1.0

PLCSim
Working with SIM tables

Modifying non-input addresses

By default, you can only write values to inputs. The SIM table editor toolbar button allows you to also write
values to outputs, memory, timer, counter, and data block addresses.

Modifying individual values

Use the "Monitor/modify value" and "Bits" fields to enter a value that writes immediately to the simulated PLC.
Enter the new value in the "Monitor/ modify value" field to modify a value individually and immediately.

You can use the individual checkboxes in the "Bits" field to immediately change the values of individual bits in a
byte address. There is one check box per bit. An empty check box indicates a 0 or FALSE value. A selected check
box indicates a 1, or TRUE, value.

Modifying values in a consistent (batch) mode

You can update multiple values concurrently by entering the new values in the "Consistent modify" fields.

Select the check boxes for the fields you want to modify in the column headed by the "lightning bolt" icon:

A yellow triangle indicates that a value will be applied when you click the "Modify all selected values" button
on the toolbar. The button writes data for all the checked entries containing a modified value. A warning
message will appear if you do not have an active connection to the simulated PLC. Click this button.

SIM table: Import and export using Microsoft Excel

The S7-PLCSIM export button allows you to export an existing SIM table in .xlsx format, which can then be
imported into another SIM table within the same project or into a SIM table in a different project.

The import button allows you to create or expand a SIM table by importing contents from a .xlsx file. The
.xlsx file can contain the following contents:

• A different SIM table

• A STEP 7 tag table, watch table, or force table
Exporting a table from STEP 7 to a Microsoft Excel file
To export STEP 7 tables to Microsoft Excel, follow these steps:

• Select tags in a STEP 7 tag table, watch table, or force table. Note that the entire table is exported
regardless of the number of tags you select.
• Right-click and select "Export" from the shortcut menu.
• Select a location and name for the exported Excel file.
• Click "Open".
Result: The entire table is exported with the name and location you entered.

- 213 - Version 1.0

PLCSim
Working with SIM tables

Importing a table from a Microsoft Excel file into a SIM table

To import a Microsoft Excel file into a SIM table, follow these steps:

• Open a SIM table.

• Click the "Import" button in the SIM table toolbar or select "Import from Excel" from the SIM table
shortcut menu.
• Locate the Excel file you want to import. Note that the import file must be closed for it to work correctly.
• Click "Open".
Result: The .xlsx file contents appear in your SIM table.

Imported files with empty address fields

If your .xlsx file contains one or more empty address fields, a warning message will
appear stating that the import was only partially successful. An error icon will also
appear in the status indicator column for a row containing an empty address field.

Using auto-fill in the SIM table

You can populate your SIM table by using auto-fill. SIM table auto-fill works in the same way as in a STEP 7
watch table.

You must have at least one row already entered for auto-fill to use as a basis for incrementing addresses.

After a download, you can also auto-fill it with the "Name" field.

Auto-fill procedure
Use the following procedure to auto-fill rows in a SIM table:

1. Enter an address in the SIM table "Address" field. A small blue square appears on the bottom right corner
of the field.

2. Hover over the blue square. A plus sign ("fill handle") appears. Click and hold the mouse button while you
drag straight down to fill in the number of addresses you want to add.

3. S7-PLCSIM adds addresses in sequential order according to the selected tag. For example, beginning with
"I0.0" as the selected address and auto-filling three rows adds I0.1, I0.2, and I0.3.

4. If entries already exist in the cells you select to auto-fill, S7-PLCSIM prompts you to either "Overwrite
existing elements" or "Insert elements".

- 214 - Version 1.0

PLCSim
Working with SIM tables

Browsing to a STEP 7 table to create a SIM table

S7-PLCSIM can create SIM tables from PLC tag tables, watch tables, and force tables in STEP 7 projects. For
S7-PLCSIM to find these tables, STEP 7 with the TIA Portal Openness option must be running on your
programming device. If you have multiple instances of STEP 7 running, S7-PLCSIM can access the tables from
all running STEP 7 instances.

To create a SIM table from a STEP 7 table (PLC tag table, watch table, or force table), follow these steps:

1. In the S7-PLCSIM project tree, click Browse in the SIM tables folder to open the Browse dialog.S7-PLCSIM
displays a Browse dialog with all STEP 7 projects, PLCs, and tables from the running STEP 7 instances.
2. From the Browse dialog, navigate to the folder for a PLC, PLC tags, or Watch and Force tables for any PLC
in any project.
3. From the list of tables, select one or more to load to an S7-PLCSIM SIM table.

Figure 14.8 – PLC Tags

4. Click OK.

S7-PLCSIM creates a new SIM table for each selection that contains all tags in the table. The default name for
each SIM table is the table name in STEP 7.

Creating a new sequence from recorded SIM table editor actions

You can record actions in the SIM table editor to create a sequence and then play back those actions by running
the new sequence.

Procedure to create a new sequence from the SIM table editor

Follow these steps to create a new sequence from the SIM table editor:

1. Create a SIM table.

- 215 - Version 1.0

PLCSim
Working with SIM tables

2. Perform a download from STEP 7.

3. Click the "Start recording" button on the main toolbar or select "Start recording" from the Tools menu.
4. Enter actions in the SIM table section, such as adding and deleting entries and changing values individually
or in consistent (batch) mode.
5. To pause while recording your actions, click the "Pause recording" button on the main toolbar or select
"Pause recording" from the Tools menu.
6. To resume recording, click or select "Pause recording" again. After recording your actions, click the "Stop
recording" button on the main toolbar or select "Stop recording" from the Tools menu.

Result: S7-PLCSIM creates a new sequence from your recorded actions. The sequence appears in the
Sequences folder with a default name.

14.6.4 Working with values in the Control view

Overview of Control view

When you work with your STEP 7 program, you might want to simulate a gradual ramp up or ramp down of an
analogue value or simulate a momentary value change for a Boolean value. S7-PLCSIM provides an easy way
to adjust these values with two controls.

SIM table editor: Table view and Control view

The SIM table editor is horizontally divided into two views:

• Table view is the upper part of the editor and contains the SIM table grid and toolbar
• Control view is the lower part of the editor and contains a slider for adjusting numeric values and a
push-button for adjusting Boolean values
You can manage the SIM editor workspace by resizing the Table or Control view or by collapsing the Control
view.

Displaying Control view

To display the control view, you must select exactly one Table view row. If you select multiple rows, the Control
view will be empty.

If you select a Table view row with non-numeric data types, such as Char and Time_of_Day, the control view
remains empty.

Changing values in the Control view

When you switch focus from one Table view row to another, the Control view displays information related to the
newly selected row. When you choose and edit a row, the information in the Control view updates to reflect your
edits.

Control view displays context-sensitive controls based on the values in your Table view row selection:

If a numeric value is in your selected Table view row, the Control view displays the slider control (see page 217).

- 216 - Version 1.0

PLCSim
Working with SIM tables

If a Boolean value is present in your selected Table view row, the Control view displays the push button control
(see page 218).

Slider for numeric values in SIM table control view

The SIM editor displays the slider control when you select a row that contains a numeric value. The value can
be a BYTE, WORD, DWORD, or QWORD.

The slider control is not displayed if a selected row does not contain a numeric value.

Updating values
When you are not directly controlling the slider by clicking and dragging the handle, the slider updates
periodically to display the actual values in your simulation.

When you control the slider by clicking and dragging the handle, S7-PLCSIM writes the corresponding value to
the simulation approximately every 200 ms. If you record a sequence, the values are recorded in the sequence.

Be aware that a sequence has a minimum allowable delay between steps, and the
sequence editor will not accept a value below that minimum.

You can operate the slider handle only by using a mouse. The slider does not support keyboard input.

Controlling the valid value range

Process values often have a limited validity range. You can set a minimum and maximum value for the slider to
reflect the valid range of values for each table view row.

• The slider handle is in the leftmost position at the configured minimum of the valid value range.
• The slider handle is in the rightmost position at the configured maximum of the valid value range.

The slider displays the minimum and maximum values with the same data width and format as shown in the
selected Table view row. For example, a Table View row containing a DWORD value displayed in HEX format will
display in the same manner in the slider control. HEX format is treated as unsigned. The slider accepts negative
settings for signed values.

When the process value exceeds your configured limits, the slider control moves to the minimum or maximum
end of the range as much as possible since it cannot indicate the actual value.

Slider range defaults

Minimum and maximum values for "integer-like" data types default to the minimum and maximum values for
the given data width and format.

For example, if you have a memory address such as MW10 and choose HEX or Octal as the display format, S7-
PLCSIM does not know if the address contains a signed or unsigned value. Therefore, that address will be
treated as containing an unsigned value.

- 217 - Version 1.0

PLCSim
Working with SIM tables

For signed integers, the minimum value will be negative. Floating point values will default to a range minimum
of 0.0 and a maximum of 1.0.

Slider range persistence

Minimum and maximum values are persisted with the corresponding table row. Each row's minimum and
maximum values are saved when you save your project.

When you cut or copy and then paste a row, the minimum and maximum values are pasted.

Minimum and maximum values are included when importing and exporting SIM table contents.

Push button for Boolean values in SIM table control view

The SIM editor displays the push button control in Control View when you select a row containing a Boolean
value.

Push button use and behaviour

The push button control operates much like a physical momentary push button. When you click and hold the
button, the associated process value is modified. When you release the button, the process value is restored to
its default state.

Like a physical push button, it is write-only. The button's visual state does not change to match the actual
process value.

If you use another method to change the value at the same time, such as running a
sequence, the button might behave unexpectedly.

SIM table error conditions

The SIM table editor recognises several error conditions. When an entry error occurs, the cell containing the
error turns pink, an icon appears in the indicator column, and S7-PLCSIM does not gather data for that entry.
However, S7-PLCSIM continues to monitor all valid entries.

S7-PLCSIM recognises the following error conditions at the time of entry:

• Address is invalid (for example, syntactically incorrect)

• Address is out of range; that is, the address is too large for the physical memory of the hardware
• The Monitor/Modify value is out of range for the data type
An empty address field in the imported file
If an imported Microsoft Excel .xlsx file contains one or more empty address fields, a warning message informs
you that the import was only partially successful. Error icons in the status indicator column indicate rows with
empty address fields.

- 218 - Version 1.0

PLCSim
Working in the Sequence Editor

14.7 Working in the Sequence Editor

14.7.1 Sequences and the Sequence Editor

The purpose of a sequence is to simulate an external process interacting with your program. An external process
interacts with the PLC through inputs. Any time you enter an input address (%I) in the sequence editor, S7-
PLCSIM converts the address to a peripheral input address (%I:P) to simulate a physical input signal more
accurately.

Sequence editor and addresses

You can manipulate any of the following address areas within a sequence:

• Peripheral Inputs (%I:P)

• Outputs (%Q)
• Memory (%M)
• Data block (%DB)
• Timer (%T)
• Counter (%C)
With the sequence editor, you can define a set of timed value changes on inputs, outputs, and memory
addresses. The sequence can be used to simulate the behaviour of external devices on the running program.
This allows you to observe the effect of your program logic and to make any adjustments that might be
necessary.

A project can contain multiple sequences, but you can run only one sequence at a time. You might want to
create numerous sequences to see the effect of various adjustments to your program logic rather than
modifying a single sequence many times.

When you save your project, you save the sequences. You can replay them multiple times to assist in debugging
your program.

When a sequence is no longer helpful, you can delete it from your project.

Forced addresses
Forced values supersede S7-PLCSIM operations. Be aware that forced values might alter the behaviour of your
simulation.

Sequences and breakpoint functionality

When the program in the CPU reaches a breakpoint, S7-PLCSIM takes the following actions:

• Enters the HOLD state

• Either pauses or continues running sequences based on your selections in Settings (page 42)
When the CPU continues past a breakpoint, S7-PLCSIM restores the task card's scan control options (page 90).

Multiple sequences
You can have multiple sequences in a single project but only run one sequence at a time. When a sequence is
running, the "Start sequence" button is inactive for any other sequence.

Sequence editor description

S7-PLCSIM displays the sequence editor when you add a new sequence or edit a sequence:

- 219 - Version 1.0

PLCSim
Working in the Sequence Editor

Figure 14.9 – Sequence editor

A simulation project can contain one or multiple sequences. Each sequence must have a unique name.

Sequence editor toolbar

The Sequence editor toolbar includes the following functions:

BUTTON FUNCTION
Inserts a new empty step immediately above the currently selected
step.
Insert step
Inserts a new empty step immediately below the currently selected
step.
Add step
Enables a previously disabled step.

Enable step
Disables a step so it will be skipped when you run the sequence.

Disable step
Adjusts the time of the selected steps by a specified time increment.

Step time adjustment

Plays the sequence from the beginning.
The button is only available when the following conditions are true:
Start sequence • There are no other sequences currently running.
• There are no errors in the sequence.
You can also click this button to resume a paused sequence.
Immediately stops a running sequence.
Stop sequence

Pauses the sequence at the step that will execute next.

Pause sequence You must click the "Start sequence" button to resume your paused
sequence.
Loops your sequence until you manually stop the sequence.
Repeat sequence

This allows you to enter a time in milliseconds to increment the time

in the "Time" column for newly added rows. The valid range is 0 -
3600000 ms. Use the time format settings to change the time format.

Default interval and time format settings

Exports sequence to Excel format.
Export to Excel

- 220 - Version 1.0

PLCSim
Working in the Sequence Editor

It allows you to import an Excel spreadsheet or a trace measurement

file.

Import from Excel

Import from trace measurement
Displays the total execution time for a running sequence and the
number of repetitions for a repeating sequence.
Execution time
Saves any changes you have made to the appearance of the sequence
editor, such as column widths and split windows. The saved settings
Save window settings also apply to new sequences that you
create.
Sequence editor columns
COLUMN DESCRIPTION
Indicator (no column This column displays icons to indicate the following information:
title) The first step in the sequence

The last step in the sequence

The step that is executing during playback

An error in the sequence

Time Displays the time in hours:minutes:seconds.fractional seconds (00:00:00.00). The maximum time
allowed is 23:59:59.95.
Name Displays the tag name.
Address Displays the memory address affected by the step.
Display format Different display formats are available and depend on the data type of the
tag. For example, some of the available display formats include Bool, Hex, and floating-point
number.
Action For the first step in the sequence, the only option is "Start sequence". For the last step in the
sequence, you can:
• Stop the sequence
• Repeat the sequence
For action steps, you can select:
• Set to value
• Set to frequency (for input bit memory only)
Action parameter Action parameters based on the Action column:
• For "Set to value", you can enter a numerical value compatible with the entry's data type.
• For "Set to frequency", you can enter a frequency in Hertz.
Comment You can add a comment here to provide documentation for the step.

- 221 - Version 1.0

PLCSim
Working in the Sequence Editor

Sequence editor rows (steps)

Each row in the Sequence editor represents a step in the sequence. The icons in the indicator column indicate
the first and last step, which step is executing during playback, and whether a step has an error:

STEP AND RELATED ICON DESCRIPTION

This is a fixed row that does not accept entries. It contains a time of "00:00:00.00".
There are two options in the Action column: Start immediately
Start step Trigger condition

Editable steps Steps with times between the first and last steps in the sequence.
The last step in a sequence. The Action column contains "Stop sequence" or "Repeat
sequence".
Stop step
Indicates the step that will execute next. If you set the same execution time for more
than one entry, all the steps will show the green arrow.
Currently executing step

Indicates that the step contains an error. A message displays information about the
error.
Error indicator
Sequence editor context menu
Right-click anywhere in a step to display the following context menu:

Figure 14.10 – Sequence editor context menu

The context menu commands provide common editing functions and Sequence editor functions.

Commands corresponding to buttons on the toolbar behave the same way as buttons in the context menu.

The Delete command lets you delete a sequence step or a value in an editable field. The Rename command
allows you to rename editable values in Sequence editor fields.

- 222 - Version 1.0

PLCSim
Working in the Sequence Editor

14.7.2 Undo and Redo in the Sequence Editor

The Sequence editor supports undoing and redoing many actions you perform. However, some actions cannot
be undone or redone.

Examples of actions that do not have undo and redo support include:

• Export to Excel (toolbar button)

• Play sequence (from the toolbar button or shortcut menu)
• Stop sequence (from the toolbar button or shortcut menu)
• Pause sequence (from the toolbar button or shortcut menu)
• Sorting columns
• Selecting or deselecting "Repeat sequence" (from the toolbar button)
• Edit execution time
Note that additional actions might also erase the contents of the undo/redo queue.

Undo and Redo during sequence playback

Undo and redo are disabled when a sequence is playing or paused. This is true even when the playing sequence
does not have the editing focus or when the playing sequence is not visible.

When the playing sequence ends, or you explicitly stop it, undo and redo become enabled again. Any editing
actions you perform during sequence playback will be visible in the undo queue.

14.7.3 Creating and populating a sequence

In addition to creating sequences and entering and editing steps, S7-PLCSIM provides additional methods for
performing tasks in the Sequence editor:

• Use auto-fill to create additional steps based on a selected address or tag name (page 223).
• Create a new sequence from recorded SIM table editor actions (page 223).
• Copy and paste all, or a portion of, a STEP 7 tag table, watch table, or force table.
• Import all, or a portion of, a STEP 7 tag table, watch table, or force table using Microsoft Excel (page
225).
• Import a trace measurement file from STEP 7 to create a sequence (page 225).

Sequence: Using auto-fill

Using auto-fill with a sequence works in a different way than it works in a SIM table. In a sequence, it is more
beneficial to use auto-fill to copy the contents of the auto-filled cell than to increment that cell. You can then
apply different start times to the same address to see the effect on your program.

Before downloading, you can use the Address field as the starting field for auto-fill. After downloading, you can
use the Name or Address field for auto-fill.

- 223 - Version 1.0

PLCSim
Working in the Sequence Editor

Auto-fill behaviour and the last sequence step

If you have defined a time for the last step in the sequence and auto-fill exceeds that time because of the Default
interval, S7-PLCSIM automatically adjusts the time for the previous step when you perform the auto-fill.

Auto-fill and the Default interval time

Before auto-filling starts, the time in the Default interval is read. The Default interval value is 50 ms, and you
cannot have a Default value less than 50 ms. The auto-fill process uses this time to increment the time in the
auto-filled steps. Each auto-filled step will have the same address as the field you selected as the basis for auto-
fill.

Recording a sequence from SIM table actions

You can create a sequence by recording actions (Page 58) you take in a SIM table (page 209). You can use this
recording to generate a sequence based on the timing of your recorded actions.

Recordable actions from a SIM table

When you record actions, S7-PLCSIM creates a sequence step for every action that changes a value at an
address. For example, when you change a value in the "Monitor/Modify value” column, S7-PLCSIM records a
new sequence step. The sequence step time is the relative time you acted from when you started recording.

If you make multiple changes to a value over time, each change becomes a step in the created sequence.

S7-PLCSIM creates sequence steps for actions such as clicking bit checkboxes to change values in the "Bits"
column or by using the "Consistent modify" column to change a single value or multiple values.

S7-PLCSIM rounds the times for sequence actions to the nearest 10 ms in conformance with minimum
sequence step time resolution specifications.

When you open a SIM table, S7-PLCSIM enables the following buttons in the Tools menu and on the toolbar
buttons:

"Start recording" button

"Stop recording" button

"Pause recording" button

When you click the "Start recording" button, S7-PLCSIM begins recording specific actions and creating a
sequence from them. The Pause and Stop buttons are then active.

Pausing the recording

When you click the "Pause recording" button, S7-PLCSIM pauses the recording clock and stops recording
actions. Your recording does not include any actions you take while the sequence is paused. When you click the
"Pause recording” button again, S7-PLCSIM continues recording.

Ending the recording session

After recording all the actions you want for your sequence, end the recording session by clicking the "Stop
recording” button on the SIM table toolbar. S7-PLCSIM creates a new sequence from your recording, which
contains a step for each action that results from a value change for an address. S7-PLCSIM assigns a time for
each step relative to the time the action was recorded. Sequences generated from a recording always have a
first step with the action set to "Start immediately".

- 224 - Version 1.0

PLCSim
Working in the Sequence Editor

Editing and playing back a recorded sequence

When you open a sequence S7-PLCSIM created from actions that you recorded in the SIM table editor, you see
that the times for the sequence steps match those for the actions you entered in the SIM table editor. You can
use the sequence as is or edit the times in the "Time" column for individual steps. Click the "Start sequence"
button to play back a recorded sequence.

Sequence: Import and export using Microsoft Excel

You can use Microsoft Excel .xlsx files to export from and import to a sequence by using the export and import
buttons just as you would for a SIM table, but there are differences in the way export and import work
between a SIM table and a sequence.

Editing an exported file

If you edit fields, including values, in an exported sequence file in Microsoft Excel and then import that file into
S7-PLCSIM, the results might be different than you expect.

You can address this issue in one of two ways:

• To prevent the issue, you can edit the exported Excel file by changing the format of the time and other
numerical field(s) to text fields and then edit the Excel file.
• You can import the file and edit the incorrect values in the sequence editor.
Considerations for using import and export with a sequence
You can import a .xlsx file into an empty sequence or a sequence containing steps. Ensure the imported file is
not open in Excel, or the import will fail.

The import operation does not overwrite the first or last step in a sequence because these steps are reserved.

You can export a sequence to import into another project.

If your .xlsx file contains one or more rows with empty address fields, the rows are imported into the sequence
as empty steps.

Importing into an existing sequence

If the sequence already contains entries, S7-PLCSIM adds the imported rows at the bottom of the existing
entries and before the last step.

If you have defined a time for the last step in the sequence and the import results exceed that time, S7-PLCSIM
automatically adjusts the stop time to accommodate the imported steps.

Importing watch table entries containing structured tags

When you import a watch table that contains structured tags, the cells containing the structured tags turn red
in S7-PLCSIM. Click the cell, add a period to the end of the tag name, and a drop-down list displays all of the
tag's subnodes. Select the subnode tags to use in the sequence.

Sequence: Import a STEP 7 trace to create a sequence

S7-PLCSIM can create sequences based on trace measurement files that were exported from STEP 7.
Supported formats are:

• .ttrec
• .ttrecx
• .csv

- 225 - Version 1.0

PLCSim
Working in the Sequence Editor

Importing the trace file

To import a trace measurement file, follow these steps:

• Select "Import sequence from trace measurement" from the shortcut menu using one of the following
methods:
o Right-clicking the Sequences folder in the project tree
o Clicking the Import button dropdown arrow from the sequence toolbar
o Right-clicking within the sequence grid
• Navigate to and select a trace measurement file.
Trace measurement addresses
A trace can record measurements for many addresses. You might not want to include all trace addresses in
your sequence. For example, the trace measurement might include recordings for output addresses (%Q
memory). These addresses are not valid for an S7-PLCSIM sequence.

S7-PLCSIM displays a trace measurement dialog for your selected trace file:

• S7-PLCSIM imports all addresses from the trace measurement.

• S7-PLCSIM displays tag names for addresses with available tag information. The tag names come from
the current configuration downloaded to S7-PLCSIM. They do not come from the imported trace
measurement. For addresses with no available tag name, S7-PLCSIM displays " – “.
• By default, S7-PLCSIM selects all addresses except output addresses. Output addresses appear in the list
but are not selected for import.
After you select the addresses to include and click "OK," S7-PLCSIM generates a sequence from the trace
measurement.

Trace measurement files contain tag information. If tag assignments change in the STEP
7 project, you must download the project with the changes to S7-PLCSIM.

Details about sequence generation

The sequence is generated according to the following rules:

• S7-PLCSIM creates an "initialisation step" for each included address. This step corresponds to the time
of the first sample in the trace file. The address in the sequence is the address in the first sample in the
trace file. Each initialisation step includes a comment that says: "Initial step". If you do not want to use
initialisation, you can edit, disable or delete the steps.
• S7-PLCSIM creates a sequence step for each value change at one of the included addresses.

Trace measurements are taken at each sample time. If the address value has not
changed since the last sample time, no sequence step is generated.

• The sample time for a trace can be much faster than the minimum increment time between sequence
steps. S7-PLCSIM adds a sequence step for each sample in the trace file. If the time difference between

- 226 - Version 1.0

PLCSim
Working in the Sequence Editor

two samples in the trace file violates the minimum sequence step increment time, the sequence step
displays an error. It would be best to correct all sequence step time errors before using the sequence.
• The trace supports triggering the recording based on a tag value. When you select this, the trace also
supports recording values before triggering. This means the measurements during this pre-trigger time
have negative time values. The S7-PLCSIM sequence does not support negative times for steps. When
a measurement has negative times, the time values are adjusted so that the first measurement time
has zero value in the sequence. Subsequent step times are converted to positive values.

After you create a sequence from an imported trace measurement file, you can edit it. There is no further
connection to the original TIA Portal trace.

- 227 - Version 1.0

PLCSim
Working in the Sequence Editor

14.7.4 Methods for starting a sequence

Sequence start action

The first row of the sequence defines the start condition for the sequence. The start condition is one of two
actions:

• "Start immediately". When you select this option, the first step of the sequence (the second row in the
sequence editor) will immediately become active, and the execution time for the sequence will begin to
count.
• "Trigger condition". For this option, you must define a trigger condition that will be evaluated to
determine when the sequence executes. When you have defined a trigger for the sequence, and then
select to play the sequence, the first step in the sequence will only become active when the trigger
condition is satisfied.
Select the start condition by clicking the "Action" column in the first row:

Figure 14.11 – Sequence start

The default start action for a new sequence is "Start immediately".

Start immediately
When you select this option, the first step of the sequence (the second row in the sequence editor) becomes
active, and the execution time for the sequence begins to count.

"Start immediately” is the default start action. When you select this start action, you do not need to edit any
other fields. The "Time” field displays 00:00:00.00 (or the equivalent time, based on your selected time format).
It is not editable. The "Action parameter” is not applicable for the "Start immediately" action.

Trigger condition
When you select this option, you must define a trigger condition (page 73) that S7-PLCSIM evaluates to
determine when your sequence begins to execute. When you define a trigger condition and then play the
sequence, the first sequence step executes only when the trigger condition occurs.

For a trigger condition, you must define the start condition under the "Action parameter” column. The trigger is
a specific condition for a single tag (or address), like the trigger condition for a STEP 7 trace.

Starting a sequence with a trigger condition

Sequences that begin with a trigger condition (page 228) require an action parameter. To configure the action
parameter, click the Action parameter dropdown to configure the following information:

• Tag or address to be used for the trigger

• Event that will be monitored
• Trigger value for the tag (if required)
To input the tag or address, click the "Trigger tag” control to see a list of all available tags:

- 228 - Version 1.0

PLCSim
Working in the Sequence Editor

Figure 14.12 – Trigger tag assignment

Select a tag from the list or enter a tag name in the field.

You can also enter an address into the "Trigger tag” field. If the address has an associated tag, S7-PLCSIM
displays the tag name for the address you enter. If the address does not have an associated tag, S7-PLCSIM
displays the address.

Selecting the tag or address also determines what events are available. For example, you can test an input bit
(Boolean) for the event "= TRUE". For value comparisons, you enter a specific value.

To cancel your edits, click the button.

To accept and apply your changes, click the button. The sequence then shows your Action parameter for the
trigger condition:

Figure 14.13 – SIM Table grid

Repeating a sequence
The last step in a sequence is the "Stop sequence” step. The sequence stops executing at the time indicated in
this step for sequences that don't repeat. Any active "Set to frequency” actions stop, and the sequence returns
to a stopped editable state. You can, however, configure your sequence to repeat in a loop.

Repeating a sequence from the toolbar button

To cause a sequence to repeat in a loop, click the "repeat sequence” toolbar button . When a sequence is
repeated, the button appears pressed.

A repeating sequence has the following functionality:

• When the running sequence reaches the "Stop sequence” step, any active "Set to frequency” actions
end.
• The first step of the sequence becomes active, and the sequence once again proceeds through the
steps.
• The time displayed in the "Execution time” field is the time for the current iteration of the sequence
rather than the total cumulative time since the sequence first began executing. The current iteration for
the repeating sequence (1…n) appears in parentheses next to the execution time.
• You can stop a repeating sequence in the following ways:

- 229 - Version 1.0

PLCSim
Working in the Sequence Editor

• Click the stop button. The sequence stops immediately. Clicking the stop button does not affect the
state of the "repeat sequence” button.
• De-select the "repeat sequence” button. This causes the sequence to stop when the time for the "stop
sequence” step is reached.

S7-PLCSIM does not save sequence repeat settings in the S7-PLCSIM project.

Repeating a sequence with a trigger condition

When a repeating sequence starts with a trigger condition, S7-PLCSIM evaluates the starting condition each
time the sequence repeats. If the trigger condition is true, the sequence continues to repeat. If it is not true, the
sequence pauses until it becomes true.

Visual feedback while running a sequence

Visual feedback in Project view while playing a sequence
S7-PLCSIM provides the following visual feedback while a sequence is actively running:

ICON DESCRIPTION

In the project tree, a "running" icon displays next to the currently running
sequence. If the sequence is paused, a "pause" icon appears instead of
the "running" icon. This way, you can select the correct sequence you want
to stop.
Sequence playing: The "sequence playing" icon appears in the lower right side of the Sequence
editor window while the sequence is running.

The "step execution" icon moves from step to step in the sequence, indicating
which step is executing. If you defined multiple steps to begin
simultaneously, all the steps display the green arrow.
The execution time is displayed in the Sequence editor toolbar.

Visual feedback after stopping a sequence

You can tell when a sequence has stopped running from the following visual indicators:

• There is no "running" icon next to the sequence name in the Project tree.
• The "sequence playing" icon no longer appears in the lower right corner of the Sequence editor window.
• The "step execution" icon stops on the last step executed.
• The execution time stops and displays the total sequence run time. If the sequence is repeated, the
number of repetitions is displayed in parentheses.

- 230 - Version 1.0

PLCSim
Working in the Sequence Editor

14.7.5 Sequence actions and action parameters

Each entry or step in a sequence represents an action to take on the specified address at the time specified in
the "Time" column. The type of action that can be specified depends on the address's data type. You can specify
an address by tag name in the "Name" field or by address in the "Address" field. A sequence entry's address
determines its data type and available actions.

Sequence example using bit address

The following example describes how the address for the step determines available options for a bit address:

• Enter an input bit address either by address or by tag name.

• S7-PLCSIM populates the remaining fields in the sequence row with default values.
• The "Set to value" action is the default action. You have two possible options for the action parameter:
FALSE or TRUE.
• If you want the "Set to frequency" action rather than the "Set to value" action, select it using the drop-
down list and enter a frequency in Hertz in the "Action parameters" field. The input will pulse at that
frequency when you run the sequence.
Sequence action: "Set to value"
"Set to value" is a discrete action. S7-PLCSIM writes the value once to the peripheral input. Because there is no
physical I/O to overwrite this action, the input retains its value until another action changes it.

Sequence action: "Set to frequency"

The "Set to frequency" action is only available for input bit memory.

When the action is "Set to frequency", you must specify a frequency value in Hz. S7-PLCSIM pulses the bit at the
configured frequency until the sequence stops. If you have selected "Repeat sequence" for the last step, S7-
PLCSIM continues to pulse the input bit until you stop the sequence.

14.7.6 Time-related Sequence information

Sequence time entry

Your sequence entries are sorted and run based on the contents of the "Time" field. The time is displayed in the
format: Hours:minutes:seconds.fractional seconds (00:00:00.00).

If you select the "Time" field and enter a number (such as "12", for example),

S7-PLCSIM interprets and displays the number as 12 seconds (00:00:12.00). You must explicitly enter the time
using the proper format to get hours, minutes, and fractional seconds.

The maximum time allowed for an entry is 23:59:59.95 (S7-PLCSIM rounds sequence time entries to the nearest
50 milliseconds).

- 231 - Version 1.0

PLCSim
Working in the Sequence Editor

The following table shows examples of time values in your sequence:

VALUE ENTERED RESULTING TIME VALUE

12 00:00:12.00
12.2 00:00:12.20
.02 00:00:00.02
2:2 00:02:02.00
12:12.12 00:12:12.12
Empty 00:00:00.00
Any illegal entry, such as text "abcd" The cell turns pink, an error icon is displayed, and the text that caused
the error is displayed.

Order of sequence steps

You do not need to add steps to the sequence in the order in which they should be executed. You can enter the
steps in any order, and they run based on the times you enter in the "Time" column.

You can sort your steps by time before running the sequence by selecting the "Time" column header.

Sequence time entry rules

You can define multiple entries simultaneously if they are not for the same address. An error occurs if you define
multiple actions for the same address simultaneously.

Multiple steps at the same time

If you define multiple actions simultaneously for different addresses, no error will appear,
but there is no way to know which action will be executed first until you play the
sequence. This could result in different ending values for your addresses.

You can sort on the Address column to see the actions based on which input addresses are affected.

- 232 - Version 1.0

PLCSim
Working in the Sequence Editor

Sequence end times for Stop and Repeat sequences

The time for the last step of your sequence must be equal to or greater than the time for the last step plus 50
ms for both Stop and Repeat sequences.

Sequence time entry examples

If you want an input point to pulse at a specific frequency for five seconds and then want the input cleared, you
could use one of the following two sequence examples.

Example: Ending a set-to-frequency action after five seconds

For the first step, choose "Set to frequency" as the action and enter the frequency in Hertz in the "Action
Parameters" field. For the second step, enter a time of 00:00:05.00 in the "Time" field, choose "Set to value" as
the action, and enter the value "0" in the "Action Parameter" field. The pulse generation stops after five seconds.

Example: Ending a sequence after five seconds

You can also enter 00:00:05.00 in the Time field for the last step in the Sequence. This also stops the pulse
generation after five seconds if you have selected "Stop sequence" in the previous step.

Sequence step timing

You can specify sequence step timing in two ways:

• Actions occur at the same time

• Steps execute sequentially
You can create multiple steps to set the values for several addresses simultaneously, which is valid. However,
if you create multiple steps to set the value for the same address simultaneously, this is an error condition. S7-
PLCSIM indicates the error condition by changing the colour of the error fields to red.

If the sequence steps contain different times, S7-PLCSIM enforces a minimum time of 5 ms between steps. If
you enter a time less than 5 ms after the time in the previous step, S7-PLCSIM rounds up the difference to 5 ms.
The stop sequence time must be at least 5 ms after the last step.

Edit execution time

When you pause a sequence, you can edit the execution time. Editing the current execution time allows you to
restart the sequence at a different location. You can either rewind to a prior step or skip ahead to a later step.

Example: Editing execution time to skip ahead

Consider the following sequence that you have paused at 12.82 seconds:

Figure 14.14 – Execution time

No steps execute while the sequence is paused.

Now, assume you edit the execution time to be 21.5 seconds and then click "Start sequence”:

- 233 - Version 1.0

PLCSim
Working in the Sequence Editor

Figure 14.15 – Execution of Sequence_1

Sequence operation starts at the step corresponding to the new execution time. In this example, the sequence
skips the step defined at time 21.0 seconds and begins operation at the step defined for time 21.50 seconds.

If you edit the execution time so that it is between two steps, clicking Start sequence causes the sequence timer
to start and the next step becomes active when its time is reached.

Note that the step that was active when you paused your sequence is a "set to frequency” action. Since this step
was active when you paused the sequence and then moved the execution time forward, this step is still active
when the sequence is started again.

Here is exactly what happened in the above example:

• When the sequence was paused, the active step was running a "set to frequency” action for %I0.3.
• While the sequence was paused, the execution time was edited to skip the next step in the sequence.
This step would have stopped the "set to frequency” action.
• By skipping this step, the set to frequency action for %I0.3 is allowed to remain active.
Example: Editing execution time to skip back
You can also edit the execution time to replay a portion of the sequence. Here is our original example of a
sequence paused at 12.82 seconds:

Figure 14.16 – Skip back

Now, assume you edit the execution time to be 0.00

The step that was active when you paused the sequence at 12.82 seconds (set to frequency for %I0.3) is no
longer active. S7-PLCSIM resets the active step to the step at 00.00 seconds.

Setting the execution time to 0.00 restarts the sequence. In the example above, the sequence starts on a trigger
condition. S7-PLCSM evaluates the trigger condition and proceeds if the trigger condition is true.

Additional information
You cannot set the execution time past the time of the last step.

When you save your project, S7-PLCSIM does not save the current execution time in the project.

- 234 - Version 1.0

PLCSim
Working in the Sequence Editor

14.7.7 Inserting, adding, and deleting sequence steps

When you open a new sequence, it contains three rows or steps:

• A first step containing the "first step" icon in the indicator column, "00:00.00:00" in the "Time" column,
and "Start immediately" in the "Action" column. You cannot edit this step.
• An empty step with "00:00.00.00" in the "Time" column.
• A final step containing the "last step" icon in the indicator column, "00:00.00:05" in the "Time" column,
and "Stop sequence" (the default value) in the "Action" column.
You can create the first step in a new sequence by editing the empty row.

Inserting a step
When you insert a step, the new step appears above your currently selected step. You can insert a step in one
of the following ways:

• Click the "Insert step" button on the Sequence Editor toolbar

• Right-click anywhere in a step and select "Insert step" from the shortcut menu
Adding a step
When you add a step, the new step appears below your currently selected step. The time for the added step will
equal the time for the currently selected step plus the default interval time.

You can add a step in one of the following ways:

• Click the "Add step" button on the Sequence Editor toolbar

• Right-click anywhere in a step and select "Add step" from the shortcut menu
Using the default interval
If you want to change the default time for an added step, enter a different value in the "Default interval" text box
on the Sequence Editor toolbar. The time for the new step will be the time for the selected step plus the default
interval time value.

For example, if the time for the current step is "00:00:05.00" and you enter "2000" for the default step interval,
your added step will have the time "00:00:07.00".

When you add a new step, the default interval time is added to the time of the selected step and subsequent
steps.

Effect of the default interval on inserted steps

The default step interval is only used for added steps. If you insert a step, the time for
the inserted step is the time for the currently selected step minus the default interval
time value.

The valid range for the default interval is 50 to 5000 ms. Your entry is rounded to the nearest 10 ms. For example,
if you enter "1445", the default interval rounds to "1450".

Deleting a step
To delete a step, select the step you want to delete and perform one of the following actions:

• Click the "Delete" key on your keyboard

• Click the "Delete" toolbar button
• Right-click and select "Delete" from the shortcut menu

- 235 - Version 1.0

PLCSim
Working in the Sequence Editor

Enable and disable sequence steps

You can temporarily disable one or more steps in a sequence. Disabled steps are ignored when you play a
sequence. This functionality provides you with a flexible way to debug your sequence. You can re-enable the
disabled step(s) with a single click to include the steps the next time you play the sequence.

To disable a step, follow these steps:

1. Select the step by either selecting the entire row or clicking a cell in the row

2. Click the "Disable step" button on the Sequence editor toolbar.

To disable multiple steps, select them and click the "Disable step" button. To re-enable a step, select it and click
the "Enable step" button.

Tips regarding disabling and enabling steps

You can disable a step even if it contains an error. In this case, the row's error icon will be replaced by the
disabled icon. This allows you to play the sequence and ignore the error.

You can edit a disabled step.

You cannot disable either the "Start sequence" or the "Stop sequence" step.

The enabled or disabled state of a step is preserved when you copy and paste it and when you export and import
a sequence.

14.7.8 Step time adjustment

You might need to insert a step in the middle of a sequence when editing and debugging a sequence. As a part
of this operation, you might want to delay all the following steps by some time.

To accomplish this, follow this example:

• After testing your sequence, you need a new step between the existing steps at 02.00 seconds and
02.50 seconds. First, use the "Insert step" button to create an empty step in the correct position, then
edit the step.
• You want to add a 0.50 second delay to the sequence's following steps. You can do this by manually
editing the time for each step, or you can select the steps, right-click and select "Step time adjustment".
• This action allows you to add a positive or negative time to all the selected steps. Selecting this context
menu option will display a small dialog box where you can enter an amount of time to add to each step.
o Adding a positive time increases each step's "Time" value by that amount.
o Adding a negative time decreases each step's "Time" value by that amount. If the decrease
would cause any times to become negative, then these step(s) are set to a time of 00.00.
The step time adjustment action does not apply to the start step of the sequence. This step always begins at
time zero. If the start step is included with a multiple-row selection, it does not change.

The step time adjustment action applies to the "stop sequence step." You can edit the time for this step
individually or with other steps.

The minimum delay (either positive or negative) is 10 ms. "Step time adjustment" is an action you can undo.

A dialog box with a text entry field indicates the delay time.

- 236 - Version 1.0

PLCSim
Working in the Sequence Editor

14.7.9 Sequence error conditions

When an error condition exists for a sequence entry, the cell containing the error turns pink and an icon
appears in the indicator column. You can hover over the erroneous entry to display an associated error message.

You cannot play a sequence as long as error conditions exist. The possible errors for a sequence are as follows:

ERROR DESCRIPTION
Undefined tag name The tag name entered has no match in the download from STEP 7.
Invalid address The address is syntactically incorrect.
Invalid time Time is syntactically incorrect.
Invalid Action parameter The action parameter is syntactically incorrect or out of the address's range.

Action parameter out of range The valid range is 1 to 100 Hz.

for "Set to frequency" value
Duplicate steps Two steps are attempting to act on the same address at the same time.

Steps too close together S7-PLCSIM enforces a minimum 5 ms time difference between any two steps.

Not online STEP 7 is not online when attempting to run a sequence.

Note that the Sequence editor does not perform a range check on addresses.

- 237 - Version 1.0

Installing TIA Portal V17

15 Installing TIA Portal V17

In the Industrial Automation courses (CSS and ISC), the Siemens software is used.

In the CSS course, the following software is used:

• TIA Portal V17 with update 4
• PLCSIM V17 with update 1

In the course ISC, the additional software is used:

• Startdrive V17

It is recommended that all the files be downloaded from Yellow Storage (Gele storage).

From there, navigate to:

root\Gele Storage\FHENG\Applicaties\TIA Portal V17 + updates (see Figure 15.1).

Figure 15.1 – Location of installation files

In this map there are four ISO-files stored. From here you can download the needed ISO-files:

• TIA_Portal_STEP7_Prof_Safety_WINCC_Adv_Unified_V17.iso
• Totally_Integrated_Automation_Portal_V17_Upd4.iso
• SIMATIC_S7-PLCSIM_V17.iso
• SIMATIC_S7-PLCSIM_V17_Upd1.iso

There is a specific order in how to install which software:

1. TIA Portal V17

2. PLCSim
3. TIA Portal V17 Update 4
4. PLCSim Update 1

- 238 - Version 1.0

Installing TIA Portal V17
Installing TIA Portal

15.1 Installing TIA Portal

Step 1 – Install TIA Portal V17

• Double-click on TIA_Portal_STEP7_Prof_Safety_WINCC_Adv_Unified_V17.iso. A DVD image is added to

Windows Explorer, see Figure 15.2.
• From there, start the setup by calling Start.exe.

Figure 15.2 – Virtual DVD station

• Follow the instructions.

• When reaching the ‘TIA Software Update Server configuration’, change its setting to ‘Continue with
current settings’, as shown in Figure 15.3.
• (This is used not to use the update server, so the software versions of the TIA Portal will always be the
same).

Figure 15.3 – Change settings of the TIA Software Update Server

- 239 - Version 1.0

Installing TIA Portal V17
Installing TIA Portal

When your computer needs to restart in between (which is the case with some laptops), see the FAQ on Canvas
for instructions on how to handle this. This may be the case with all four ISO files.

15.1.1 Install PLCSim V17

• Double-click on SIMATIC_S7-PLCSIM_V17.iso.
• A DVD image is added to the Windows Explorer.
• From there, start the setup by calling Start.exe.
• Follow the instructions.

15.1.2 Install TIA Portal Update 4

• Double-click on Totally_Integrated_Automation_Portal_V17_Upd4.iso.
Another DVD image has been added to Windows Explorer.
• From there, start the setup by calling Start.exe.
• Follow the instructions.

15.1.3 Install PLCSim Update 1

• Double-click on SIMATIC_S7-PLCSIM_V17_Upd1.iso.
A DVD image is added to the Windows Explorer.
• From there, start the setup by calling Start.exe.
• Follow the instructions.

15.1.4 Install Startdrive V17

Startdrive is only necessary for the course ICS.

Startdrive V17 is an addition to the TIA Portal application. Startdrive V17 needs to be configured as a drive and
motor.

Unlike TIA Portal and PLCSim, the installation file of Startdrive is located on Sharepoint
(Startdrive_Advanced_V17_SP1.iso)

- 240 - Version 1.0

Installing TIA Portal V17
Installing Licenses

15.2 Installing Licenses

With TIA Portal, demo licenses are installed. These demo licenses have a limited working period. After this
period, you cannot work in the TIA Portal environment. After installation of the TIA Portal, collect the license
from your teacher. This license is valid for one year.

Be aware that if your laptop needs to be reinstalled, the licenses are removed. Before reinstallation, back up the
licenses on a USB stick with the License Manager.

Select the following licenses (see Figure 15.4):

• STEP 7 Professional combo

• WinCC Advanced combo licenses
• All licenses…

Figure 15.4 – Selecting the licenses

Click License Key -> Transfer.

Figure 15.5 – Transfer menu

Select the drive where the license keys are. They must be on the hard drive, such as your C drive.

Then press OK to start the transfer.

- 241 - Version 1.0

Installing TIA Portal V17
Installing Licenses

Figure 15.6 – Transferring

If you reinstall Windows, use the License Manager to secure your licenses. You can then put them on an external
hard drive or USB stick.

- 242 - Version 1.0

Installing TIA Portal V17
TIA Portal settings

15.3 TIA Portal settings

The rules and recommendations for the settings in TIA Portal listed in the programming style guide are stored
in the TIA Portal Settings File (tps file). You can find the tps file as a separate download from CANVAS. To apply
the settings, you can import the tps file into TIA Portal.

15.3.1 Import tps-File

You can import settings of the TIA Portal manually from a initialization file, for example, to take over settings
from other users.

To import the settings manually, proceed as follows:

• Select the "Settings" command in the "Options" menu.

Figure 15.7 – Getting to the import menu

The settings of the TIA Portal are displayed.

• Select the "General" entry in the area navigation.
• In the "Import/export settings" area, click on the "Import settings ..." button.

Figure 15.8 – Import settings menu

• Select the setting file "TIAPortal_StyleGuideSettingsFile.tps17".

• Click "Open", to import the file.

- 243 - Version 1.0

Installing TIA Portal V17
TIA Portal settings

Figure 15.9 – Select the file

• In the following dialog, click "OK" and restart TIA Portal.

Figure 15.10 – Apply settings

• After a restart of TIA Portal the settings are applied

- 244 - Version 1.0

Naming Convention

16 Naming Convention
The Fontys Industrial Automation department defined naming conventions that all students need to apply, and
they are judged based on them in their final assignments for CSS and ISC.

Please note that names appear to be “a bit long.” But please be open to understanding why names are created
like this and try to see the logical functionality behind them.

The naming convention is derived from the Siemens Programming Styleguide.

16.1 Explanation
The reason why most customers do have naming conventions as a requirement is probably pretty obvious, but
please consider what happens when all software engineers in a company produce software compliant with
these naming conventions. And realise the difference between a small company, producing their own small
machines where no one else needs to read the software, or a big company like “Vanderlande Industries” or “Van
Riet Material Handling Systems” where hundreds of thousands of PLC input/outputs are located in a project?

• I/O addresses and PLC tags become more apparent to everyone using them,
• Software becomes easier readable amongst colleges,
• Service engineers who don’t have in-depth knowledge about the software can easily read it and connect
it to the electrical diagrams to find problems in the hardware,
• You can still read your software, even years after not looking into it,
• And much more.
A frustration that appears very much amongst colleges in an engineering department or at a customer’s site is
that naming conventions are not clear between:

• Process engineers,
• Mechanical engineers,
• Electrical engineers,
• Software engineers.
The more precise all “Control Module” names are, and the earlier in the engineering process they are defined (by
a system designer), the better they are communicated between departments, and the easier it becomes to keep
everybody in line with the concept.

You may find a template project with incorrect naming conventions; they still need to be
“fixed” while developing the CSS and ISC courses.

It is your responsibility and advantage as a student to stay diligent and ensure that your
implementation follows the rules mentioned in this document's chapter.

- 245 - Version 1.0

Naming Convention
Inputs

16.2 Inputs
i_MixerTank_MixerMotor_Feedback

This variable is an input from a motor thermal contact feedback. For example, in a decimal number, you write
the most significant first, then the middle and last, the lowest level, and the least significant part of the name.

i_ PLC input
MixerTank_ Location of the following object. In this case, the object's location
(MixerMotor) is the MixerTank.
MixerMotor_ The object where the feedback is from. In this case, the MixerMotor.
Feedback Type or function of input: Feedback signal if the motor is OK.
Example 16.1

Please notice that the tag:

- Input/ output/ internal tag has an “_” at the end,

- Location has an “_” at the end,
- Object has an “_” at the end.
- Function type has no “_” at the end,
In the example above, from the “i_”, you can immediately see that the signal is a PLC input. The “MixerTank”
gives you the location (Unit) of that feedback signal. “Feedback” represents the function, which is “feedback”.

Examples

i_MixerTank_Tank_LevelSwitchHigh:
i_ PLC input
MixerTank_ Location of the following object. In this case, it is the location of the
mixer.
Tank_ The kind of output the object is controlling.
LevelSwitchHigh Type or function of input: Level switch for detecting the High level.
Example 16.2

ai_MixerTank_Tank_LevelSensor
ai_ Analogue PLC input
MixerTank_ Location of the following object. In this case, it is the location of the
mixer.
Tank_ The kind of output the object is controlling.
LevelSensor Type or function of input: Level sensor.
Example 16.3

ai_MixerTank_Tank_TemperatureSensor
ai_ Analogue PLC input
MixerTank_ Location of the following object. In this case, it is the location of the
mixer.
Tank_ The kind of output the object is controlling.
TemperatureSensor Type or function of input: Temperature sensor.
Example 16.4

- 246 - Version 1.0

Naming Convention
Outputs

Abbreviations like Fb for Feedback, MT for MixerTank, RP for Recipe Panel, and so on are allowed. The most
important rule for using abbreviations is that you are consequent in the WHOLE PROJECT and that abbreviations
are listed so they are easy for everybody to use.

So, in your design document, you will create a table with the abbreviations used so the reader can understand
what you meant by the software's names.

16.3 Outputs
o_MixerTank_Heater_LED
o_ PLC output
MixerTank_ Location of the following object. In this case, the location of the heater
is essential.
Heater_ The kind of output the object is controlling.
LED Type or function of output: LED.
Example 16.5

o_MixerTank_Mixer_Relay
o_ PLC output
MixerTank_ Location of the following object. In this case, it is the location of the
mixer.
Mixer_ The kind of output the object is controlling.
Relay Type or function of output: Relay.
Example 16.6

o_ChocolateMixerTank_Heater_Relay
o_ PLC output
ChocolateMixerTank_ Location of the following object. In this case, it is the location of the
mixer.
Heater_ The kind of output the object is controlling.
Relay Type or function of output: Relay.
Example 16.7

o_ChocolateMixerTank_Heater_LED
o_ PLC output
ChocolateMixerTank_ Location of the following object. In this case, the location of the heater
is essential.
Heater_ The kind of output the object is controlling.
LED Type or function of output: LED.
Example 16.8

- 247 - Version 1.0

Naming Convention
Data Block names

16.4 HMI tags

HMI_Chocolate_Heating_On

HMI_Chocolate_Mixing_On

HMI_Chocolate_Heating_TemperatureSetpoint

16.5 Data Block names

When using FBs, you must declare an instance DB, regardless of whether it is a single instance or a multi-
instance. Start your DB name with an iDB_ so that it is evident in your TIA portal project what are “Global DBs”
and “Instance DBs”

iDB_UnitMixertank This is the Instance Data Block from the FB where the Unit Mixer
Tank is called.

Example 16.9

PC_Communication_Tags This is a global Data Block where the communication tags between PLC
and HMI are located.
Example 16.10

- 248 - Version 1.0

Section 21
 Naming Convention

16.6 ISA-88 naming conventions

Within the ISA-88 Physical model, the hierarchy is explained in Section 4.2 on page 29. When creating software
or doing a functional decomposition, you work " bottom-up " most efficiently. This is because the components
in a system are often known, like in the End Assignment Use Case CSS and ISC. Sometimes, you get an
assignment (like in your internship or when you graduated as a bachelor) where the mechanical/electrical
design is already finished. Therefore, the below naming conventions are given in this order.

16.6.1 Control Modules (CM)

CM_HeatingElement
This can be an FC/FB that controls a Heating element to switch a relay or solid state relay to an on/off state.

CM_TemperatureSensor
Control module FC/FB reads an analogue input from the PLC and converts it to the correct temperature unit.

CM_HeaterStatus
The control module shows the status of the temperature controller on an operator panel.

It is wise to test each CM when you think it is ready. This finishes your work for this Control Module, and you no
longer have to worry about it. Validation at other parts of the V-model process is then already done.

The reuse of CMs becomes obvious. All the hard work is done. You can build a library
with CMs and use the ones you need in a (new) project.
Remember, do not use global variables! Use multi-instance (see also Section 7.6.3 on
page 73)

16.6.2 Equipment Modules (EM)

EM_TankHeating
Taking the above examples from the Heating, the EM_TankHeating combines the above control modules and
forms the temperature controller.

Taking the set point value from the HMI, reading the actual temperature, reading the input (if the temperature
controller has an enable input), and then controlling the heating element to be on/off. Last but not least, the
actual state of the heating on the control panel should be shown so the operator can read it out.

16.6.3 Units (UN)

UN_MixerTank
The UN_MixerTank must then contain the software to control all the Equipment Modules. This unit mostly has
a State Machine to control all equipment modules.

Also, the complete status of the mixer tank is in this unit.

Section 22 - 250 - Version 1.0

 Naming Convention

16.6.4 Process Cells (PC)

PC_MixedDrinks
When there are more Units in a system, communication between them is built at the Process Cell level.

Therefore, it is essential to realise that the software to control “Control Modules” is always one level higher (at
the Equipment Module level). Software to control Equipment Modules is always one level higher at the Unit level,
and software to control Units is one level higher at the Process Cell level.

Figure 16.1 – Example of an ISA-88 structure in a PLC project (with a different naming convention)

Section 22 - 251 - Version 1.0

 Index

17 Index

WString, 110
A DB, 72
Analogue signals, 96 Discrete Control, 28

B F
Batch Control, 28 F_TRIG, 94
Block Status, 170 FB, 70
FC, 65
Flowchart, 52
C Forcing values, 178
Call Structure, 149 Function, 65
Call-by-reference, 76 Function Block, 70
Call-by-value, 76 Function Block Diagram, 16
Clock and system memories, 91 Functional Decomposition, 35
Comparing offline and online, 167
Continuous Control, 28 G
Control
IF ... THEN ... ELSE, 19 Global DB, 72
Control functions Go To, 147
Continue, 24
Exit, 24 H
Goto, 24
Human Machine Interface, 184
Return, 24
HMI, 184
Converting, 126
Counter
Count down, 88 I
Count up, 87
Instances, 73
Up and Down, 89
ISA-88, 27
Cross-reference, 146
Cross-references, 144
L
D Ladder Diagram, 13
Loops
Datablock, 72
FOR, 23
Datatype
REPEAT, 22
Array, 113
WHILE, 21
Bool, 107
Byte, 107
Character, 110
M
Data structure, 115 Modify Tags, 171
DWord, 107 Module Design, 44
Floating point, 108 Monitoring a Block, 170
Integer, 108 Multi-instances, 73
Real, 108
String, 110
Time and Date, 109
N
UDT, 116 N_TRIG, 94
Variant pointer, 124 NORM_X, 102
Word, 107

Section 23 - 252 - Version 1.0

 Index

O SIM tables, 209

Software Development Life Cycle, 40
OB, 59 Software Testing, 49
Optimised DB, 74 Start value, 71
Organization Blocks, 59 State Machine, 54
Overlapping Accesses, 145 State, 54
Transition, 54
P Structured Control Language, 17
System Design, 44
P_TRIG, 94 System Requirements, 43
Physical Model
Area, 29
T
Control Module, 31
Enterprise, 29 TOF, 83
Equipment Module, 31 TON, 79, 80, 81, 82
Process Cell, 30 TP, 85
Site, 29 Turn-Key Project, 47
Unit, 30
PLC, 2 U
R User Requirements, 43

R_TRIG, 94 V
S V-Model, 41

SCALE_X, 102 W
SDLC, 40
Sequence Editor, 219 Watch tables, 172
SIM table editor, 209

Section 24 - 253 - Version 1.0