Berger Automating with STEP7 in STL and SCL

40

Transcript of Berger Automating with STEP7 in STL and SCL

Page 1: Berger Automating with STEP7 in STL and SCL
Dateianlage
covergif

Berger Automating with STEP 7 in STL and SCL

Automating with STEP7 in STL and SCLProgrammable Controllers SIMATIC S7-300400

by Hans Berger

6th revised and enlarged edition 2012

Publicis Publishing

Bibliographic information published by the Deutsche NationalbibliothekThe Deutsche Nationalbibliothek lists this publication in the Deutsche Nationalbibliografie detailed bibliographic data are available in the Internet at httpdnbd-nbde

ISBN 978-3-89578-412-56th edition 2012

Editor Siemens Aktiengesellschaft Berlin and Munich Publisher Publicis Publishing Erlangen copy 2012 by Publicis Erlangen Zweigniederlassung der PWW GmbH

This publication and all parts thereof are protected by copyright Any use of it outside the strict provisions of the copyright law without the consent of the publisher is forbidden and will incur penalties This applies particularly to reproduction translation microfilming or other processingsbquo and to storage or processing in electronic systems It also applies to the use of individual illustrations or extracts from the text

Printed in Germany

This book contains one Trial DVD ldquoSIMATIC STEP 7 Professional Edition 2010 SR1 Trial Licenserdquo encompasses SIMATIC STEP 7 V55 SP1 S7-GRAPH V53 SP7 S7-SCL V53 SP6 S7-PLCSIM V54 SP5 and can be used for trial purposes for 14 days

This Software can only be used with the Microsoft Windows XP 32 Bit Professional Edition SP3 or Microsoft Windows 7 3264 Bit Professional Edition SP1 or Microsoft Windows 7 3264 Bit Ultimate Edition SP1 operating systems

Additional information can be found in the Internet at httpwwwsiemenscomscecontact httpwwwsiemenscomscemodules httpwwwsiemenscomscetp

The programming examples concentrate on describing the STL and SCL functions and providing SIMATIC S7 users with programming tips for solving specific tasks with this controller

The programming examples given in the book do not pretend to be complete solutions or to be executable on future STEP 7 releases or S7-300400 versions Additional care must be taken in order to comply with the relevant safety regulations

The author and publisher have taken great care with all texts and illustrations in this book Nevertheless errors can never be completely avoided The publisher and the author accept no liability regardless of legal basis for any damage resulting from the use of the programming examples

The author and publisher are always grateful to hear your responses to the contents of the book

Publicis Publishing PO Box 3240 91050 ErlangenE-mail publishing-distributionpublicisde

Internet wwwpublicis-booksde

Preface

5

Preface

The SIMATIC automation system unites all thesubsystems of an automation solution under auniform system architecture to form a homoge-neous whole from the field level right up to pro-cess control This Totally Integrated Automa-tion (TIA) enables integrated configuring andprogramming data management and communi-cations throughout the complete automationsystem

As the basic tool for SIMATIC STEP 7 playsan integrating role in Totally Integrated Auto-mation STEP 7 is used to configure and pro-gram the SIMATIC S7 SIMATIC C7 andSIMATIC WinAC automation systems Micro-soft Windows has been chosen as the operatingsystem to take advantage of the familiar userinterface of standard PCs as also used in officeenvironments

For block programming STEP 7 provides pro-gramming languages that comply with DIN EN61131-3 STL (statement list an Assembler-like language) LAD (ladder logic a represen-tation similar to relay logic diagrams) FBD(function block diagram) and the S7-SCLoptional package (Structured Control Lan-guage a Pascal-like high-level language) Sev-eral optional packages supplement these lan-guages S7-GRAPH (sequential control) S7-HiGraph (programming with state-transitiondiagrams) and CFC (connecting blocks similarto function block diagram) The various meth-ods of representation allow every user to selectthe suitable control function description Thisbroad adaptability in representing the controltask to be solved significantly simplifies work-ing with STEP 7

This book describes the STL and SCL program-ming languages for S7-300400 As a valuablesupplement to the description of the languagesand following an introduction to the S7-300400 automation system it provides valuablepractice-oriented information on the basic han-

dling of STEP 7 when configuring networkingand programming SIMATIC PLCs Thedescription of the ldquoBasic Functionsrdquo of a binarycontrol such as logic operations or latchingunlatching functions makes it particularly easyfor first-time users or users changing from relaycontactor controls to become acquainted withSTEP 7 The digital functions explain how dig-ital values are combined for example basiccalculations comparisons or data type conver-sion

The book shows how you can control programprocessing (program flow) and design struc-tured programs In addition to the cyclicallyprocessed main program you can also incorpo-rate event-driven program sections as well asinfluence the behavior of the controller atstartup and in the event of errorsfaults

One section of the book is dedicated to thedescription of the SCL programming languageSCL is especially suitable for programmingcomplex algorithms or for tasks in the datamanagement area and it supplements STLtowards higher-level programming languagesThe book concludes with the description of aprogram for converting STEP 5 programs toSTEP 7 programs and a general overview ofthe system functions and the function set forSTL and SCL

The contents of this book describe Version 55of the STEP 7 programming software and Ver-sion 53 SP5 of the S7-SCL optional package

Nuremberg May 2012

Hans Berger

6

The Contents of the Book at a Glance

Overview of the S7-300400 programma-ble logic controller

PLC functions compa-rable to a contactor control system

Numbers manipulat-ing the contents of the accumulators

Program run control block functions

Introduction

1 SIMATIC S7-300400 Programmable Controller

Structure of the Pro-grammable Controller(Hardware Components of S7-300400)Memory AreasDistributed IO (PROFIBUS DP)Communications (Subnets)Modules AddressesAddresses Areas

2 STEP 7 Program-ming Software

Editing ProjectsConfiguring StationsConfiguring the Net-work Symbol EditorSTL Program EditorSCL Program EditorOnline ModeTesting the Program

3 SIMATIC S7 Program

Program ProcessingBlock TypesProgramming STL and SCL Code Blocks Programming Data BlocksAddressing Variables Constant Representa-tions Data Types (Overview)

Basic Functions

4 Binary Logic Operations

AND OR and Exclusive OR FunctionsNesting Functions

5 Memory Functions

Assign Set and ResetEdge EvaluationExample of a Conveyor Belt Control System

6 Move Functions

Load FunctionsTransfer FunctionsAccumulator FunctionsSystem Functions for Data Transfer

7 Timer Functions

Start SIMATIC Timers with Five Different TypesIEC Timers

8 Counter Functions

SIMATIC CountersCount up Count down Set Reset and Scan CountersIEC Counters

Digital Functions

9 Comparison Functions

Comparison Accord-ing to Data Types INT DINT and REAL

10 Arithmetic Functions

Four-function Math with INT DINT and REAL numbersAdding ConstantsDecrementing and Incrementing

11 Math Functions

Trigonometric FunctionsArc FunctionsPowers Logarithm

12 Converting Functions

Data Type Conversion Complement Forma-tion

13 Shift Functions

Shifting and Rotating

14 Word Logic

AND OR Exclusive OR

Program Flow Control

15 Status Bits

Binary Flags Digital FlagsENENOMechanism

16 Jump Functions

Unconditional Jump Jumps Conditional on the RLO BR and the Digital FlagsJump Distributor Loop Jump

17 Master Control Relay

MCR Dependency MCR Area MCR Zone

18 Block Functions

Block Call Block EndTemporary and Static Local DataData Addresses

19 Block Parameters

Formal Parameters Actual ParametersDeclarations Assignments andldquoParameter Passingrdquo

7

Processing the user program

Working with complex variables indirect addressing

Description of the Programming Language SCL

S5S7 Converter block libraries overviews

ProgramProcessing

20 Main Program

Program Structure Scan Cycle Control(Response Time Start Information Back-ground Scanning) Program FunctionsCommunications via Distributed IO and Global Data S7 and S7-Basic Communications

21 Interrupt Handling

Time-of-Day Inter-rupts Time-Delay In-terrupts Watchdog Interrupts Hardware Interrupts DPV1 In-terrupts Multiproces-sor Interrupt Handling Interrupts

22 Restart Characteristics

Cold Restart Hot Restart Warm RestartSTOP HOLD Memory ResetParameterizing Modules

23 Error Handling

Synchronous ErrorsAsynchronous ErrorsSystem Diagnostics

Variable Handling

24 Data Types

Structure of the Data TypesDeclaration and Use of Elementary and Complex Data TypesProgramming of User Defined Data Types UDT

25 Indirect Addressing

Area PointerDB PointerANY PointerIndirect Addressing via Memory and Register (Area-internal and Area-crossing)Working with Address Registers

26 Direct Variable Access

Load Variable AddressData Storage of Variables in the MemoryData Storage when Transferring Parame-ters ldquoVariablerdquo ANY PointerBrief Description of the ldquoMessage Frame Examplerdquo

Structured Control Language SCL

27 Introduction Language Elements

Addressing Operators Expressions Value Assignments

28 Control Statements

IF CASE FOR WHILE REPEAT CONTINUE EXIT GOTO RETURN

29 SCL Block Calls

Function Value OK Variable ENENO Mechanism Descrip-tion of Examples

30 SCL Functions

Timer FunctionsCounter FunctionsConversion and Math FunctionsShifting and Rotating

31 IEC Functions

Conversion and Com-parison FunctionsSTRING FunctionsDateTime-of-Day FunctionsNumerical Functions

Appendix

32 S5S7 Converter

Preparations for ConversionConverting STEP 5 ProgramsPostprocessing

33 Block Libraries

Organization BlocksSystem Function BlocksIEC Function BlocksS5-S7 Converting BlocksTI-S7 Converting BlocksPID Control BlocksDP Functions

34 STL Operation Overview

Basic FunctionsDigital FunctionsProgram Flow ControlIndirect Addressing

35 SCL Statement and Function Overview

OperatorsControl StatementsBlock CallsStandard Functions

8

The Programming Examples

The present book provides many figures repre-senting the use of the STL and SCL program-ming languages All programming examplescan be downloaded from the publisherrsquos web-site wwwpublicis-booksde There are two li-braries one for STL examples (STL_Book) andone for SCL examples (SCL_Book) Whendearchived with the Retrieve function these li-braries occupy approximately 29 or 17 MB(dependent on the PGPC file system used)

The library STL_Book contains eight programsthat are essentially illustrations of the STLmethod of representation Two extensive exam-ples show the programming of functions func-tion blocks and local instances (Conveyor Ex-ample) and the handling of data (MessageFrame Example) All the examples exist assource files and contain symbols and com-ments

The library SCL_Book contains five programswith representations of the SCL statements and

Library STL_Book

Basic FunctionsExamples of STL representation

Program ProcessingExamples of SFC Calls

FB 104 Chapter 4 Binary Logic OperationsFB 105 Chapter 5 Memory FunctionsFB 106 Chapter 6 Transfer FunctionsFB 107 Chapter 7 Timer FunctionsFB 108 Chapter 8 Counter Functions

FB 120 Chapter 20 Main ProgramFB 121 Chapter 21 Interrupt HandlingFB 122 Chapter 22 Restart CharacteristicsFB 123 Chapter 23 Error Handling

Digital FunctionsExamples of STL representation

Variable HandlingExamples of Data Types and Variable Processing

FB 109 Chapter 9 Comparison FunctionsFB 110 Chapter 10 Arithmetic FunctionsFB 111 Chapter 11 Math FunctionsFB 112 Chapter 12 Conversion FunctionsFB 113 Chapter 13 Shift FunctionsFB 114 Chapter 14 Word Logic

FB 124 Chapter 24 Data TypesFB 125 Chapter 25 Indirect AddressingFB 126 Chapter 26 Direct Variable AccessFB 101 Elementary Data TypesFB 102 Complex Data TypesFB 103 Parameter Types

Program Flow ControlExamples of STL representation

Conveyor ExampleExamples of Basic Functions and Local Instances

FB 115 Chapter 15 Status BitsFB 116 Chapter 16 Jump FunctionsFB 117 Chapter 17 Master Control RelayFB 118 Chapter 18 Block FunctionsFB 119 Chapter 19 Block ParametersSource File Block Programming (Chapter 3)

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

Message Frame ExampleHandling Data examples

General Examples

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock CheckFC 62 Generate ChecksumFC 63 Convert Date

FC 41 Range MonitorFC 42 Limit Value DetectionFC 43 Compound Interest CalculationFC 44 Double-Word-Wise Edge EvaluationFC 45 Converting S5 Floating-Point to S7 REALFC 46 Converting S7 REAL to S5 Floating-PointFC 47 Copy Data Area (ANY Pointer)

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 2: Berger Automating with STEP7 in STL and SCL

Berger Automating with STEP 7 in STL and SCL

Automating with STEP7 in STL and SCLProgrammable Controllers SIMATIC S7-300400

by Hans Berger

6th revised and enlarged edition 2012

Publicis Publishing

Bibliographic information published by the Deutsche NationalbibliothekThe Deutsche Nationalbibliothek lists this publication in the Deutsche Nationalbibliografie detailed bibliographic data are available in the Internet at httpdnbd-nbde

ISBN 978-3-89578-412-56th edition 2012

Editor Siemens Aktiengesellschaft Berlin and Munich Publisher Publicis Publishing Erlangen copy 2012 by Publicis Erlangen Zweigniederlassung der PWW GmbH

This publication and all parts thereof are protected by copyright Any use of it outside the strict provisions of the copyright law without the consent of the publisher is forbidden and will incur penalties This applies particularly to reproduction translation microfilming or other processingsbquo and to storage or processing in electronic systems It also applies to the use of individual illustrations or extracts from the text

Printed in Germany

This book contains one Trial DVD ldquoSIMATIC STEP 7 Professional Edition 2010 SR1 Trial Licenserdquo encompasses SIMATIC STEP 7 V55 SP1 S7-GRAPH V53 SP7 S7-SCL V53 SP6 S7-PLCSIM V54 SP5 and can be used for trial purposes for 14 days

This Software can only be used with the Microsoft Windows XP 32 Bit Professional Edition SP3 or Microsoft Windows 7 3264 Bit Professional Edition SP1 or Microsoft Windows 7 3264 Bit Ultimate Edition SP1 operating systems

Additional information can be found in the Internet at httpwwwsiemenscomscecontact httpwwwsiemenscomscemodules httpwwwsiemenscomscetp

The programming examples concentrate on describing the STL and SCL functions and providing SIMATIC S7 users with programming tips for solving specific tasks with this controller

The programming examples given in the book do not pretend to be complete solutions or to be executable on future STEP 7 releases or S7-300400 versions Additional care must be taken in order to comply with the relevant safety regulations

The author and publisher have taken great care with all texts and illustrations in this book Nevertheless errors can never be completely avoided The publisher and the author accept no liability regardless of legal basis for any damage resulting from the use of the programming examples

The author and publisher are always grateful to hear your responses to the contents of the book

Publicis Publishing PO Box 3240 91050 ErlangenE-mail publishing-distributionpublicisde

Internet wwwpublicis-booksde

Preface

5

Preface

The SIMATIC automation system unites all thesubsystems of an automation solution under auniform system architecture to form a homoge-neous whole from the field level right up to pro-cess control This Totally Integrated Automa-tion (TIA) enables integrated configuring andprogramming data management and communi-cations throughout the complete automationsystem

As the basic tool for SIMATIC STEP 7 playsan integrating role in Totally Integrated Auto-mation STEP 7 is used to configure and pro-gram the SIMATIC S7 SIMATIC C7 andSIMATIC WinAC automation systems Micro-soft Windows has been chosen as the operatingsystem to take advantage of the familiar userinterface of standard PCs as also used in officeenvironments

For block programming STEP 7 provides pro-gramming languages that comply with DIN EN61131-3 STL (statement list an Assembler-like language) LAD (ladder logic a represen-tation similar to relay logic diagrams) FBD(function block diagram) and the S7-SCLoptional package (Structured Control Lan-guage a Pascal-like high-level language) Sev-eral optional packages supplement these lan-guages S7-GRAPH (sequential control) S7-HiGraph (programming with state-transitiondiagrams) and CFC (connecting blocks similarto function block diagram) The various meth-ods of representation allow every user to selectthe suitable control function description Thisbroad adaptability in representing the controltask to be solved significantly simplifies work-ing with STEP 7

This book describes the STL and SCL program-ming languages for S7-300400 As a valuablesupplement to the description of the languagesand following an introduction to the S7-300400 automation system it provides valuablepractice-oriented information on the basic han-

dling of STEP 7 when configuring networkingand programming SIMATIC PLCs Thedescription of the ldquoBasic Functionsrdquo of a binarycontrol such as logic operations or latchingunlatching functions makes it particularly easyfor first-time users or users changing from relaycontactor controls to become acquainted withSTEP 7 The digital functions explain how dig-ital values are combined for example basiccalculations comparisons or data type conver-sion

The book shows how you can control programprocessing (program flow) and design struc-tured programs In addition to the cyclicallyprocessed main program you can also incorpo-rate event-driven program sections as well asinfluence the behavior of the controller atstartup and in the event of errorsfaults

One section of the book is dedicated to thedescription of the SCL programming languageSCL is especially suitable for programmingcomplex algorithms or for tasks in the datamanagement area and it supplements STLtowards higher-level programming languagesThe book concludes with the description of aprogram for converting STEP 5 programs toSTEP 7 programs and a general overview ofthe system functions and the function set forSTL and SCL

The contents of this book describe Version 55of the STEP 7 programming software and Ver-sion 53 SP5 of the S7-SCL optional package

Nuremberg May 2012

Hans Berger

6

The Contents of the Book at a Glance

Overview of the S7-300400 programma-ble logic controller

PLC functions compa-rable to a contactor control system

Numbers manipulat-ing the contents of the accumulators

Program run control block functions

Introduction

1 SIMATIC S7-300400 Programmable Controller

Structure of the Pro-grammable Controller(Hardware Components of S7-300400)Memory AreasDistributed IO (PROFIBUS DP)Communications (Subnets)Modules AddressesAddresses Areas

2 STEP 7 Program-ming Software

Editing ProjectsConfiguring StationsConfiguring the Net-work Symbol EditorSTL Program EditorSCL Program EditorOnline ModeTesting the Program

3 SIMATIC S7 Program

Program ProcessingBlock TypesProgramming STL and SCL Code Blocks Programming Data BlocksAddressing Variables Constant Representa-tions Data Types (Overview)

Basic Functions

4 Binary Logic Operations

AND OR and Exclusive OR FunctionsNesting Functions

5 Memory Functions

Assign Set and ResetEdge EvaluationExample of a Conveyor Belt Control System

6 Move Functions

Load FunctionsTransfer FunctionsAccumulator FunctionsSystem Functions for Data Transfer

7 Timer Functions

Start SIMATIC Timers with Five Different TypesIEC Timers

8 Counter Functions

SIMATIC CountersCount up Count down Set Reset and Scan CountersIEC Counters

Digital Functions

9 Comparison Functions

Comparison Accord-ing to Data Types INT DINT and REAL

10 Arithmetic Functions

Four-function Math with INT DINT and REAL numbersAdding ConstantsDecrementing and Incrementing

11 Math Functions

Trigonometric FunctionsArc FunctionsPowers Logarithm

12 Converting Functions

Data Type Conversion Complement Forma-tion

13 Shift Functions

Shifting and Rotating

14 Word Logic

AND OR Exclusive OR

Program Flow Control

15 Status Bits

Binary Flags Digital FlagsENENOMechanism

16 Jump Functions

Unconditional Jump Jumps Conditional on the RLO BR and the Digital FlagsJump Distributor Loop Jump

17 Master Control Relay

MCR Dependency MCR Area MCR Zone

18 Block Functions

Block Call Block EndTemporary and Static Local DataData Addresses

19 Block Parameters

Formal Parameters Actual ParametersDeclarations Assignments andldquoParameter Passingrdquo

7

Processing the user program

Working with complex variables indirect addressing

Description of the Programming Language SCL

S5S7 Converter block libraries overviews

ProgramProcessing

20 Main Program

Program Structure Scan Cycle Control(Response Time Start Information Back-ground Scanning) Program FunctionsCommunications via Distributed IO and Global Data S7 and S7-Basic Communications

21 Interrupt Handling

Time-of-Day Inter-rupts Time-Delay In-terrupts Watchdog Interrupts Hardware Interrupts DPV1 In-terrupts Multiproces-sor Interrupt Handling Interrupts

22 Restart Characteristics

Cold Restart Hot Restart Warm RestartSTOP HOLD Memory ResetParameterizing Modules

23 Error Handling

Synchronous ErrorsAsynchronous ErrorsSystem Diagnostics

Variable Handling

24 Data Types

Structure of the Data TypesDeclaration and Use of Elementary and Complex Data TypesProgramming of User Defined Data Types UDT

25 Indirect Addressing

Area PointerDB PointerANY PointerIndirect Addressing via Memory and Register (Area-internal and Area-crossing)Working with Address Registers

26 Direct Variable Access

Load Variable AddressData Storage of Variables in the MemoryData Storage when Transferring Parame-ters ldquoVariablerdquo ANY PointerBrief Description of the ldquoMessage Frame Examplerdquo

Structured Control Language SCL

27 Introduction Language Elements

Addressing Operators Expressions Value Assignments

28 Control Statements

IF CASE FOR WHILE REPEAT CONTINUE EXIT GOTO RETURN

29 SCL Block Calls

Function Value OK Variable ENENO Mechanism Descrip-tion of Examples

30 SCL Functions

Timer FunctionsCounter FunctionsConversion and Math FunctionsShifting and Rotating

31 IEC Functions

Conversion and Com-parison FunctionsSTRING FunctionsDateTime-of-Day FunctionsNumerical Functions

Appendix

32 S5S7 Converter

Preparations for ConversionConverting STEP 5 ProgramsPostprocessing

33 Block Libraries

Organization BlocksSystem Function BlocksIEC Function BlocksS5-S7 Converting BlocksTI-S7 Converting BlocksPID Control BlocksDP Functions

34 STL Operation Overview

Basic FunctionsDigital FunctionsProgram Flow ControlIndirect Addressing

35 SCL Statement and Function Overview

OperatorsControl StatementsBlock CallsStandard Functions

8

The Programming Examples

The present book provides many figures repre-senting the use of the STL and SCL program-ming languages All programming examplescan be downloaded from the publisherrsquos web-site wwwpublicis-booksde There are two li-braries one for STL examples (STL_Book) andone for SCL examples (SCL_Book) Whendearchived with the Retrieve function these li-braries occupy approximately 29 or 17 MB(dependent on the PGPC file system used)

The library STL_Book contains eight programsthat are essentially illustrations of the STLmethod of representation Two extensive exam-ples show the programming of functions func-tion blocks and local instances (Conveyor Ex-ample) and the handling of data (MessageFrame Example) All the examples exist assource files and contain symbols and com-ments

The library SCL_Book contains five programswith representations of the SCL statements and

Library STL_Book

Basic FunctionsExamples of STL representation

Program ProcessingExamples of SFC Calls

FB 104 Chapter 4 Binary Logic OperationsFB 105 Chapter 5 Memory FunctionsFB 106 Chapter 6 Transfer FunctionsFB 107 Chapter 7 Timer FunctionsFB 108 Chapter 8 Counter Functions

FB 120 Chapter 20 Main ProgramFB 121 Chapter 21 Interrupt HandlingFB 122 Chapter 22 Restart CharacteristicsFB 123 Chapter 23 Error Handling

Digital FunctionsExamples of STL representation

Variable HandlingExamples of Data Types and Variable Processing

FB 109 Chapter 9 Comparison FunctionsFB 110 Chapter 10 Arithmetic FunctionsFB 111 Chapter 11 Math FunctionsFB 112 Chapter 12 Conversion FunctionsFB 113 Chapter 13 Shift FunctionsFB 114 Chapter 14 Word Logic

FB 124 Chapter 24 Data TypesFB 125 Chapter 25 Indirect AddressingFB 126 Chapter 26 Direct Variable AccessFB 101 Elementary Data TypesFB 102 Complex Data TypesFB 103 Parameter Types

Program Flow ControlExamples of STL representation

Conveyor ExampleExamples of Basic Functions and Local Instances

FB 115 Chapter 15 Status BitsFB 116 Chapter 16 Jump FunctionsFB 117 Chapter 17 Master Control RelayFB 118 Chapter 18 Block FunctionsFB 119 Chapter 19 Block ParametersSource File Block Programming (Chapter 3)

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

Message Frame ExampleHandling Data examples

General Examples

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock CheckFC 62 Generate ChecksumFC 63 Convert Date

FC 41 Range MonitorFC 42 Limit Value DetectionFC 43 Compound Interest CalculationFC 44 Double-Word-Wise Edge EvaluationFC 45 Converting S5 Floating-Point to S7 REALFC 46 Converting S7 REAL to S5 Floating-PointFC 47 Copy Data Area (ANY Pointer)

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 3: Berger Automating with STEP7 in STL and SCL

Automating with STEP7 in STL and SCLProgrammable Controllers SIMATIC S7-300400

by Hans Berger

6th revised and enlarged edition 2012

Publicis Publishing

Bibliographic information published by the Deutsche NationalbibliothekThe Deutsche Nationalbibliothek lists this publication in the Deutsche Nationalbibliografie detailed bibliographic data are available in the Internet at httpdnbd-nbde

ISBN 978-3-89578-412-56th edition 2012

Editor Siemens Aktiengesellschaft Berlin and Munich Publisher Publicis Publishing Erlangen copy 2012 by Publicis Erlangen Zweigniederlassung der PWW GmbH

This publication and all parts thereof are protected by copyright Any use of it outside the strict provisions of the copyright law without the consent of the publisher is forbidden and will incur penalties This applies particularly to reproduction translation microfilming or other processingsbquo and to storage or processing in electronic systems It also applies to the use of individual illustrations or extracts from the text

Printed in Germany

This book contains one Trial DVD ldquoSIMATIC STEP 7 Professional Edition 2010 SR1 Trial Licenserdquo encompasses SIMATIC STEP 7 V55 SP1 S7-GRAPH V53 SP7 S7-SCL V53 SP6 S7-PLCSIM V54 SP5 and can be used for trial purposes for 14 days

This Software can only be used with the Microsoft Windows XP 32 Bit Professional Edition SP3 or Microsoft Windows 7 3264 Bit Professional Edition SP1 or Microsoft Windows 7 3264 Bit Ultimate Edition SP1 operating systems

Additional information can be found in the Internet at httpwwwsiemenscomscecontact httpwwwsiemenscomscemodules httpwwwsiemenscomscetp

The programming examples concentrate on describing the STL and SCL functions and providing SIMATIC S7 users with programming tips for solving specific tasks with this controller

The programming examples given in the book do not pretend to be complete solutions or to be executable on future STEP 7 releases or S7-300400 versions Additional care must be taken in order to comply with the relevant safety regulations

The author and publisher have taken great care with all texts and illustrations in this book Nevertheless errors can never be completely avoided The publisher and the author accept no liability regardless of legal basis for any damage resulting from the use of the programming examples

The author and publisher are always grateful to hear your responses to the contents of the book

Publicis Publishing PO Box 3240 91050 ErlangenE-mail publishing-distributionpublicisde

Internet wwwpublicis-booksde

Preface

5

Preface

The SIMATIC automation system unites all thesubsystems of an automation solution under auniform system architecture to form a homoge-neous whole from the field level right up to pro-cess control This Totally Integrated Automa-tion (TIA) enables integrated configuring andprogramming data management and communi-cations throughout the complete automationsystem

As the basic tool for SIMATIC STEP 7 playsan integrating role in Totally Integrated Auto-mation STEP 7 is used to configure and pro-gram the SIMATIC S7 SIMATIC C7 andSIMATIC WinAC automation systems Micro-soft Windows has been chosen as the operatingsystem to take advantage of the familiar userinterface of standard PCs as also used in officeenvironments

For block programming STEP 7 provides pro-gramming languages that comply with DIN EN61131-3 STL (statement list an Assembler-like language) LAD (ladder logic a represen-tation similar to relay logic diagrams) FBD(function block diagram) and the S7-SCLoptional package (Structured Control Lan-guage a Pascal-like high-level language) Sev-eral optional packages supplement these lan-guages S7-GRAPH (sequential control) S7-HiGraph (programming with state-transitiondiagrams) and CFC (connecting blocks similarto function block diagram) The various meth-ods of representation allow every user to selectthe suitable control function description Thisbroad adaptability in representing the controltask to be solved significantly simplifies work-ing with STEP 7

This book describes the STL and SCL program-ming languages for S7-300400 As a valuablesupplement to the description of the languagesand following an introduction to the S7-300400 automation system it provides valuablepractice-oriented information on the basic han-

dling of STEP 7 when configuring networkingand programming SIMATIC PLCs Thedescription of the ldquoBasic Functionsrdquo of a binarycontrol such as logic operations or latchingunlatching functions makes it particularly easyfor first-time users or users changing from relaycontactor controls to become acquainted withSTEP 7 The digital functions explain how dig-ital values are combined for example basiccalculations comparisons or data type conver-sion

The book shows how you can control programprocessing (program flow) and design struc-tured programs In addition to the cyclicallyprocessed main program you can also incorpo-rate event-driven program sections as well asinfluence the behavior of the controller atstartup and in the event of errorsfaults

One section of the book is dedicated to thedescription of the SCL programming languageSCL is especially suitable for programmingcomplex algorithms or for tasks in the datamanagement area and it supplements STLtowards higher-level programming languagesThe book concludes with the description of aprogram for converting STEP 5 programs toSTEP 7 programs and a general overview ofthe system functions and the function set forSTL and SCL

The contents of this book describe Version 55of the STEP 7 programming software and Ver-sion 53 SP5 of the S7-SCL optional package

Nuremberg May 2012

Hans Berger

6

The Contents of the Book at a Glance

Overview of the S7-300400 programma-ble logic controller

PLC functions compa-rable to a contactor control system

Numbers manipulat-ing the contents of the accumulators

Program run control block functions

Introduction

1 SIMATIC S7-300400 Programmable Controller

Structure of the Pro-grammable Controller(Hardware Components of S7-300400)Memory AreasDistributed IO (PROFIBUS DP)Communications (Subnets)Modules AddressesAddresses Areas

2 STEP 7 Program-ming Software

Editing ProjectsConfiguring StationsConfiguring the Net-work Symbol EditorSTL Program EditorSCL Program EditorOnline ModeTesting the Program

3 SIMATIC S7 Program

Program ProcessingBlock TypesProgramming STL and SCL Code Blocks Programming Data BlocksAddressing Variables Constant Representa-tions Data Types (Overview)

Basic Functions

4 Binary Logic Operations

AND OR and Exclusive OR FunctionsNesting Functions

5 Memory Functions

Assign Set and ResetEdge EvaluationExample of a Conveyor Belt Control System

6 Move Functions

Load FunctionsTransfer FunctionsAccumulator FunctionsSystem Functions for Data Transfer

7 Timer Functions

Start SIMATIC Timers with Five Different TypesIEC Timers

8 Counter Functions

SIMATIC CountersCount up Count down Set Reset and Scan CountersIEC Counters

Digital Functions

9 Comparison Functions

Comparison Accord-ing to Data Types INT DINT and REAL

10 Arithmetic Functions

Four-function Math with INT DINT and REAL numbersAdding ConstantsDecrementing and Incrementing

11 Math Functions

Trigonometric FunctionsArc FunctionsPowers Logarithm

12 Converting Functions

Data Type Conversion Complement Forma-tion

13 Shift Functions

Shifting and Rotating

14 Word Logic

AND OR Exclusive OR

Program Flow Control

15 Status Bits

Binary Flags Digital FlagsENENOMechanism

16 Jump Functions

Unconditional Jump Jumps Conditional on the RLO BR and the Digital FlagsJump Distributor Loop Jump

17 Master Control Relay

MCR Dependency MCR Area MCR Zone

18 Block Functions

Block Call Block EndTemporary and Static Local DataData Addresses

19 Block Parameters

Formal Parameters Actual ParametersDeclarations Assignments andldquoParameter Passingrdquo

7

Processing the user program

Working with complex variables indirect addressing

Description of the Programming Language SCL

S5S7 Converter block libraries overviews

ProgramProcessing

20 Main Program

Program Structure Scan Cycle Control(Response Time Start Information Back-ground Scanning) Program FunctionsCommunications via Distributed IO and Global Data S7 and S7-Basic Communications

21 Interrupt Handling

Time-of-Day Inter-rupts Time-Delay In-terrupts Watchdog Interrupts Hardware Interrupts DPV1 In-terrupts Multiproces-sor Interrupt Handling Interrupts

22 Restart Characteristics

Cold Restart Hot Restart Warm RestartSTOP HOLD Memory ResetParameterizing Modules

23 Error Handling

Synchronous ErrorsAsynchronous ErrorsSystem Diagnostics

Variable Handling

24 Data Types

Structure of the Data TypesDeclaration and Use of Elementary and Complex Data TypesProgramming of User Defined Data Types UDT

25 Indirect Addressing

Area PointerDB PointerANY PointerIndirect Addressing via Memory and Register (Area-internal and Area-crossing)Working with Address Registers

26 Direct Variable Access

Load Variable AddressData Storage of Variables in the MemoryData Storage when Transferring Parame-ters ldquoVariablerdquo ANY PointerBrief Description of the ldquoMessage Frame Examplerdquo

Structured Control Language SCL

27 Introduction Language Elements

Addressing Operators Expressions Value Assignments

28 Control Statements

IF CASE FOR WHILE REPEAT CONTINUE EXIT GOTO RETURN

29 SCL Block Calls

Function Value OK Variable ENENO Mechanism Descrip-tion of Examples

30 SCL Functions

Timer FunctionsCounter FunctionsConversion and Math FunctionsShifting and Rotating

31 IEC Functions

Conversion and Com-parison FunctionsSTRING FunctionsDateTime-of-Day FunctionsNumerical Functions

Appendix

32 S5S7 Converter

Preparations for ConversionConverting STEP 5 ProgramsPostprocessing

33 Block Libraries

Organization BlocksSystem Function BlocksIEC Function BlocksS5-S7 Converting BlocksTI-S7 Converting BlocksPID Control BlocksDP Functions

34 STL Operation Overview

Basic FunctionsDigital FunctionsProgram Flow ControlIndirect Addressing

35 SCL Statement and Function Overview

OperatorsControl StatementsBlock CallsStandard Functions

8

The Programming Examples

The present book provides many figures repre-senting the use of the STL and SCL program-ming languages All programming examplescan be downloaded from the publisherrsquos web-site wwwpublicis-booksde There are two li-braries one for STL examples (STL_Book) andone for SCL examples (SCL_Book) Whendearchived with the Retrieve function these li-braries occupy approximately 29 or 17 MB(dependent on the PGPC file system used)

The library STL_Book contains eight programsthat are essentially illustrations of the STLmethod of representation Two extensive exam-ples show the programming of functions func-tion blocks and local instances (Conveyor Ex-ample) and the handling of data (MessageFrame Example) All the examples exist assource files and contain symbols and com-ments

The library SCL_Book contains five programswith representations of the SCL statements and

Library STL_Book

Basic FunctionsExamples of STL representation

Program ProcessingExamples of SFC Calls

FB 104 Chapter 4 Binary Logic OperationsFB 105 Chapter 5 Memory FunctionsFB 106 Chapter 6 Transfer FunctionsFB 107 Chapter 7 Timer FunctionsFB 108 Chapter 8 Counter Functions

FB 120 Chapter 20 Main ProgramFB 121 Chapter 21 Interrupt HandlingFB 122 Chapter 22 Restart CharacteristicsFB 123 Chapter 23 Error Handling

Digital FunctionsExamples of STL representation

Variable HandlingExamples of Data Types and Variable Processing

FB 109 Chapter 9 Comparison FunctionsFB 110 Chapter 10 Arithmetic FunctionsFB 111 Chapter 11 Math FunctionsFB 112 Chapter 12 Conversion FunctionsFB 113 Chapter 13 Shift FunctionsFB 114 Chapter 14 Word Logic

FB 124 Chapter 24 Data TypesFB 125 Chapter 25 Indirect AddressingFB 126 Chapter 26 Direct Variable AccessFB 101 Elementary Data TypesFB 102 Complex Data TypesFB 103 Parameter Types

Program Flow ControlExamples of STL representation

Conveyor ExampleExamples of Basic Functions and Local Instances

FB 115 Chapter 15 Status BitsFB 116 Chapter 16 Jump FunctionsFB 117 Chapter 17 Master Control RelayFB 118 Chapter 18 Block FunctionsFB 119 Chapter 19 Block ParametersSource File Block Programming (Chapter 3)

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

Message Frame ExampleHandling Data examples

General Examples

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock CheckFC 62 Generate ChecksumFC 63 Convert Date

FC 41 Range MonitorFC 42 Limit Value DetectionFC 43 Compound Interest CalculationFC 44 Double-Word-Wise Edge EvaluationFC 45 Converting S5 Floating-Point to S7 REALFC 46 Converting S7 REAL to S5 Floating-PointFC 47 Copy Data Area (ANY Pointer)

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 4: Berger Automating with STEP7 in STL and SCL

Bibliographic information published by the Deutsche NationalbibliothekThe Deutsche Nationalbibliothek lists this publication in the Deutsche Nationalbibliografie detailed bibliographic data are available in the Internet at httpdnbd-nbde

ISBN 978-3-89578-412-56th edition 2012

Editor Siemens Aktiengesellschaft Berlin and Munich Publisher Publicis Publishing Erlangen copy 2012 by Publicis Erlangen Zweigniederlassung der PWW GmbH

This publication and all parts thereof are protected by copyright Any use of it outside the strict provisions of the copyright law without the consent of the publisher is forbidden and will incur penalties This applies particularly to reproduction translation microfilming or other processingsbquo and to storage or processing in electronic systems It also applies to the use of individual illustrations or extracts from the text

Printed in Germany

This book contains one Trial DVD ldquoSIMATIC STEP 7 Professional Edition 2010 SR1 Trial Licenserdquo encompasses SIMATIC STEP 7 V55 SP1 S7-GRAPH V53 SP7 S7-SCL V53 SP6 S7-PLCSIM V54 SP5 and can be used for trial purposes for 14 days

This Software can only be used with the Microsoft Windows XP 32 Bit Professional Edition SP3 or Microsoft Windows 7 3264 Bit Professional Edition SP1 or Microsoft Windows 7 3264 Bit Ultimate Edition SP1 operating systems

Additional information can be found in the Internet at httpwwwsiemenscomscecontact httpwwwsiemenscomscemodules httpwwwsiemenscomscetp

The programming examples concentrate on describing the STL and SCL functions and providing SIMATIC S7 users with programming tips for solving specific tasks with this controller

The programming examples given in the book do not pretend to be complete solutions or to be executable on future STEP 7 releases or S7-300400 versions Additional care must be taken in order to comply with the relevant safety regulations

The author and publisher have taken great care with all texts and illustrations in this book Nevertheless errors can never be completely avoided The publisher and the author accept no liability regardless of legal basis for any damage resulting from the use of the programming examples

The author and publisher are always grateful to hear your responses to the contents of the book

Publicis Publishing PO Box 3240 91050 ErlangenE-mail publishing-distributionpublicisde

Internet wwwpublicis-booksde

Preface

5

Preface

The SIMATIC automation system unites all thesubsystems of an automation solution under auniform system architecture to form a homoge-neous whole from the field level right up to pro-cess control This Totally Integrated Automa-tion (TIA) enables integrated configuring andprogramming data management and communi-cations throughout the complete automationsystem

As the basic tool for SIMATIC STEP 7 playsan integrating role in Totally Integrated Auto-mation STEP 7 is used to configure and pro-gram the SIMATIC S7 SIMATIC C7 andSIMATIC WinAC automation systems Micro-soft Windows has been chosen as the operatingsystem to take advantage of the familiar userinterface of standard PCs as also used in officeenvironments

For block programming STEP 7 provides pro-gramming languages that comply with DIN EN61131-3 STL (statement list an Assembler-like language) LAD (ladder logic a represen-tation similar to relay logic diagrams) FBD(function block diagram) and the S7-SCLoptional package (Structured Control Lan-guage a Pascal-like high-level language) Sev-eral optional packages supplement these lan-guages S7-GRAPH (sequential control) S7-HiGraph (programming with state-transitiondiagrams) and CFC (connecting blocks similarto function block diagram) The various meth-ods of representation allow every user to selectthe suitable control function description Thisbroad adaptability in representing the controltask to be solved significantly simplifies work-ing with STEP 7

This book describes the STL and SCL program-ming languages for S7-300400 As a valuablesupplement to the description of the languagesand following an introduction to the S7-300400 automation system it provides valuablepractice-oriented information on the basic han-

dling of STEP 7 when configuring networkingand programming SIMATIC PLCs Thedescription of the ldquoBasic Functionsrdquo of a binarycontrol such as logic operations or latchingunlatching functions makes it particularly easyfor first-time users or users changing from relaycontactor controls to become acquainted withSTEP 7 The digital functions explain how dig-ital values are combined for example basiccalculations comparisons or data type conver-sion

The book shows how you can control programprocessing (program flow) and design struc-tured programs In addition to the cyclicallyprocessed main program you can also incorpo-rate event-driven program sections as well asinfluence the behavior of the controller atstartup and in the event of errorsfaults

One section of the book is dedicated to thedescription of the SCL programming languageSCL is especially suitable for programmingcomplex algorithms or for tasks in the datamanagement area and it supplements STLtowards higher-level programming languagesThe book concludes with the description of aprogram for converting STEP 5 programs toSTEP 7 programs and a general overview ofthe system functions and the function set forSTL and SCL

The contents of this book describe Version 55of the STEP 7 programming software and Ver-sion 53 SP5 of the S7-SCL optional package

Nuremberg May 2012

Hans Berger

6

The Contents of the Book at a Glance

Overview of the S7-300400 programma-ble logic controller

PLC functions compa-rable to a contactor control system

Numbers manipulat-ing the contents of the accumulators

Program run control block functions

Introduction

1 SIMATIC S7-300400 Programmable Controller

Structure of the Pro-grammable Controller(Hardware Components of S7-300400)Memory AreasDistributed IO (PROFIBUS DP)Communications (Subnets)Modules AddressesAddresses Areas

2 STEP 7 Program-ming Software

Editing ProjectsConfiguring StationsConfiguring the Net-work Symbol EditorSTL Program EditorSCL Program EditorOnline ModeTesting the Program

3 SIMATIC S7 Program

Program ProcessingBlock TypesProgramming STL and SCL Code Blocks Programming Data BlocksAddressing Variables Constant Representa-tions Data Types (Overview)

Basic Functions

4 Binary Logic Operations

AND OR and Exclusive OR FunctionsNesting Functions

5 Memory Functions

Assign Set and ResetEdge EvaluationExample of a Conveyor Belt Control System

6 Move Functions

Load FunctionsTransfer FunctionsAccumulator FunctionsSystem Functions for Data Transfer

7 Timer Functions

Start SIMATIC Timers with Five Different TypesIEC Timers

8 Counter Functions

SIMATIC CountersCount up Count down Set Reset and Scan CountersIEC Counters

Digital Functions

9 Comparison Functions

Comparison Accord-ing to Data Types INT DINT and REAL

10 Arithmetic Functions

Four-function Math with INT DINT and REAL numbersAdding ConstantsDecrementing and Incrementing

11 Math Functions

Trigonometric FunctionsArc FunctionsPowers Logarithm

12 Converting Functions

Data Type Conversion Complement Forma-tion

13 Shift Functions

Shifting and Rotating

14 Word Logic

AND OR Exclusive OR

Program Flow Control

15 Status Bits

Binary Flags Digital FlagsENENOMechanism

16 Jump Functions

Unconditional Jump Jumps Conditional on the RLO BR and the Digital FlagsJump Distributor Loop Jump

17 Master Control Relay

MCR Dependency MCR Area MCR Zone

18 Block Functions

Block Call Block EndTemporary and Static Local DataData Addresses

19 Block Parameters

Formal Parameters Actual ParametersDeclarations Assignments andldquoParameter Passingrdquo

7

Processing the user program

Working with complex variables indirect addressing

Description of the Programming Language SCL

S5S7 Converter block libraries overviews

ProgramProcessing

20 Main Program

Program Structure Scan Cycle Control(Response Time Start Information Back-ground Scanning) Program FunctionsCommunications via Distributed IO and Global Data S7 and S7-Basic Communications

21 Interrupt Handling

Time-of-Day Inter-rupts Time-Delay In-terrupts Watchdog Interrupts Hardware Interrupts DPV1 In-terrupts Multiproces-sor Interrupt Handling Interrupts

22 Restart Characteristics

Cold Restart Hot Restart Warm RestartSTOP HOLD Memory ResetParameterizing Modules

23 Error Handling

Synchronous ErrorsAsynchronous ErrorsSystem Diagnostics

Variable Handling

24 Data Types

Structure of the Data TypesDeclaration and Use of Elementary and Complex Data TypesProgramming of User Defined Data Types UDT

25 Indirect Addressing

Area PointerDB PointerANY PointerIndirect Addressing via Memory and Register (Area-internal and Area-crossing)Working with Address Registers

26 Direct Variable Access

Load Variable AddressData Storage of Variables in the MemoryData Storage when Transferring Parame-ters ldquoVariablerdquo ANY PointerBrief Description of the ldquoMessage Frame Examplerdquo

Structured Control Language SCL

27 Introduction Language Elements

Addressing Operators Expressions Value Assignments

28 Control Statements

IF CASE FOR WHILE REPEAT CONTINUE EXIT GOTO RETURN

29 SCL Block Calls

Function Value OK Variable ENENO Mechanism Descrip-tion of Examples

30 SCL Functions

Timer FunctionsCounter FunctionsConversion and Math FunctionsShifting and Rotating

31 IEC Functions

Conversion and Com-parison FunctionsSTRING FunctionsDateTime-of-Day FunctionsNumerical Functions

Appendix

32 S5S7 Converter

Preparations for ConversionConverting STEP 5 ProgramsPostprocessing

33 Block Libraries

Organization BlocksSystem Function BlocksIEC Function BlocksS5-S7 Converting BlocksTI-S7 Converting BlocksPID Control BlocksDP Functions

34 STL Operation Overview

Basic FunctionsDigital FunctionsProgram Flow ControlIndirect Addressing

35 SCL Statement and Function Overview

OperatorsControl StatementsBlock CallsStandard Functions

8

The Programming Examples

The present book provides many figures repre-senting the use of the STL and SCL program-ming languages All programming examplescan be downloaded from the publisherrsquos web-site wwwpublicis-booksde There are two li-braries one for STL examples (STL_Book) andone for SCL examples (SCL_Book) Whendearchived with the Retrieve function these li-braries occupy approximately 29 or 17 MB(dependent on the PGPC file system used)

The library STL_Book contains eight programsthat are essentially illustrations of the STLmethod of representation Two extensive exam-ples show the programming of functions func-tion blocks and local instances (Conveyor Ex-ample) and the handling of data (MessageFrame Example) All the examples exist assource files and contain symbols and com-ments

The library SCL_Book contains five programswith representations of the SCL statements and

Library STL_Book

Basic FunctionsExamples of STL representation

Program ProcessingExamples of SFC Calls

FB 104 Chapter 4 Binary Logic OperationsFB 105 Chapter 5 Memory FunctionsFB 106 Chapter 6 Transfer FunctionsFB 107 Chapter 7 Timer FunctionsFB 108 Chapter 8 Counter Functions

FB 120 Chapter 20 Main ProgramFB 121 Chapter 21 Interrupt HandlingFB 122 Chapter 22 Restart CharacteristicsFB 123 Chapter 23 Error Handling

Digital FunctionsExamples of STL representation

Variable HandlingExamples of Data Types and Variable Processing

FB 109 Chapter 9 Comparison FunctionsFB 110 Chapter 10 Arithmetic FunctionsFB 111 Chapter 11 Math FunctionsFB 112 Chapter 12 Conversion FunctionsFB 113 Chapter 13 Shift FunctionsFB 114 Chapter 14 Word Logic

FB 124 Chapter 24 Data TypesFB 125 Chapter 25 Indirect AddressingFB 126 Chapter 26 Direct Variable AccessFB 101 Elementary Data TypesFB 102 Complex Data TypesFB 103 Parameter Types

Program Flow ControlExamples of STL representation

Conveyor ExampleExamples of Basic Functions and Local Instances

FB 115 Chapter 15 Status BitsFB 116 Chapter 16 Jump FunctionsFB 117 Chapter 17 Master Control RelayFB 118 Chapter 18 Block FunctionsFB 119 Chapter 19 Block ParametersSource File Block Programming (Chapter 3)

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

Message Frame ExampleHandling Data examples

General Examples

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock CheckFC 62 Generate ChecksumFC 63 Convert Date

FC 41 Range MonitorFC 42 Limit Value DetectionFC 43 Compound Interest CalculationFC 44 Double-Word-Wise Edge EvaluationFC 45 Converting S5 Floating-Point to S7 REALFC 46 Converting S7 REAL to S5 Floating-PointFC 47 Copy Data Area (ANY Pointer)

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 5: Berger Automating with STEP7 in STL and SCL

Preface

5

Preface

The SIMATIC automation system unites all thesubsystems of an automation solution under auniform system architecture to form a homoge-neous whole from the field level right up to pro-cess control This Totally Integrated Automa-tion (TIA) enables integrated configuring andprogramming data management and communi-cations throughout the complete automationsystem

As the basic tool for SIMATIC STEP 7 playsan integrating role in Totally Integrated Auto-mation STEP 7 is used to configure and pro-gram the SIMATIC S7 SIMATIC C7 andSIMATIC WinAC automation systems Micro-soft Windows has been chosen as the operatingsystem to take advantage of the familiar userinterface of standard PCs as also used in officeenvironments

For block programming STEP 7 provides pro-gramming languages that comply with DIN EN61131-3 STL (statement list an Assembler-like language) LAD (ladder logic a represen-tation similar to relay logic diagrams) FBD(function block diagram) and the S7-SCLoptional package (Structured Control Lan-guage a Pascal-like high-level language) Sev-eral optional packages supplement these lan-guages S7-GRAPH (sequential control) S7-HiGraph (programming with state-transitiondiagrams) and CFC (connecting blocks similarto function block diagram) The various meth-ods of representation allow every user to selectthe suitable control function description Thisbroad adaptability in representing the controltask to be solved significantly simplifies work-ing with STEP 7

This book describes the STL and SCL program-ming languages for S7-300400 As a valuablesupplement to the description of the languagesand following an introduction to the S7-300400 automation system it provides valuablepractice-oriented information on the basic han-

dling of STEP 7 when configuring networkingand programming SIMATIC PLCs Thedescription of the ldquoBasic Functionsrdquo of a binarycontrol such as logic operations or latchingunlatching functions makes it particularly easyfor first-time users or users changing from relaycontactor controls to become acquainted withSTEP 7 The digital functions explain how dig-ital values are combined for example basiccalculations comparisons or data type conver-sion

The book shows how you can control programprocessing (program flow) and design struc-tured programs In addition to the cyclicallyprocessed main program you can also incorpo-rate event-driven program sections as well asinfluence the behavior of the controller atstartup and in the event of errorsfaults

One section of the book is dedicated to thedescription of the SCL programming languageSCL is especially suitable for programmingcomplex algorithms or for tasks in the datamanagement area and it supplements STLtowards higher-level programming languagesThe book concludes with the description of aprogram for converting STEP 5 programs toSTEP 7 programs and a general overview ofthe system functions and the function set forSTL and SCL

The contents of this book describe Version 55of the STEP 7 programming software and Ver-sion 53 SP5 of the S7-SCL optional package

Nuremberg May 2012

Hans Berger

6

The Contents of the Book at a Glance

Overview of the S7-300400 programma-ble logic controller

PLC functions compa-rable to a contactor control system

Numbers manipulat-ing the contents of the accumulators

Program run control block functions

Introduction

1 SIMATIC S7-300400 Programmable Controller

Structure of the Pro-grammable Controller(Hardware Components of S7-300400)Memory AreasDistributed IO (PROFIBUS DP)Communications (Subnets)Modules AddressesAddresses Areas

2 STEP 7 Program-ming Software

Editing ProjectsConfiguring StationsConfiguring the Net-work Symbol EditorSTL Program EditorSCL Program EditorOnline ModeTesting the Program

3 SIMATIC S7 Program

Program ProcessingBlock TypesProgramming STL and SCL Code Blocks Programming Data BlocksAddressing Variables Constant Representa-tions Data Types (Overview)

Basic Functions

4 Binary Logic Operations

AND OR and Exclusive OR FunctionsNesting Functions

5 Memory Functions

Assign Set and ResetEdge EvaluationExample of a Conveyor Belt Control System

6 Move Functions

Load FunctionsTransfer FunctionsAccumulator FunctionsSystem Functions for Data Transfer

7 Timer Functions

Start SIMATIC Timers with Five Different TypesIEC Timers

8 Counter Functions

SIMATIC CountersCount up Count down Set Reset and Scan CountersIEC Counters

Digital Functions

9 Comparison Functions

Comparison Accord-ing to Data Types INT DINT and REAL

10 Arithmetic Functions

Four-function Math with INT DINT and REAL numbersAdding ConstantsDecrementing and Incrementing

11 Math Functions

Trigonometric FunctionsArc FunctionsPowers Logarithm

12 Converting Functions

Data Type Conversion Complement Forma-tion

13 Shift Functions

Shifting and Rotating

14 Word Logic

AND OR Exclusive OR

Program Flow Control

15 Status Bits

Binary Flags Digital FlagsENENOMechanism

16 Jump Functions

Unconditional Jump Jumps Conditional on the RLO BR and the Digital FlagsJump Distributor Loop Jump

17 Master Control Relay

MCR Dependency MCR Area MCR Zone

18 Block Functions

Block Call Block EndTemporary and Static Local DataData Addresses

19 Block Parameters

Formal Parameters Actual ParametersDeclarations Assignments andldquoParameter Passingrdquo

7

Processing the user program

Working with complex variables indirect addressing

Description of the Programming Language SCL

S5S7 Converter block libraries overviews

ProgramProcessing

20 Main Program

Program Structure Scan Cycle Control(Response Time Start Information Back-ground Scanning) Program FunctionsCommunications via Distributed IO and Global Data S7 and S7-Basic Communications

21 Interrupt Handling

Time-of-Day Inter-rupts Time-Delay In-terrupts Watchdog Interrupts Hardware Interrupts DPV1 In-terrupts Multiproces-sor Interrupt Handling Interrupts

22 Restart Characteristics

Cold Restart Hot Restart Warm RestartSTOP HOLD Memory ResetParameterizing Modules

23 Error Handling

Synchronous ErrorsAsynchronous ErrorsSystem Diagnostics

Variable Handling

24 Data Types

Structure of the Data TypesDeclaration and Use of Elementary and Complex Data TypesProgramming of User Defined Data Types UDT

25 Indirect Addressing

Area PointerDB PointerANY PointerIndirect Addressing via Memory and Register (Area-internal and Area-crossing)Working with Address Registers

26 Direct Variable Access

Load Variable AddressData Storage of Variables in the MemoryData Storage when Transferring Parame-ters ldquoVariablerdquo ANY PointerBrief Description of the ldquoMessage Frame Examplerdquo

Structured Control Language SCL

27 Introduction Language Elements

Addressing Operators Expressions Value Assignments

28 Control Statements

IF CASE FOR WHILE REPEAT CONTINUE EXIT GOTO RETURN

29 SCL Block Calls

Function Value OK Variable ENENO Mechanism Descrip-tion of Examples

30 SCL Functions

Timer FunctionsCounter FunctionsConversion and Math FunctionsShifting and Rotating

31 IEC Functions

Conversion and Com-parison FunctionsSTRING FunctionsDateTime-of-Day FunctionsNumerical Functions

Appendix

32 S5S7 Converter

Preparations for ConversionConverting STEP 5 ProgramsPostprocessing

33 Block Libraries

Organization BlocksSystem Function BlocksIEC Function BlocksS5-S7 Converting BlocksTI-S7 Converting BlocksPID Control BlocksDP Functions

34 STL Operation Overview

Basic FunctionsDigital FunctionsProgram Flow ControlIndirect Addressing

35 SCL Statement and Function Overview

OperatorsControl StatementsBlock CallsStandard Functions

8

The Programming Examples

The present book provides many figures repre-senting the use of the STL and SCL program-ming languages All programming examplescan be downloaded from the publisherrsquos web-site wwwpublicis-booksde There are two li-braries one for STL examples (STL_Book) andone for SCL examples (SCL_Book) Whendearchived with the Retrieve function these li-braries occupy approximately 29 or 17 MB(dependent on the PGPC file system used)

The library STL_Book contains eight programsthat are essentially illustrations of the STLmethod of representation Two extensive exam-ples show the programming of functions func-tion blocks and local instances (Conveyor Ex-ample) and the handling of data (MessageFrame Example) All the examples exist assource files and contain symbols and com-ments

The library SCL_Book contains five programswith representations of the SCL statements and

Library STL_Book

Basic FunctionsExamples of STL representation

Program ProcessingExamples of SFC Calls

FB 104 Chapter 4 Binary Logic OperationsFB 105 Chapter 5 Memory FunctionsFB 106 Chapter 6 Transfer FunctionsFB 107 Chapter 7 Timer FunctionsFB 108 Chapter 8 Counter Functions

FB 120 Chapter 20 Main ProgramFB 121 Chapter 21 Interrupt HandlingFB 122 Chapter 22 Restart CharacteristicsFB 123 Chapter 23 Error Handling

Digital FunctionsExamples of STL representation

Variable HandlingExamples of Data Types and Variable Processing

FB 109 Chapter 9 Comparison FunctionsFB 110 Chapter 10 Arithmetic FunctionsFB 111 Chapter 11 Math FunctionsFB 112 Chapter 12 Conversion FunctionsFB 113 Chapter 13 Shift FunctionsFB 114 Chapter 14 Word Logic

FB 124 Chapter 24 Data TypesFB 125 Chapter 25 Indirect AddressingFB 126 Chapter 26 Direct Variable AccessFB 101 Elementary Data TypesFB 102 Complex Data TypesFB 103 Parameter Types

Program Flow ControlExamples of STL representation

Conveyor ExampleExamples of Basic Functions and Local Instances

FB 115 Chapter 15 Status BitsFB 116 Chapter 16 Jump FunctionsFB 117 Chapter 17 Master Control RelayFB 118 Chapter 18 Block FunctionsFB 119 Chapter 19 Block ParametersSource File Block Programming (Chapter 3)

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

Message Frame ExampleHandling Data examples

General Examples

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock CheckFC 62 Generate ChecksumFC 63 Convert Date

FC 41 Range MonitorFC 42 Limit Value DetectionFC 43 Compound Interest CalculationFC 44 Double-Word-Wise Edge EvaluationFC 45 Converting S5 Floating-Point to S7 REALFC 46 Converting S7 REAL to S5 Floating-PointFC 47 Copy Data Area (ANY Pointer)

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 6: Berger Automating with STEP7 in STL and SCL

6

The Contents of the Book at a Glance

Overview of the S7-300400 programma-ble logic controller

PLC functions compa-rable to a contactor control system

Numbers manipulat-ing the contents of the accumulators

Program run control block functions

Introduction

1 SIMATIC S7-300400 Programmable Controller

Structure of the Pro-grammable Controller(Hardware Components of S7-300400)Memory AreasDistributed IO (PROFIBUS DP)Communications (Subnets)Modules AddressesAddresses Areas

2 STEP 7 Program-ming Software

Editing ProjectsConfiguring StationsConfiguring the Net-work Symbol EditorSTL Program EditorSCL Program EditorOnline ModeTesting the Program

3 SIMATIC S7 Program

Program ProcessingBlock TypesProgramming STL and SCL Code Blocks Programming Data BlocksAddressing Variables Constant Representa-tions Data Types (Overview)

Basic Functions

4 Binary Logic Operations

AND OR and Exclusive OR FunctionsNesting Functions

5 Memory Functions

Assign Set and ResetEdge EvaluationExample of a Conveyor Belt Control System

6 Move Functions

Load FunctionsTransfer FunctionsAccumulator FunctionsSystem Functions for Data Transfer

7 Timer Functions

Start SIMATIC Timers with Five Different TypesIEC Timers

8 Counter Functions

SIMATIC CountersCount up Count down Set Reset and Scan CountersIEC Counters

Digital Functions

9 Comparison Functions

Comparison Accord-ing to Data Types INT DINT and REAL

10 Arithmetic Functions

Four-function Math with INT DINT and REAL numbersAdding ConstantsDecrementing and Incrementing

11 Math Functions

Trigonometric FunctionsArc FunctionsPowers Logarithm

12 Converting Functions

Data Type Conversion Complement Forma-tion

13 Shift Functions

Shifting and Rotating

14 Word Logic

AND OR Exclusive OR

Program Flow Control

15 Status Bits

Binary Flags Digital FlagsENENOMechanism

16 Jump Functions

Unconditional Jump Jumps Conditional on the RLO BR and the Digital FlagsJump Distributor Loop Jump

17 Master Control Relay

MCR Dependency MCR Area MCR Zone

18 Block Functions

Block Call Block EndTemporary and Static Local DataData Addresses

19 Block Parameters

Formal Parameters Actual ParametersDeclarations Assignments andldquoParameter Passingrdquo

7

Processing the user program

Working with complex variables indirect addressing

Description of the Programming Language SCL

S5S7 Converter block libraries overviews

ProgramProcessing

20 Main Program

Program Structure Scan Cycle Control(Response Time Start Information Back-ground Scanning) Program FunctionsCommunications via Distributed IO and Global Data S7 and S7-Basic Communications

21 Interrupt Handling

Time-of-Day Inter-rupts Time-Delay In-terrupts Watchdog Interrupts Hardware Interrupts DPV1 In-terrupts Multiproces-sor Interrupt Handling Interrupts

22 Restart Characteristics

Cold Restart Hot Restart Warm RestartSTOP HOLD Memory ResetParameterizing Modules

23 Error Handling

Synchronous ErrorsAsynchronous ErrorsSystem Diagnostics

Variable Handling

24 Data Types

Structure of the Data TypesDeclaration and Use of Elementary and Complex Data TypesProgramming of User Defined Data Types UDT

25 Indirect Addressing

Area PointerDB PointerANY PointerIndirect Addressing via Memory and Register (Area-internal and Area-crossing)Working with Address Registers

26 Direct Variable Access

Load Variable AddressData Storage of Variables in the MemoryData Storage when Transferring Parame-ters ldquoVariablerdquo ANY PointerBrief Description of the ldquoMessage Frame Examplerdquo

Structured Control Language SCL

27 Introduction Language Elements

Addressing Operators Expressions Value Assignments

28 Control Statements

IF CASE FOR WHILE REPEAT CONTINUE EXIT GOTO RETURN

29 SCL Block Calls

Function Value OK Variable ENENO Mechanism Descrip-tion of Examples

30 SCL Functions

Timer FunctionsCounter FunctionsConversion and Math FunctionsShifting and Rotating

31 IEC Functions

Conversion and Com-parison FunctionsSTRING FunctionsDateTime-of-Day FunctionsNumerical Functions

Appendix

32 S5S7 Converter

Preparations for ConversionConverting STEP 5 ProgramsPostprocessing

33 Block Libraries

Organization BlocksSystem Function BlocksIEC Function BlocksS5-S7 Converting BlocksTI-S7 Converting BlocksPID Control BlocksDP Functions

34 STL Operation Overview

Basic FunctionsDigital FunctionsProgram Flow ControlIndirect Addressing

35 SCL Statement and Function Overview

OperatorsControl StatementsBlock CallsStandard Functions

8

The Programming Examples

The present book provides many figures repre-senting the use of the STL and SCL program-ming languages All programming examplescan be downloaded from the publisherrsquos web-site wwwpublicis-booksde There are two li-braries one for STL examples (STL_Book) andone for SCL examples (SCL_Book) Whendearchived with the Retrieve function these li-braries occupy approximately 29 or 17 MB(dependent on the PGPC file system used)

The library STL_Book contains eight programsthat are essentially illustrations of the STLmethod of representation Two extensive exam-ples show the programming of functions func-tion blocks and local instances (Conveyor Ex-ample) and the handling of data (MessageFrame Example) All the examples exist assource files and contain symbols and com-ments

The library SCL_Book contains five programswith representations of the SCL statements and

Library STL_Book

Basic FunctionsExamples of STL representation

Program ProcessingExamples of SFC Calls

FB 104 Chapter 4 Binary Logic OperationsFB 105 Chapter 5 Memory FunctionsFB 106 Chapter 6 Transfer FunctionsFB 107 Chapter 7 Timer FunctionsFB 108 Chapter 8 Counter Functions

FB 120 Chapter 20 Main ProgramFB 121 Chapter 21 Interrupt HandlingFB 122 Chapter 22 Restart CharacteristicsFB 123 Chapter 23 Error Handling

Digital FunctionsExamples of STL representation

Variable HandlingExamples of Data Types and Variable Processing

FB 109 Chapter 9 Comparison FunctionsFB 110 Chapter 10 Arithmetic FunctionsFB 111 Chapter 11 Math FunctionsFB 112 Chapter 12 Conversion FunctionsFB 113 Chapter 13 Shift FunctionsFB 114 Chapter 14 Word Logic

FB 124 Chapter 24 Data TypesFB 125 Chapter 25 Indirect AddressingFB 126 Chapter 26 Direct Variable AccessFB 101 Elementary Data TypesFB 102 Complex Data TypesFB 103 Parameter Types

Program Flow ControlExamples of STL representation

Conveyor ExampleExamples of Basic Functions and Local Instances

FB 115 Chapter 15 Status BitsFB 116 Chapter 16 Jump FunctionsFB 117 Chapter 17 Master Control RelayFB 118 Chapter 18 Block FunctionsFB 119 Chapter 19 Block ParametersSource File Block Programming (Chapter 3)

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

Message Frame ExampleHandling Data examples

General Examples

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock CheckFC 62 Generate ChecksumFC 63 Convert Date

FC 41 Range MonitorFC 42 Limit Value DetectionFC 43 Compound Interest CalculationFC 44 Double-Word-Wise Edge EvaluationFC 45 Converting S5 Floating-Point to S7 REALFC 46 Converting S7 REAL to S5 Floating-PointFC 47 Copy Data Area (ANY Pointer)

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 7: Berger Automating with STEP7 in STL and SCL

7

Processing the user program

Working with complex variables indirect addressing

Description of the Programming Language SCL

S5S7 Converter block libraries overviews

ProgramProcessing

20 Main Program

Program Structure Scan Cycle Control(Response Time Start Information Back-ground Scanning) Program FunctionsCommunications via Distributed IO and Global Data S7 and S7-Basic Communications

21 Interrupt Handling

Time-of-Day Inter-rupts Time-Delay In-terrupts Watchdog Interrupts Hardware Interrupts DPV1 In-terrupts Multiproces-sor Interrupt Handling Interrupts

22 Restart Characteristics

Cold Restart Hot Restart Warm RestartSTOP HOLD Memory ResetParameterizing Modules

23 Error Handling

Synchronous ErrorsAsynchronous ErrorsSystem Diagnostics

Variable Handling

24 Data Types

Structure of the Data TypesDeclaration and Use of Elementary and Complex Data TypesProgramming of User Defined Data Types UDT

25 Indirect Addressing

Area PointerDB PointerANY PointerIndirect Addressing via Memory and Register (Area-internal and Area-crossing)Working with Address Registers

26 Direct Variable Access

Load Variable AddressData Storage of Variables in the MemoryData Storage when Transferring Parame-ters ldquoVariablerdquo ANY PointerBrief Description of the ldquoMessage Frame Examplerdquo

Structured Control Language SCL

27 Introduction Language Elements

Addressing Operators Expressions Value Assignments

28 Control Statements

IF CASE FOR WHILE REPEAT CONTINUE EXIT GOTO RETURN

29 SCL Block Calls

Function Value OK Variable ENENO Mechanism Descrip-tion of Examples

30 SCL Functions

Timer FunctionsCounter FunctionsConversion and Math FunctionsShifting and Rotating

31 IEC Functions

Conversion and Com-parison FunctionsSTRING FunctionsDateTime-of-Day FunctionsNumerical Functions

Appendix

32 S5S7 Converter

Preparations for ConversionConverting STEP 5 ProgramsPostprocessing

33 Block Libraries

Organization BlocksSystem Function BlocksIEC Function BlocksS5-S7 Converting BlocksTI-S7 Converting BlocksPID Control BlocksDP Functions

34 STL Operation Overview

Basic FunctionsDigital FunctionsProgram Flow ControlIndirect Addressing

35 SCL Statement and Function Overview

OperatorsControl StatementsBlock CallsStandard Functions

8

The Programming Examples

The present book provides many figures repre-senting the use of the STL and SCL program-ming languages All programming examplescan be downloaded from the publisherrsquos web-site wwwpublicis-booksde There are two li-braries one for STL examples (STL_Book) andone for SCL examples (SCL_Book) Whendearchived with the Retrieve function these li-braries occupy approximately 29 or 17 MB(dependent on the PGPC file system used)

The library STL_Book contains eight programsthat are essentially illustrations of the STLmethod of representation Two extensive exam-ples show the programming of functions func-tion blocks and local instances (Conveyor Ex-ample) and the handling of data (MessageFrame Example) All the examples exist assource files and contain symbols and com-ments

The library SCL_Book contains five programswith representations of the SCL statements and

Library STL_Book

Basic FunctionsExamples of STL representation

Program ProcessingExamples of SFC Calls

FB 104 Chapter 4 Binary Logic OperationsFB 105 Chapter 5 Memory FunctionsFB 106 Chapter 6 Transfer FunctionsFB 107 Chapter 7 Timer FunctionsFB 108 Chapter 8 Counter Functions

FB 120 Chapter 20 Main ProgramFB 121 Chapter 21 Interrupt HandlingFB 122 Chapter 22 Restart CharacteristicsFB 123 Chapter 23 Error Handling

Digital FunctionsExamples of STL representation

Variable HandlingExamples of Data Types and Variable Processing

FB 109 Chapter 9 Comparison FunctionsFB 110 Chapter 10 Arithmetic FunctionsFB 111 Chapter 11 Math FunctionsFB 112 Chapter 12 Conversion FunctionsFB 113 Chapter 13 Shift FunctionsFB 114 Chapter 14 Word Logic

FB 124 Chapter 24 Data TypesFB 125 Chapter 25 Indirect AddressingFB 126 Chapter 26 Direct Variable AccessFB 101 Elementary Data TypesFB 102 Complex Data TypesFB 103 Parameter Types

Program Flow ControlExamples of STL representation

Conveyor ExampleExamples of Basic Functions and Local Instances

FB 115 Chapter 15 Status BitsFB 116 Chapter 16 Jump FunctionsFB 117 Chapter 17 Master Control RelayFB 118 Chapter 18 Block FunctionsFB 119 Chapter 19 Block ParametersSource File Block Programming (Chapter 3)

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

Message Frame ExampleHandling Data examples

General Examples

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock CheckFC 62 Generate ChecksumFC 63 Convert Date

FC 41 Range MonitorFC 42 Limit Value DetectionFC 43 Compound Interest CalculationFC 44 Double-Word-Wise Edge EvaluationFC 45 Converting S5 Floating-Point to S7 REALFC 46 Converting S7 REAL to S5 Floating-PointFC 47 Copy Data Area (ANY Pointer)

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 8: Berger Automating with STEP7 in STL and SCL

8

The Programming Examples

The present book provides many figures repre-senting the use of the STL and SCL program-ming languages All programming examplescan be downloaded from the publisherrsquos web-site wwwpublicis-booksde There are two li-braries one for STL examples (STL_Book) andone for SCL examples (SCL_Book) Whendearchived with the Retrieve function these li-braries occupy approximately 29 or 17 MB(dependent on the PGPC file system used)

The library STL_Book contains eight programsthat are essentially illustrations of the STLmethod of representation Two extensive exam-ples show the programming of functions func-tion blocks and local instances (Conveyor Ex-ample) and the handling of data (MessageFrame Example) All the examples exist assource files and contain symbols and com-ments

The library SCL_Book contains five programswith representations of the SCL statements and

Library STL_Book

Basic FunctionsExamples of STL representation

Program ProcessingExamples of SFC Calls

FB 104 Chapter 4 Binary Logic OperationsFB 105 Chapter 5 Memory FunctionsFB 106 Chapter 6 Transfer FunctionsFB 107 Chapter 7 Timer FunctionsFB 108 Chapter 8 Counter Functions

FB 120 Chapter 20 Main ProgramFB 121 Chapter 21 Interrupt HandlingFB 122 Chapter 22 Restart CharacteristicsFB 123 Chapter 23 Error Handling

Digital FunctionsExamples of STL representation

Variable HandlingExamples of Data Types and Variable Processing

FB 109 Chapter 9 Comparison FunctionsFB 110 Chapter 10 Arithmetic FunctionsFB 111 Chapter 11 Math FunctionsFB 112 Chapter 12 Conversion FunctionsFB 113 Chapter 13 Shift FunctionsFB 114 Chapter 14 Word Logic

FB 124 Chapter 24 Data TypesFB 125 Chapter 25 Indirect AddressingFB 126 Chapter 26 Direct Variable AccessFB 101 Elementary Data TypesFB 102 Complex Data TypesFB 103 Parameter Types

Program Flow ControlExamples of STL representation

Conveyor ExampleExamples of Basic Functions and Local Instances

FB 115 Chapter 15 Status BitsFB 116 Chapter 16 Jump FunctionsFB 117 Chapter 17 Master Control RelayFB 118 Chapter 18 Block FunctionsFB 119 Chapter 19 Block ParametersSource File Block Programming (Chapter 3)

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

Message Frame ExampleHandling Data examples

General Examples

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock CheckFC 62 Generate ChecksumFC 63 Convert Date

FC 41 Range MonitorFC 42 Limit Value DetectionFC 43 Compound Interest CalculationFC 44 Double-Word-Wise Edge EvaluationFC 45 Converting S5 Floating-Point to S7 REALFC 46 Converting S7 REAL to S5 Floating-PointFC 47 Copy Data Area (ANY Pointer)

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 9: Berger Automating with STEP7 in STL and SCL

9

the SCL functions The programs ldquoConveyorExamplerdquo The library SCL_Book contains fiveprograms with representations of the SCL state-ments and the SCL functions The programsldquoConveyor Examplerdquo and ldquoMessage Frame Ex-amplerdquo and ldquoMessage Frame Examplerdquo showthe same functions as the STL examples of thesame name The program ldquoGeneral Examplesrdquocontains SCL functions for processing complexdata types data storage and ndash for SCL program-

mers ndash a statement for programming simpleSTL functions for SCL programs

To try the programs out set up a project corre-sponding to your hardware configuration andthen copy the program including the symboltable from the library to the project Now youcan call the example programs adapt them foryour own purposes and test them online

Library SCL_Book

27 Language ElementsExamples of SCL Representation (Chapter 27)

30 SCL FunctionsExamples of SCL Representation (Chapter 30)

FC 271 Delimiter ExampleOB 1 Main Program for the Delimiter ExampleFB 271 Operators Expressions AssignmentsFB 272 Indirect Addressing

FB 301 Timer FunctionsFB 302 Counter FunctionsFB 303 Conversion FunctionsFB 304 Math FunctionsFB 305 Shifting and Rotating

28 Control StatementsExamples of SCL Representation (Chapter 28)

31 IEC FunctionsExamples of SCL Representation (Chapter 31)

FB 281 IF StatementFB 282 CASE StatementFB 283 FOR StatementFB 284 WHILE StatementFB 285 REPEAT Statement

FB 311 Conversion FunctionsFB 312 Comparison FunctionsFB 313 String FunctionsFB 314 DateTime-of-day FunctionsFB 315 Numerical Functions

29 SCL Block CallsExamples of SCL Representation (Chapter 29)

General Examples

FC 291 FC Block with Function ValueFC 292 FC Block without Function ValueFB 291 FB BlockFB 292 Example Calls for FC and FB BlocksFC 293 FC Block for ENENO ExampleFB 293 FB Block for ENENO ExampleFB 294 Calls for ENENO Examples

FC 61 DT_TO_STRINGFC 62 DT_TO_DATEFC 63 DT_TO_TODFB 61 Variable LengthFB 62 ChecksumFB 63 Ring BufferFB 64 FIFO RegisterSTL Functions for SCL Programming

Conveyor ExampleExamples of Basic Functions and Local Instances

Message Frame ExampleHandling Data examples

FC 11 Conveyor Belt ControllerFC 12 Counter ControlFB 20 FeedFB 21 Conveyor BeltFB 22 Parts Counter

UDT 51 Data Structure HeaderUDT 52 Data Structure Message FrameFB 51 Generate Message FrameFB 52 Save Message FrameFC 61 Clock Check

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 10: Berger Automating with STEP7 in STL and SCL

Automating with STEP 7

10

Automating with STEP 7

This double page shows the ba-sic procedure for using theSTEP 7 programming software

Start the SIMATIC Managerand set up a new project or openan existing project All the datafor an automation task arestored in the form of objects ina project When you set up aproject you create containersfor the accumulated data by set-ting up the required stationswith at least the CPUs then thecontainers for the user pro-grams are also created You canalso create a program containerdirect in the project

In the next steps you configurethe hardware and if applicablethe communications connec-tions Following this you cre-ate and test the program

The order for creating the auto-mation data is not fixed Onlythe following general regula-tion applies if you want to pro-cess objects (data) they mustexist if you want to insert ob-jects the relevant containersmust be available

You can interrupt processing ina project at any time and con-tinue again from any locationthe next time you start theSIMATIC Manager

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 11: Berger Automating with STEP7 in STL and SCL

Automating with STEP 7

11

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 12: Berger Automating with STEP7 in STL and SCL

Table of Contents

12

Table of Contents

Preface 5

Automating with STEP 7 10

Introduction 21

1 SIMATIC S7-300400 Programmable Controller 22

11 Structure of the Programmable Controller 22

111 Components 22112 S7-300 Station 22113 S7-400 Station 24114 Fault-Tolerant SIMATIC 25115 Safety-related SIMATIC 26116 CPU Memory Areas 27

12 Distributed IO 30

121 PROFIBUS DP 30122 PROFINET IO 32123 ActuatorSensor Interface 33124 Routers 35

13 Communications 37

131 Introduction 37132 Subnets 39133 Communications Services 42134 Connections 44

14 Module Addresses 44

141 Signal Path 44142 Slot Address 45143 Logical Address 46144 Module Start Address 46145 Diagnostics Address 46146 Addresses for Bus Nodes 47

15 Address Areas 47

151 User Data Area 47152 Process Image 48153 Consistent User Data 49154 Bit Memories 50

2 STEP 7 Programming Software 51

21 STEP 7 Basic Package 51

211 Installation 51212 Automation License Manager 51213 SIMATIC Manager 52214 Projects and Libraries 53215 Multiprojects 55216 Online Help 56

22 Editing Projects 56

221 Creating Projects 56222 Managing Rearranging and

Archiving 58223 Project Versions 58224 Creating and Editing Multiprojects 59

23 Configuring Stations 60

231 Arranging Modules 62232 Addressing Modules 62233 Parameterizing Modules 63234 Networking Modules with MPI 63235 Monitoring and Modifying

Modules 64

24 Configuring the Network 64

241 Configuring the Network View 66242 Configuring Distributed IO with

the Network Configuration 66243 Configuring Connections 67244 Network Transitions 70245 Loading the Connection Data 71246 Adjusting Projects in the

Multiproject 71

25 Creating the S7 Program 73

251 Introduction 73252 Symbol Table 73253 STL-Program Editor 75254 SCL Program Editor 80255 Rewiring 83256 Address Priority 83257 Reference Data 84258 Language Settings 86

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 13: Berger Automating with STEP7 in STL and SCL

Table of Contents

13

26 Online Mode 87

261 Connecting a PLC 87262 Protection of the user program 88263 CPU Information 89264 Loading the User Program into

the CPU 89265 Block Handling 90

27 Testing the Program 92

271 Diagnosing the Hardware 92272 Determining the Cause of a STOP 93273 Monitoring and Modifying

Variables 93274 Forcing Variables 95275 Enabling Peripheral Outputs 96276 Test and process mode 97277 STL Program Status 97278 Monitoring and Controlling Data

Addresses 99279 Debugging SCL Programs 100

3 SIMATIC S7 Program 102

31 Program Processing 102

311 Program Processing Methods 102312 Priority Classes 103313 Specifications for Program

Processing 105

32 Blocks 106

321 Block Types 106322 Block Structure 108323 Block Properties 108324 Block Interface 111

33 Addressing Variables 113

331 Absolute Addressing of Variables 113

332 Indirect Addressing 115333 Symbolic Addressing of

Variables 115

34 Programming Code Blocks with STL 116

341 Structure of an STL Statement 116342 Programming STL Code Blocks

Incrementally 117343 Overview Window 118344 Programming Networks 119345 Source-oriented programming

of an STL code block 120

35 Programming Code Blocks with SCL 122

351 Structure of an SCL Statement 122352 Programming SCL Code Blocks 124

36 Programming Data Blocks 127

361 Programming Data Blocks Incrementally 127

362 Source-Oriented Data Block Programming 131

37 Variables and Constants 133

371 General Remarks Concerning Variables 133

372 General Remarks Regarding Data Types 134

373 Elementary Data Types 134374 Complex Data Types 137375 Parameter Types 137

Basic Functions 138

4 Binary Logic Operations 139

41 Processing a Binary Logic Operation 139

42 Elementary Binary Logic Operations 141

421 AND Function 142422 OR Function 142423 Exclusive OR Function 142

43 Negating the Result of the Logic Operation 144

44 Compound Binary Logic Operations 145

441 Processing Nesting Expressions 145442 Combining AND Functions

According to OR 146443 Combining OR and Exclusive OR

Functions According to AND 146444 Combining AND Functions According

to Exclusive OR 147445 Combining OR Functions and

Exclusive OR Functions 148446 Negating Nesting Expressions 148

5 Memory Functions 149

51 Assign 149

52 Set and Reset 149

53 RS Flipflop Function 151

531 Memory Functions with Reset Priority 151

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 14: Berger Automating with STEP7 in STL and SCL

Table of Contents

14

532 Memory Function with Set Priority 151

533 Memory Function in a Binary Logic Operation 151

54 Edge Evaluation 152

541 Positive Edge 153542 Negative Edge 154543 Testing a Pulse Memory Bit 154544 Edge Evaluation in a Binary

Logic Operation 154545 Binary Scaler 155

55 Example of a Conveyor Belt Control System 155

6 Move Functions 159

61 General Remarks on Loading and Transferring Data 159

62 Load Functions 161

621 General Representation of a Load Function 161

622 Loading the Contents of Memory Locations 161

623 Loading Constants 162

63 Transfer Functions 163

631 General Representation of a Transfer Function 163

632 Transferring to Various Memory Areas 163

64 Accumulator Functions 164

641 Direct Transfers Between Accumulators 164

642 Exchange Bytes in Accumulator 1 165

65 System Functions for Data Transfer 166

651 Copying Memory Area 166652 Uninterruptible Copying of

Variables 167653 Initializing a Memory Area 167654 Copying STRING Variables 168655 Reading from Load Memory 168656 Writing into the Load Memory 169

7 Timer Functions 171

71 Programming a Timer 171

711 Starting a Timer 171712 Specifying the Time 172713 Resetting a Timer 173

714 Enabling a Timer 173715 Checking a Timer 173716 Sequence of Timer Instructions 174717 Clock Generator Example 174

72 Pulse Timers 175

73 Extended Pulse Timers 177

74 On-Delay Timers 179

75 Retentive On-Delay Timers 181

76 Off-Delay Timers 183

77 IEC Timer Functions 185

771 Pulse Generation SFB 3 TP 185772 On Delay SFB 4 TON 186773 Off Delay SFB 5 TOF 186

8 Counter Functions 187

81 Setting and Resetting Counters 187

82 Counting 188

83 Checking a Counter 189

84 Enabling a Counter 189

85 Sequence of Counter Instructions 190

86 IEC Counter Functions 191

861 Up Counter SFB 0 CTU 191862 Down Counter SFB 1 CTD 191863 Up-Down Counter SFB 2 CTUD 192

87 Parts Counter Example 192

Digital Functions 196

9 Comparison Functions 197

91 General Representation of a Comparison Function 197

92 Description of the Comparison Functions 198

93 Comparison Function in a Logic Operation 199

10 Arithmetic Functions 201

101 General Representation of an Arithmetic Function 201

102 Calculating with Data Type INT 202

103 Calculating with Data Type DINT 203

104 Calculating with Data Type REAL 204

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 15: Berger Automating with STEP7 in STL and SCL

Table of Contents

15

105 Successive Arithmetic Functions 205

106 Adding Constants to Accumulator 1 206

107 Decrementing and Incrementing 206

11 Math Functions 208

111 Processing a Math Function 208

112 Trigonometric Functions 209

113 Arc Functions 209

114 Other Math Functions 209

12 Conversion Functions 211

121 Processing a Conversion Function 211

122 Converting INT and DINT Numbers 212

123 Converting BCD Numbers 212

124 Converting REAL Numbers 213

125 Other Conversion Functions 214

13 Shift Functions 216

131 Processing a Shift Function 216

132 Shifting 217

133 Rotating 219

14 Word Logic 221

141 Processing a Word Logic Operation 221

142 Description of the Word Logic Operations 223

Program Flow Control 224

15 Status Bits 225

151 Description of the Status Bits 225

152 Setting the Status Bits and the Binary Flags 227

153 Evaluating the Status Bit 229

154 Using the Binary Result 231

16 Jump Functions 233

161 Programming a Jump Function 233

162 Unconditional Jump 234

163 Jump Functions with RLO andBR 234

164 Jump Functions with CC0 and CC1 235

165 Jump Functions with OV and OS 237

166 Jump Distributor 237

167 Loop Jump 238

17 Master Control Relay 239

171 MCR Dependency 239

172 MCR Area 240

173 MCR Zone 240

174 Setting and Resetting IO Bits 241

18 Block Functions 243

181 Block Functions for Code Blocks 243

1811 Block Calls General 2441812 CALL Call Statement 2441813 UC and CC Call Statements 2451814 Block End Functions 2461815 Temporary Local Data 2461816 Static Local Data 249

182 Block Functions for Data Blocks 251

1821 Two Data Block Registers 2511822 Accessing Data Addresses 2521823 Open Data Block 2541824 Exchanging the Data Block

Registers 2551825 Data Block Length and Number 2551826 Special Points in Data Addressing 255

183 System Functions for Data Blocks 257

1831 Creating a Data Block in the Work Memory 257

1832 Creating a Data Block in the Load Memory 257

1833 Deleting a Data Block 2591834 Testing a Data Block 259

184 Null Operations 259

1841 NOP Statements 2591842 Program Display Statements 260

19 Block Parameters 261

191 Block Parameters in General 261

1911 Defining the Block Parameters 261

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 16: Berger Automating with STEP7 in STL and SCL

Table of Contents

16

1912 Processing the Block Parameters 2611913 Declaration of the Block

Parameters 2621914 Declaration of the Function Value 2631915 Initializing Block Parameters 264

192 Formal Parameters 264

193 Actual Parameters 267

194 ldquoPassing Onrdquo Block Parameters 270

195 Examples 271

1951 Conveyor Belt Example 2711952 Parts Counter Example 2721953 Feed Example 272

Program Processing 276

20 Main Program 277

201 Program Organization 277

2011 Program Structure 2772012 Program Organization 278

202 Scan Cycle Control 279

2021 Process Image Updating 2792022 Scan Cycle Monitoring Time 2812023 Minimum Scan Cycle Time

Background Scanning 2822024 Response Time 2832025 Start Information 283

203 Program Functions 285

2031 Time 2852032 Read System Clock 2872033 Run-Time Meter 2872034 Compressing CPU Memory 2892035 Waiting and Stopping 2892036 Multiprocessing Mode 2892037 Determining OB Program

Execution Time 2902038 Changing the Program Protection 292

204 Communication via Distributed IO 294

2041 Addressing PROFIBUS DP 2942042 Configuring PROFIBUS DP 2982043 Special Functions for

PROFIBUS DP 3072044 Addressing PROFINET IO 3122045 Configuring PROFINET IO 315

2046 Special functions for PROFINET IO 321

2047 System Blocks for the Distributed IO 329

205 Global Data Communication 337

2051 Fundamentals 3372052 Configuring GD Communication 3392053 System Functions for GD

Communication 341

206 S7 Basic Communication 342

2061 Station-Internal S7 Basic Communication 342

2062 System Functions for Data Interchange within a Station 343

2063 Station-External S7 Basic Communication 344

2064 System Functions for Station-External S7 Basic Communication 345

207 S7 Communication 347

2071 Fundamentals 3472072 Two-Way Data Exchange 3492073 One-Way Data Exchange 3512074 Transferring Print Data 3522075 Control Functions 3522076 Monitoring Functions 353

208 IE Communication 356

2081 Fundamentals 3562082 Establishment and Cancellation

of Connections 3582083 Data Transmission with TCP

Native or ISO-on-TCP 3602084 Data Transmission with UDP 361

209 PtP Communication with S7-300C 363

2091 Fundamentals 3632092 ASCII Driver and 3964(R)

Procedure 3642093 RK512 Computer Link 366

2010 Configuration in RUN 368

20101 Preparation of Modifications to Configuration 369

20102 Changing the Configuration 37020103 Loading the Configuration 37120104 CiR Synchronization Time 37120105 Effects on Program Execution 37120106 Controlling the CiR Procedure 372

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 17: Berger Automating with STEP7 in STL and SCL

Table of Contents

17

21 Interrupt Handling 373

211 General Remarks 373

212 Time-of-Day Interrupts 374

2121 Handling Time-of-Day Interrupts 3752122 Configuring Time-of-Day

Interrupts with STEP 7 3762123 System Functions for Time-of-Day

Interrupts 376

213 Time-Delay Interrupts 378

2131 Handling Time-Delay Interrupts 3782132 Configuring Time-Delay

Interrupts with STEP 7 3792133 System Functions for Time-Delay

Interrupts 379

214 Watchdog Interrupts 380

2141 Handling Watchdog Interrupts 3812142 Configuring Watchdog Interrupts

with STEP 7 382

215 Hardware Interrupts 382

2151 Generating a Hardware Interrupt 3822152 Servicing Hardware Interrupts 3832153 Configuring Hardware Interrupts

with STEP 7 384

216 DPV1 Interrupts 384

217 Multiprocessor Interrupt 386

218 Synchronous Cycle Interrupts 387

2181 Processing Synchronous Cycle Interrupts 387

2182 Isochronous Updating of Process Image 388

2183 Programming of Synchronous Cycle Interrupts with STEP 7 389

219 Handling Interrupts 389

2191 Disabling and Enabling Interrupts 3892192 Delaying and Enabling Delayed

Interrupts 3902193 Reading Additional Interrupt

Information 391

22 Restart Characteristics 393

221 General Remarks 393

2211 Operating Modes 3932212 HOLD Mode 3942213 Disabling the Output Modules 3942214 Restart Organization Blocks 394

222 Power-Up 395

2221 STOP Mode 3952222 Memory Reset 3952223 Restoration of Delivery State 3962224 Retentivity 3962225 Restart Parameterization 396

223 Types of Restart 397

2231 START-UP Mode 3972232 Cold Restart 3972233 Warm Restart 3992234 Hot Restart 400

224 Ascertaining a Module Address 400

225 Parameterizing Modules 403

2251 General Remarks on Parameterizing Modules 403

2252 System Blocks for Module Parameterization 405

2253 Blocks for Data Record Transfer 407

23 Error Handling 409

231 Synchronous Errors 409

232 Synchronous Error Handling 411

2321 Error Filters 4112322 Masking Synchronous Errors 4122323 Unmasking Synchronous Errors 4122324 Reading the Error tab 4122325 Entering a Substitute Value 413

233 Asynchronous Errors 414

234 System Diagnostics 416

2341 Diagnostic Events and Diagnostic Buffer 416

2342 Writing User Entries in the Diagnostic Buffer 416

2343 Evaluating Diagnostic Interrupts 4172344 Reading the System Status List 419

235 Web Server 420

2351 Activate Web Server 4202352 Reading Web Information 4202353 Web Information 420

Variable Handling 422

24 Data Types 423

241 Elementary Data Types 423

2411 Declaration of Elementary Data Types 423

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 18: Berger Automating with STEP7 in STL and SCL

Table of Contents

18

2412 BOOL BYTE WORD DWORD CHAR 424

2413 Number Representations 4252414 Time Representations 427

242 Complex Data Types 428

2421 DATE_AND_TIME 4292422 STRING 4292423 ARRAY 4302424 STRUCT 432

243 User-Defined Data Types 434

2431 Programming UDTs Incrementally 434

2432 Source-File-Oriented Programming of UDTs 434

25 Indirect Addressing 436

251 Pointers 436

2511 Area Pointer 4362512 DB Pointer 4362513 ANY Pointer 438

252 Types of Indirect Addressing in STL 439

2521 General 4392522 Indirect Addresses 4392523 Memory-Indirect Addressing 4402524 Register-Indirect Area-Internal

Addressing 4422525 Register-Indirect Area-Crossing

Addressing 4422526 Summary 442

253 Working with Address Registers 443

2531 Loading into an Address Register 4432532 Transferring from an Address

Register 4432533 Swap Address Registers 4432534 Adding to the Address Register 445

254 Special Features of Indirect Addressing 446

2541 Using Address Register AR1 4462542 Using Address Register AR2 4462543 Restrictions with Static Local

Data 446

26 Direct Variable Access 449

261 Loading the Variable Address 449

262 Data Storage of Variables 450

2621 Storage in Global Data Blocks 450

2622 Storage in Instance Data Blocks 4512623 Storage in the Temporary Local

Data 451

263 Data Storage when Transferring Parameters 454

2631 Parameter Storage in Functions 4542632 Storing Parameters in Function

Blocks 4562633 ldquoVariablerdquo ANY Pointer 456

264 Brief Description of the Message Frame Example 458

Structured Control Language (SCL) 465

27 Introduction Language Elements 466

271 Integration in SIMATIC 466

2711 Installation 4662712 Setting Up a Project 4662713 Editing the SCL Source 4662714 Completing the Symbol Table 4672715 Compiling the SCL Program 4682716 Loading SCL Blocks 4682717 Testing SCL Blocks 4682718 Addresses and Data Types 4682719 Data Type Views 470

272 Addressing 471

2721 Absolute Addressing 4712722 Symbolic Addressing 4712723 Indirect Addressing in SCL 472

273 Operators 473

274 Expressions 474

2741 Arithmetic Expressions 4752742 Comparison Expressions 4752743 Logical Expressions 476

275 Value Assignments 476

2751 Assignment for Elementary Data Types 476

2752 Assignment of DT and STRING Variables 476

2753 Assignment of Structures 4762754 Assigning Fields 477

28 Control Statements 478

281 IF Statement 478

282 CASE Statement 479

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 19: Berger Automating with STEP7 in STL and SCL

Table of Contents

19

283 FOR Statement 479

284 WHILE Statement 480

285 REPEAT Statement 480

286 CONTINUE Statement 481

287 EXIT Statement 481

288 RETURN Statement 481

289 GOTO Statement 481

29 SCL Blocks 483

291 SCL Blocks ndash General 483

292 Programming SCL Blocks 483

2921 Function FC without a Function Value 484

2922 Function FC with Function Value 484

2923 Function Block FB 4842924 Temporary Local Data 4852925 Static Local Data 4862926 Block Parameters 4862927 Formal Parameters 487

293 Calling SCL Blocks 487

2931 Function FC without Function Value 488

2932 Function FC with Function Value 4882933 Function Block with its Own

Data Block 4882934 Function Block as Local Instance 4892935 Actual Parameters 489

294 ENENO Mechanism 490

2941 OK Variable 4902942 ENO Output 4902943 EN Input 491

30 SCL Functions 492

301 Timer Functions 492

302 Counter Functions 493

303 Math Functions 494

304 Shifting and Rotating 494

305 Conversion Functions 495

3051 Implicit Conversion Functions 4953052 Explicit Conversion Functions 495

306 Numerical Functions 498

307 Programming Your Own Functions with SCL 499

308 Programming Your Own Functions with STL 501

309 Brief Description of the SCL Examples 502

3091 Conveyor Example 5023092 Message Frame Example 5033093 General Examples 503

31 IEC functions 505

311 Conversion Functions 505

312 Comparison Functions 507

313 STRING Functions 508

314 DateTime-of-Day Functions 510

315 Numerical Functions 511

Appendix 513

32 S5S7 Converter 514

321 General 514

322 Preparation 515

3221 Checking Executability on the Target System (PLC) 515

3222 Checking Program Execution Characteristics 515

3223 Checking the Modules 5163224 Checking the Addresses 516

323 Converting 518

3231 Creating Macros 5183232 Preparing the Conversion 5193233 Starting the Converter 5193234 Convertible Functions 520

324 Post-Editing 521

3241 Creating the STEP 7 Project 5213242 Non-convertible Functions 5223243 Address Changes 5223244 Indirect Addressing 5233245 Access to ldquoExcessively Longrdquo

Data Blocks 5253246 Working with Absolute

Addresses 5253247 Parameter Initialization 5253248 Special Function Organization

Blocks 5253249 Error Handling 525

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 20: Berger Automating with STEP7 in STL and SCL

Table of Contents

20

33 Block Libraries 528

331 Organization Blocks 528

332 System Function Blocks 529

333 IEC Function Blocks 532

334 S5-S7 Converting Blocks 533

335 TI-S7 Converting Blocks 534

336 PID Control Blocks 535

337 Communication Blocks 535

338 Miscellaneous Blocks 535

339 SIMATIC_NET_CP 536

3310 Redundant IO MGP V31 537

3311 Redundant IO CGP V40 537

3312 Redundant IO CGP V51 537

34 STL Operation Overview 538

341 Basic Functions 538

3411 Binary Logic Operations 5383412 Memory Functions 5393413 Transfer Functions 5393414 Timer Functions 5393415 Counter Functions 539

342 Digital Functions 539

3421 Comparison Functions 539

3422 Math Functions 5403423 Arithmetic Functions 5403424 Conversion Functions 5403425 Shift Functions 5403426 Word Logic Operations 540

343 Program Flow Control 541

3431 Jump Functions 5413432 Master Control Relay 5413433 Block Functions 541

344 Indirect Addressing 541

35 SCL Statement and Function Overview 542

351 Operators 542

352 Control Statements 542

353 Block Calls 542

354 SCL Standard Functions 543

3541 Timer Functions 5433542 Counter Functions 5433543 Conversion Functions 5433544 Math functions 5443545 Shift and Rotate 544

Index 545

Abbreviations 553

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 21: Berger Automating with STEP7 in STL and SCL

Introduction

21

Introduction

This section of the book provides an overviewof the SIMATIC S7-300400

The S7-300400 programmable controller isof modular design The modules with which itis configured can be central (in the vicinity ofthe CPU) or distributed without any special set-tings or parameter assignments having to bemade In SIMATIC S7 systems distributed IOis an integral part of the system The CPU withits various memory areas forms the hardwarebasis for processing of the user programs Aload memory contains the complete user pro-gram the parts of the program relevant to itsexecution at any given time are in a work mem-ory whose short access times are the prerequi-site for fast program processing

STEP 7 is the programming software for S7-300400 and the automation tool is theSIMATIC Manager The SIMATIC Manager isan application for the Windows operating sys-tems from Microsoft and contains all functionsneeded to set up a project When necessary theSIMATIC Manager starts additional tools forexample to configure stations initialize mod-ules and to write and test programs

You formulate your automation solution in theSTEP 7 programming languages TheSIMATIC S7 program is structured that is tosay it consists of blocks with defined functionsthat are composed of networks or rungs Differ-ent priority classes allow a graduated interrupt-ibility of the user program currently executingSTEP 7 works with variables of various datatypes starting with binary variables (data typeBOOL) through digital variables (eg data typeINT or REAL for computing tasks) up to com-plex data types such as arrays or structures(combinations of variables of different types toform a single variable)

The first chapter contains an overview of thehardware of the S7-300400 automation systemand the second chapter contains the same over-

view of the STEP 7 programming softwareThe basis of the description is the functionalscope for STEP 7 Version 55

Chapter 3 ldquoSIMATIC S7 Programrdquo serves as anintroduction to the most important elements ofan S7 program and shows the programming ofindividual blocks in the programming lan-guages STL and SCL The functions and state-ments of STL and SCL are then described in thesubsequent chapters of the book All thedescriptions are explained using brief exam-ples

1 SIMATIC S7-300400 Programmable ControllerStructure of the programmable controllerdistributed IO communications moduleaddresses address areas

2 STEP 7 Programming SoftwareSIMATIC Manager processing a projectconfiguring a station configuring a net-work writing programs (symbol tableprogram editor) switching online testingprograms

3 SIMATIC S7 ProgramProgram processing with priority classesprogram blocks addressing variablesprogramming blocks with STL and SCLvariables and constants data types (over-view)

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 22: Berger Automating with STEP7 in STL and SCL

1 SIMATIC S7-300400 Programmable Controller

22

1 SIMATIC S7-300400 Programmable Controller

11 Structure of the Programmable Controller

111 Components

The SIMATIC S7-300400 is a modular pro-grammable controller comprising the followingcomponents

b RacksAccommodate the modules and connectthem to each other

b Power supply (PS)Provides the internal supply voltages

b Central processing unit (CPU)Stores and processes the user program

b Interface modules (IMs)Connect the racks to one another

b Signal modules (SMs)Adapt the signals from the system to theinternal signal level or control actuators viadigital and analog signals

b Function modules (FMs)Execute complex or time-critical processesindependently of the CPU

b Communications processors (CPs)Establish the connection to subsidiary net-works (subnets)

b SubnetsConnect programmable controllers to eachother or to other devices

A programmable controller (or station) mayconsist of several racks which are linked to oneanother via bus cables The power supply CPUand IO modules (SMs FMs and CPs) areplugged into the central rack If there is notenough room in the central rack for the IOmodules or if you want some or all IO modulesto be separate from the central rack expansionracks are available which are connected to thecentral rack via interface modules (Figure 11)

It is also possible to connect distributed IO to astation (see Chapter 121 ldquoPROFIBUS DPrdquo)

The racks connect the modules with two busesthe IO bus (or P bus) and the communicationbus (or K bus) The IO bus is designed forhigh-speed exchange of input and output sig-nals the communication bus for the exchangeof large amounts of data The communicationbus connects the CPU and the programmingdevice interface (MPI) with function modulesand communications processors

112 S7-300 Station

Centralized configuration

In an S7-300 controller as many as 8 IO mod-ules can be plugged into the central rackShould this single-tier configuration proveinsufficient you have two options for control-lers equipped with a CPU 313 or a moreadvanced CPU

b Either choose a two-tier configuration (withIM 365 up to 1 meter between racks)

b or choose a configuration of up to four tiers(with IM 360 and IM 361 up to 10 metersbetween racks)

You can operate a maximum of 8 modules in arack The number of modules may be limited bythe maximum permissible current per rackwhich is 12 A

The modules are linked to one another via abackplane bus which combines the functionsof the P and K buses

Local bus segment

A special feature regarding configuration is theuse of the FM 356 application module AnFM 356 is able to ldquosplitrdquo a modules backplanebus and to take over control of the remainingmodules in the split-off ldquolocal bus segmentrdquo

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 23: Berger Automating with STEP7 in STL and SCL

11 Structure of the Programmable Controller

23

Figure 11 Hardware Configuration for S7-300400

Single-tier configuration Two-tier configurationwith IM 365

Four-tier configurationwith IM 360 and IM 361

Modular designof an S7-300 station

Modular designof an S7-400 station

Far rangeup to 600 mwithout5V transmission(IM 461-4)

Close rangeup to 15 mwith 5V transmission(IM 461-1)

In the controller rackIM 460-1IM 460-0IM 460-3IM 460-4IM 463-2

Close rangeup to 5 mwithout5V transmission(IM 461-0)

Far rangeup to 100 mwithout5V transmission(IM 461-3)

Far rangeup to 600 m forS5 expansiondevices (IM 314)

SIEMENS SIEMENS SIEMENS

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 24: Berger Automating with STEP7 in STL and SCL

1 SIMATIC S7-300400 Programmable Controller

24

itself The limitations mentioned above regard-ing the number of modules and the power con-sumption also apply in this case

Standard CPUs

The standard CPUs are available in differentversions with regard to memory size and pro-cessing speed They range from the ldquosmallestrdquoCPU 312 for smaller applications with moder-ate processing speed requirements up to theCPU 319-3 PNDP with a large program mem-ory and fast program execution for cross-sectorautomation tasks Equipped with the corre-sponding interfaces some CPUs can be used asthe central controller for the distributed IOover PROFIBUS and PROFINET

A micro memory card (MMC) is required forusing the standard CPUs ndash as is the case with allinnovated S7-300 CPUs This memory mediumopens up new application possibilities com-pared to the previously used memory card (seeChapter 116 ldquoCPU Memory Areasrdquo)

The now discontinued CPU 318 can be re-placed by the CPUs 317 or 319

Compact CPUs

The 3xxC CPUs permit a compact design formini programmable controllers Depending onthe version they already contain

b Integral IODigital and analog inputsoutputs

b Integral technological functionsCounting measurement control position-ing

b Integral communications interfacesPROFIBUS DP master or slave point-to-point coupling (PtP)

The technological functions are system blockswhich use the onboard IOs of the CPU

Technology CPUs

The CPUs 3xxT combine open-loop controlfunctions with simple motion control functionsThe control section is designed as with a stan-dard CPU It is configured parameterized andprogrammed using STEP 7 The technologyobjects and the motion control section requirethe S7-Technology option package that is inte-

grated in the SIMATIC Manager following theinstallation

The technology CPUs have a PROFIBUS DPinterface which permits use as a DP master orDP slave The CPUs are used for cross-sectorautomation tasks in series machine construc-tion special machine construction and plantconstruction

Fail-safe CPUs

The CPUs 3xxF are used in production plantswith increased safety requirements Corre-sponding PROFIBUS and PROFINET inter-faces allow use of safety-related distributed IOwith the PROFIsafe bus profile (see ldquoS7 Dis-tributed Safetyrdquo under 115 ldquoSafety-relatedSIMATICrdquo) Standard modules for normalapplications can be used parallel to safety-related operation

SIPLUS

The SIPLUS product family offers modulesthat can be used in harsh environments TheSIPLUS components are based on standard de-vices which have been specially converted forthe respective application for example for anextended temperature range increased resis-tance to vibration and shock or voltage rangesdiffering from the standard Please thereforenote the technical data for the respective SIP-LUS module In order to carry out the configu-ration with STEP 7 use the equivalent type (thestandard module on which it is based) this isspecified for example on the modules name-plate

113 S7-400 Station

Centralized configuration

The controller rack of the S7-400 is available inthe versions UR1 (18 slots) UR2 (9 slots) andCR3 (4 slots) UR1 and UR2 can also be usedas expansion racks The power supply and theCPU also occupy slots in the racks possiblyeven two or more per module If necessary thenumber of available slots can be increasedusing expansion racks UR1 and ER1 have 18slots each UR2 and ER2 have 9 slots each

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 25: Berger Automating with STEP7 in STL and SCL

11 Structure of the Programmable Controller

25

Using the IM 460-1 and IM 461-1 interfacemodules one expansion rack per interface canbe located up to 15 m away from the controllerrack and the 5 V supply is also transmitted Upto 4 expansion ranks can also be operated viaIM 460-0 and 461-0 in the local range up to5 m For longer distances the IM 460-3 andIM 461-3 or the IM 460-4 and 461-4 enable upto 4 expansion racks to be operated up to 100 mor 600 m away

A maximum of 21 expansion racks can be con-nected to a central rack To distinguish betweenracks you set the number of the rack on thecoding switch of the receiving IM

The backplane bus consists of a parallel P busand a serial K bus Expansion racks ER1 andER2 are designed for ldquosimplerdquo signal moduleswhich generate no process interrupts do nothave to be supplied with 24 V voltage via the Pbus require no back-up voltage and have no Kbus connection The K bus is in racks UR1UR2 and CR2 either when these racks are usedas central racks or expansion racks with thenumbers 1 to 6

Connecting segmented rack

A special feature is the segmented rack CR2The rack can accommodate two CPUs with ashared power supply while keeping them func-tionally separate The two CPUs can exchangedata with one another via the K bus but havecompletely separate P buses for their own sig-nal modules

Multiprocessor mode

In an S7-400 as many as four speciallydesigned CPUs in a suitable rack UR can takepart in multiprocessor mode Each module inthis station is assigned to only one CPU bothwith its address and its interrupts See Chapters2036 ldquoMultiprocessing Moderdquo and 217 ldquoMul-tiprocessor Interruptrdquo for more details

Connection of SIMATIC S5 modules

The IM 463-2 interface module allows you toconnect S5 expansion units (EG 183U EG185U EG 186U as well as ER 701-2 and ER701-3) to an S7-400 and also allows central-ized expansion of the expansion units An

IM 314 in the S5 expansion unit handles thelink You can operate all analog and digitalmodules allowed in these expansion units AnS7-400 can accommodate as many as fourIM 463-2 interface modules as many as fourS5 expansion units can be connected in a dis-tributed configuration to each of an IM 463-2sinterfaces

114 Fault-Tolerant SIMATIC

For applications with high fault tolerancedemands for machines and processes there aretwo versions of SIMATIC S7 fault-tolerant pro-grammable controllers with a redundantdesign software redundancy and S7-400HFH

Software redundancy

Using SIMATIC S7-300400 standard compo-nents you can establish a software-basedredundant system with a master station control-ling the process and a standby station assumingcontrol in the event of the master failing

Fault tolerance through software redundancy issuitable for slow processes because transfer tothe standby station can require several secondsdepending on the configuration of the program-mable controllers The process signals are ldquofro-zenrdquo during this time The standby station thencontinues operation with the data last valid inthe master station

Redundancy of the inputoutput modules is im-plemented with distributed IO (ET 200M withIM 153-2 interface module for redundant PRO-FIBUS DP) The software redundancy can beconfigured with STEP 7 Version 52 and higher

Fault-tolerant SIMATIC S7-400H

The SIMATIC S7-400H is a fault-tolerant pro-grammable controller with redundant configu-ration comprising two central racks each withan H CPU and a synchronization module fordata comparison via fiber optic cable Bothcontrollers operate in ldquohot standbyrdquo mode inthe event of a fault the intact controllerassumes operation alone via automatic bump-less transfer The UR2-H rack with 2x9 slotsoffers the possibility for also installing a fault-tolerant system in one single rack

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 26: Berger Automating with STEP7 in STL and SCL

1 SIMATIC S7-300400 Programmable Controller

26

The IO can have normal availability (single-channel single-sided configuration) or en-hanced availability (single-channel switchedconfiguration with ET 200M) Communicationtakes place with a single or redundant bus

The user program is the same as for a non-re-dundant device the redundancy function is pro-vided exclusively by the hardware that is usedand is kept hidden from the user The softwarepackage required for configuration is includedin STEP 7 from V53 The provided standard li-braries Redundant IO contain blocks for sup-porting the redundant IO

115 Safety-related SIMATIC

Fail-safe programmable controllers controlprocesses in which the safe state can beachieved by direct switching-off They are usedin plants with increased safety requirements

The safety functions are mainly located in thesafety-related user program of a corresponding-ly designed CPU and in the failsafe input andoutput modules An F-CPU complies with thesafety requirements up to AK 6 in accordancewith DIN V 19250DIN V VDE 0801 up to SIL3 in accordance with IEC 61508 and up to Cat-egory 4 in accordance with EN 954-1 Safetyfunctions can be executed parallel to a non-safe-ty-related user program in the same CPU

Safety-related communication over PROFIBUSDP ndash also over PROFINET IO with S7 Distrib-uted Safety ndash uses the PROFIsafe bus profileThis permits transmission of safety-related andnon-safety-related data on a single bus cable

Safety Integrated for the manufacturing industry

S7 Distributed Safety is a failsafe automationsystem for the protection of machines and per-sonnel mainly for applications with machinecontrols and in the process industry

Controllers from the SIMATIC S7-300 S7-400 and ET 200S ranges are available as F-CPUs The safety-related IO modules are con-nected to S7-400 over PROFIBUS DP or PRO-FINET IO using the safety-related PROFIsafebus profile With S7-300 and ET 200S use ofsafety-related IO modules is additionally possi-ble in the central rack

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The SIMATIC S7 Distributed Safety optionpackage is required to program the safety-relat-ed parts of the program With this option pack-age you can use the F-LAD or F-FBD program-ming languages to create the blocks which con-tain the safety-related program Interfacing tothe IO is carried out using the process image aswith the standard program S7 DistributedSafety also includes a library with TUumlV-certi-fied safety blocks There is an additional libraryavailable with F-blocks for press and burnercontrols

The safety-related user program can be execut-ed parallel to the standard user program If anerror is detected in the safety-related part of theprogram the CPU enters the STOP state

Safety Integrated for the process industry

S7 FFH Systems is a failsafe automation sys-tem based on S7-400 mainly for applications inthe process industry The safety-related IOmodules are connected over PROFIBUS DPusing the safety-related PROFIsafe bus profile

An S7-400 F-CPU is provided with the safety-related control functions by application of an S7F Systems Runtime license A non-safety-relat-ed user program can be executed parallel to thesafety-related plant unit

In addition to fail-safety the S7-400FH alsoprovides increased availability If a detectedfault results in a STOP of the master CPU a re-action-free switch is made to the CPU runningin hot standby mode The S7 H Systems optionpackage is additionally required for operationas S7-400FH

The hardware configuration and programmingof the non-safety-related user program are car-ried out using the standard applications ofSTEP 7

The S7 F Systems option package is additional-ly required for programming the safety-relatedprogram parts and additionally the CFC optionpackage V50 SP3 and higher and the S7-SCLoption package V50 and higher

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 27: Berger Automating with STEP7 in STL and SCL

11 Structure of the Programmable Controller

27

The safety-related program is programmed us-ing CFC (Continuous Function Chart) Pro-grammed safety-related function blocks fromthe supplied F-library can be called and inter-connected in this manner Alongside functionsfor programming safety functions they also in-clude fault detection and fault reaction func-tions This ensures that if there are failures orerrors the F-system can be stopped in or trans-ferred to a safe mode If a fault is detected in thesafety program the safety-related part of theplant is switched off whereas the remainingpart can continue to operate

Fail-safe IO

Failsafe signal modules (F-modules or F-sub-modules) are required for safety operation Thefail-safety is achieved through the integratedsafety functions and the corresponding wiringof sensors and actuators

The F-modules can also be used in standardapplications with enhanced diagnostics require-ments Redundant F-modules can be used withS7 FFH systems to increase the availabilityboth in standard and safety-related operation

The failsafe IO is available in various versions

b The fail-safe signal modules in S7-300 de-sign are used in the ET 200M distributed IOdevice or ndash with S7-Distributed Safety ndash al-so centrally

b Failsafe IO modules are available for thedistributed IO devices in the designs ET200S ET 200pro and ET 200eco

b Failsafe interface modules are also availableas F-CPUs for the ET 200S and ET 200prodistributed IO devices

b Failsafe DP standard slaves and ndash with S7-Distributed Safety also IO standard devicesndash can be used which can handle the PRO-FIsafe bus profile

Failsafe CPUs and signal modules are alsoavailable in SIPLUS design

116 CPU Memory Areas

Figure 12 shows the memory areas in the pro-gramming device in the CPU and in the signalmodules which are important for your program

The programming device contains the off-linedata These consist of the user program (pro-gram code and user data) the system data (eghardware configuration network and connec-tion configuration) and further project-specificdata such as eg the symbol table and com-ments

The online data consists of the user programand the system data on the CPU stored in twostorage areas the load memory and the workmemory In addition the system memory is alsopresent here

Finally the IO modules contain memories forthe signal statuses of the inputs and outputs

The central processing units have a slot for aplug-in memory module This memory modulealso contains the load memory or parts thereof(see ldquoPhysical design of CPU memoryrdquo furtherbelow) The memory module is designed asmemory card (S7-400-CPUs) or as micro mem-ory card (S7-300 CPUs and derived ET 200CPUs) A firmware update for the CPU operat-ing system can also be performed via the mem-ory module

Memory card

The memory submodule for the S7-400 CPUsis the memory card (MC) There are two typesof memory card RAM cards and flash EPROMcards

If you only want to expand the load memoryuse a RAM card A RAM card allows you tomodify the entire user program online This isnecessary for example for larger programswhen testing and during commissioning RAMmemory cards lose their contents whenunplugged

If you want to protect your user programagainst power failure following testing andcommissioning including configuration dataand module parameters use a flash EPROMcard In this case load the entire programoffline onto the flash EPROM card with thecard plugged into the programming deviceWith the relevant CPUs you can also load theprogram online with the memory card pluggedinto the CPU

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 28: Berger Automating with STEP7 in STL and SCL

1 SIMATIC S7-300400 Programmable Controller

28

Micro memory card

The memory submodule for the newer S7-300CPUs is a micro memory card (MMC) Thedata on the MMC are non-volatile but can beread written and deleted just like with a RAMThis response permits data backup without abattery

The MMC contains the complete load memoryso that an MMC is always required for opera-tion The MMC can be used as a portable stor-age medium for user programs or firmwareupdates Using special system functions youcan read or write data blocks on the MMC fromthe user program eg read recipes from theMMC or create a measured-value archive onthe MMC and provide it with data

Load memory

The entire user program including configura-tion data is in the load memory (system data)From the programming device the user pro-gram is always initially loaded into the loadmemory and from there into the work memoryThe program in the load memory is not exe-cuted as the control program

With a CPU 300 and a CPU ET200 the loadmemory is present completely on the micromemory card Thus the contents of the loadmemory are retained even if the CPU is de-en-ergized

If the load memory with a CPU 400 consists ofan integrated RAM or RAM memory card abackup battery is required in order to keep theuser program retentive With an integrated

Figure 12 Memory areas on the CPU

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 29: Berger Automating with STEP7 in STL and SCL

11 Structure of the Programmable Controller

29

EEPROM or a plug-in flash EPROM memorycard as the load memory the CPU can be oper-ated without battery backup

From STEP 7 V51 and with appropriatelyequipped CPUs you can save all the projectdata as a compressed archive file in the loadmemory (see Chapter 222 ldquoManaging Rear-ranging and Archivingrdquo)

Work memory

Work memory is designed in the form of high-speed RAM fully integrated in the CPU Theoperating system of the CPU copies the ldquoexecu-tion-relevantrdquo program code and the user datainto the work memory ldquoRelevantrdquo is a charac-teristic of the existing objects and does notmean that a particular code block will necessar-ily be called and executed The ldquoactualrdquo controlprogram is executed in the work memory

Specific to the product the work memory canbe either a coherent area or divided accordingto program and data memories where the latteris also divided into retentive and non-retentiveparts

When writing back the user program into theprogramming device the blocks are fetchedfrom the load memory supplemented by the cur-rent values of the data addresses from the workmemory (further information available in Chap-ters 264 ldquoLoading the User Program intothe CPUrdquo and 265 ldquoBlock Handlingrdquo)

System memory

System memory contains the addresses (vari-ables) that you access in your program Theaddresses are combined into areas (addressareas) containing a CPU-specific number ofaddresses Addresses may be for exampleinputs used to scan the signal states of momen-tary-contact switches and limit switches andoutputs that you can use to control contactorsand lamps

The system memory on a CPU contains the fol-lowing address areas

b Inputs (I)Inputs are an image (ldquoprocess imagerdquo) ofthe digital input modules

b Outputs (Q)Outputs are an image (ldquoprocess imagerdquo) ofthe digital output modules

b Bit memories (M) are information stores which are directly ac-cessible from any point in the user program

b Timers (T)Timers are locations used to implementwaiting and monitoring times

b Counters (C)Counters are software-level locationswhich can be used for up and down count-ing

b Temporary local data (L)Locations used as dynamic intermediatebuffers during block processing The tem-porary local data are located in the L stackwhich the CPU occupies dynamically dur-ing program execution

The letters enclosed in parentheses representthe abbreviations to be used for the differentaddresses when writing programs You mayalso assign a symbol to each variable and thenuse the symbol in place of the address identifier

The system memory also contains buffers forcommunication jobs and system messages(diagnostics buffer) The size of these data buf-fers as well as the size of the process inputimage the process output image and the Lstack are parameterizable on certain CPUs

Physical design of CPU memory

The physical design of the load memory differsaccording to the type of CPU (Figure 13)

A CPU 300 or CPU ET 200 does not have anintegrated load memory A micro memory cardcontaining the load memory must always be in-serted to permit operation The load memorycan be written and read like a RAM The phys-ical design means that the number of write op-erations is limited (no cyclic writing by userprogram) You can use the menu command CO-PY RAM TO ROM to transfer the current valuesof the data operands from the work memory tothe load memory

With a CPU 300 with firmware version V2012or later the work memory for the user data con-sists of a retentive part and a non-retentive part

1 SIMATIC S7-300400 Programmable Controller

30

The control program is also present in the non-retentive part

The integrated RAM load memory in a CPU400 is designed for small programs or for mod-ification of individual blocks if the load memo-ry is a flash EPROM memory card If the com-plete control program is larger than the integrat-ed load memory you will need a RAM memorycard for testing The tested program is then cop-ied with the programming device to a flashEPROM memory card which you insert intothe CPU for operation

The work memory of a CPU 400 is divided intotwo parts One part saves the program code theother the user data The system and work mem-ories in a CPU 400 constitute one (physical)unit If the process image changes in size thisaffects the size of the work memory

12 Distributed IO

Distributed IO refers to modules connected viaPROFIBUS DP or PROFINET IO PROFIBUSDP uses the PROFIBUS subnet for data trans-mission PROFINET IO the Industrial Ethernetsubnet (for further information see Chapter132 ldquoSubnetsrdquo)

121 PROFIBUS DP

PROFIBUS DP provides a standardized inter-face for transferring predominantly binary pro-cess data between an ldquointerface modulerdquo in the(central) programmable controller and the fielddevices This ldquointerface modulerdquo is called theDP master and the field devices are the DPslaves

Figure 13 Physical Design of the CPU Memory

Work memoryProgram code

User data

Work memoryProgram code

Work memoryProgram code

Work memoryUser data

Non-retentiveuser data

Retentiveuser data

System memory

System memory

System memory

CPU

CPU

CPU

S7-300 and ET CPUs without adjustable data retentivity

S7-300 and ET CPUs with adjustable data retentivity

S7-400 CPUMemory Card

or

Micro Memory Card

Micro Memory Card

Load memoryRAM and ROM

Load memoryRAM and ROM

Load memoryRAM

FEPROMLoad memory

Load memoryRAM

12 Distributed IO

31

The DP master and all the slaves it controlsform a DP master system There can be up to32 stations in one segment and up to 127 sta-tions in the entire network A DP master cancontrol a number of DP slaves specific to itselfYou can also connect programming devices tothe PROFIBUS DP network as well as forexample devices for human machine interfaceET 200 devices or SIMATIC S5 DP slaves

DP master system

PROFIBUS DP is usually operated as a ldquomonomaster systemrdquo that is one DP master controlsseveral DP slaves The DP master is the onlymaster on the bus with the exception of a tem-porarily available programming device (diag-nostics and service device) The DP master andthe DP slaves assigned to it form a DP mastersystem (Figure 14)

You can also install several DP master systemson one PROFIBUS subnet (multi master sys-tem) However this increases the response timein individual cases because when a DP masterhas initialized ldquoitsrdquo DP slaves the access rightsfall to the next DP master that in turn initializesldquoitsrdquo DP slaves etc

You can reduce the response time if a DP mas-ter system contains only a few DP slaves Since

it is possible to operate several DP masters inone S7 station you can distribute the DP slavesof a station over several DP master systems Inmultiprocessor mode every CPU has its ownDP master systems

DP master

The DP master is the active node on the PRO-FIBUS network It exchanges cyclic data withldquoitsrdquo DP slaves A DP master can be

b A CPU with integral DP master interface orplug-in interface submodule (eg CPU 315-2DP CPU 417)

b An interface module in conjunction with aCPU (eg IM 467)

b A CP in conjunction with a CPU (egCP 342-5 CP 443-5)

There are ldquoClass 1 mastersrdquo for data exchangein process operation and ldquoClass 2 mastersrdquo forservice and diagnostics (eg a programmingdevice)

DP slaves

The DP slaves are the passive nodes onPROFIBUS In SIMATIC S7 a distinction ismade between

Figure 14 Components of a PROFIBUS DP Master System in an RS485 Segment

1 SIMATIC S7-300400 Programmable Controller

32

b Compact DP slavesThey behave like a single module towardsthe DP master

b Modular DP slavesThey comprise several modules (submod-ules

b Intelligent DP slavesThey contain a control program that con-trols the lower-level (own) modules

Compact PROFIBUS DP slaves

Examples of compact DP slaves are theET 200L the ET 200R and the ET 200eco Busgateways such as the DPAS-i Link also behavelike a compact slave on the PROFIBUS DP

Modular PROFIBUS DP slaves

Examples of modular DP slaves are theET 200iSP the ET 200M the ET 200S and theET 200pro

Intelligent PROFIBUS DP slaves

Intelligent DP slaves are for example CPUswith integrated DP (slave) interface or an S7-300 station with the CP 342-5 communicationsprocessor Equally an ET 200pro station withthe IM 154-8 PNDP CPU interface module oran ET 200S station with the IM 151-7 CPU in-terface module can be operated as intelligentDP slaves

RS 485 repeater

The RS 485 repeater combines two bus seg-ments in a PROFIBUS subnet The number ofbus stations and the size of the subnet can thenbe increased

The repeater provides signal regeneration andelectrical isolation It can be operated at trans-mission rates up to 12 Mbits ndash including4545 kbits for PROFIBUS PA

The RS 485 repeater is not configured it needonly be considered when calculating the busparameters

Diagnostics repeater

You can use a diagnostics repeater to determinethe topology in a PROFIBUS segment (RS 485copper cable) during operation and to carry out

line diagnostics The diagnostics repeater pro-vides signal regeneration and electrical isola-tion for the connected segments The maximumsegment length is 100 m in each case the trans-mission rate can be between 96 kbits and12 Mbits

The diagnostics repeater has connections for 3bus segments The line from the DP master isconnected to the feed terminals of the bus seg-ment DP1 The two other connections DP2 andDP3 contain the measuring circuits for determi-nation of the topology and line diagnostics onthe bus segments connected here Up to 9 fur-ther diagnostics repeaters can be connected inseries

The diagnostics repeater is handled in the mas-ter system like a DP slave In the event of afault it transmits the determined diagnosticsdata to the DP master These data are the topol-ogy of the bus segment (bus station and cablelengths) the contents of the segment diagnos-tics buffer (last 10 events with fault informa-tion location and cause) and the statistics data(comments on the quality of the bus system) Inaddition the diagnostics repeater providesmonitoring functions for isochronous mode

The diagnostics data can be fetched using aprogramming device with STEP 7 V52 orhigher and also displayed graphically Fromthe user program the line diagnostics is trig-gered using the system function SFC 103 DP_TOPOL and read using SFC 59 RD_REC orSFB 52 RDREC To adjust the clock on thediagnostics repeater read the CPU time usingthe system function SFC 1 READ_CLK andtransmit it using SFC 58 WR_REC or SFB 53WRREC

The diagnostics repeater is configured andparameterized using STEP 7 A GSD file isavailable for operation on non-Siemens mas-ters

122 PROFINET IO

PROFINET IO offers a standardized interfacefor transmitting mainly binary process dataover Industrial Ethernet between an ldquointerfacemodulerdquo in the (central) programmable control-ler and the field devices This ldquointerface mod-ulerdquo is referred to as the IO controller and the

12 Distributed IO

33

field devices as the IO devices The IO control-ler and all IO devices controlled by it constitutea PROFINET IO system

PROFINET IO System

A PROFINET IO system comprises the IO con-troller in the central station and the IO devices(field devices) assigned to it The connectingIndustrial Ethernet subnet can be shared withother nodes and applications (Figure 15)

IO controller

The IO controller is the active node on thePROFINET It exchanges data cyclically withldquoitsrdquo IO devices An IO controller can be

b A CPU with integrated PROFINET inter-face (eg CPU 317-2PNDP)

b A CP module in association with a CPU(eg CP 343-1)

IO device

IO devices are the passive stations on the PRO-FINET In SIMATIC S7 a distinction is madebetween

b Compact IO devicesThese behave like a single module with regard to the IO controller

b Modular IO devicesThese comprise several modules (submodules)

b Intelligent IO devicesThese contain a control program that con-trols the lower-level (own) modules

Compact PROFINET IO devices

An example of a compact IO device is theET 200eco Bus gateways such as the IEAS-iLink PN IO also behave like a compact slave onthe PROFINET IO

Modular PROFINET IO devices

Examples of modular IO devices are theET 200M the ET 200S and the ET 200pro

Intelligent PROFINET IO devices

Intelligent IO devices are for example CPUswith integrated PN interface Equally anET 200pro station with the IM 154-8 PNDPCPU interface module or an ET 200S stationwith the IM 151-8 PNDP CPU interface mod-ule can be operated as intelligent IO devices

IO supervisor

Devices for parameterization commissioningdiagnostics and operator control and monitor-ing eg programming or HMI devices arereferred to as IO supervisors

123 ActuatorSensor Interface

The actuatorsensor interface (AS-i) is a net-working system for the lowest process level inautomation plants in accordance with the open

Figure 15 Components of a PROFINET IO system

S7 station with IO-Controller eg CPU 317-2PNDP

IO-Device eg ET 200S

IO-Supervisor eg a programming device

Industrial Ethernet Industrial EthernetPNPN coupler

IEPB Link

PROFIBUS DP

IEAS-i Link

AS-Interface

1 SIMATIC S7-300400 Programmable Controller

34

international standard EN 50295 An AS-i mas-ter controls up to 62 AS-i slaves over a two-wire AS-i cable which transmits both the con-trol signals and the supply voltage (Figure 16)

An AS-i segment can have a maximum lengthof 100 m when combined with repeaters andextension plugs a maximum length of 600 mcan be achieved

With the ASIsafe safety concept you can con-nect safety sensors such as emergency-offswitches door contact switches or safety lightarrays directly to the AS-i network up to Catego-ry 4 in accordance with EN 954-1 or SIL3 in ac-cordance with IEC 61508 This requires safeAS-i slaves for connecting the safety sensors anda safety monitor that combines the safe inputswith parameterizable logic and ensures safeshutdown

AS-i master

Standard AS-i masters can control up to 31standard AS-i slaves with a cycle time of max5 ms With enhanced AS-i masters the quantityframework is increased to a maximum of 62AS-i slaves with extended addressing range anda cycle time of max 10 ms Pairs of slaves withextended addressing range occupy one address

if standard slaves are connected to an enhancedmaster they each occupy one address

The AS-i master CP 343-2 is used in an S7-300 station or in an ET-200M station It sup-ports the following AS-i slaves

b Standard slaves

b Slaves with extended addressing range ABslaves)

b Analog slaves in accordance with slave pro-file 73 or 74

In standard mode the CP 343-2 responds like anIO module it occupies 16 input bytes and 16 out-put bytes in the analog address space (128 andupwards) Up to 31 standard slaves or up to 62AB slaves (slaves with extended addressingrange) can be used with a CP 343-2 The AS-islaves are parameterized with default valuesstored in the CP

In extended mode the complete scope of func-tions is available in accordance with the AS-imaster specification When using the providedFC block master calls from the user program(transmission of parameters during ongoingoperation checking of the referenceactual con-figuration testing and diagnostics) can be car-ried out in addition to standard operation

Figure 16 Connecting the AS-i Bus System to SIMATIC S7

S7-300 stationCP343-2

AS-i actuator

AS-ipower supply

AS-i sensor AS-i distributor

or or

DPAS-i Link

IEAS-i Link

PROFIBUS DP Industrial Ethernet

AS-Interface

furtherAS-i devices

binary actuatorsans sensorswith AS-i ASIC

up to 8 actuatorsor sensorsup to 4 slaves

passiveAS-i module AS-i module

active

binary actuatorsans sensorswithout AS-i ASIC

12 Distributed IO

35

AS-i slaves

AS-i slaves can be bus-capable actuators orsensors with AS-i ASIC or also AS-i modulesActuators and sensors with AS-i ASIC are con-nected to a passive module Conventional actu-ators and sensors can be connected to an activemodule

AS-i slaves are available in the standard versionwhere a standard slave occupies one of the max31 possible addresses The standard slaves areaddressed by the user program like binaryinputs and outputs

AS-i slaves with extended addressing range(AB slaves) occupy one address in pairs sothat max 62 slaves can be operated on one mas-ter ldquoA slavesrdquo are handled like standard slavesldquoB slavesrdquo are addressed using data recordsAS-i AB slaves can also be used to record andtransmit analog values

124 Routers

Routers permit data exchange between deviceson different subnets as well as the passing on ofconfiguration and parameterization informa-tion between different subnets (Figure 17)

Connection of two PROFIBUS subnets

You can use the DPDP coupler (revision level2) to connect two PROFIBUS subnets togetherand can then exchange data between the DPmasters The two subnets are electrically iso-lated and can be operated at different transmis-sion rates up to max 12 Mbits In both subnetsthe DPDP coupler is assigned to the respectiveDP master as a DP slave with a freely selectablestation address in each case

The maximum size of the transfer memory is244 byte input data and 244 byte output datadivided in up to 16 areas Input areas in onesubnet must correspond to output areas in theother Up to 128 byte can be consistently trans-mitted If the page with input data fails the cor-responding output data on the other page areheld at their last value

The DPDP coupler is configured and parame-terized using STEP 7 A GSD file is availablefor operation on non-Siemens masters

Connection of PROFIBUS DP to PROFIBUS PA

PROFIBUS PA (Process Automation) is a bussystem for process engineering in intrinsically-safe areas (Ex area Zone 1) eg in the chemicalindustry as well as in non-intrinsically-safeareas such as the food and drinks industry

The protocol for PROFIBUS PA is based on theEN 50170 standard Volume 2 (PROFIBUSDP) and the transmission method is based onIEC 1158-2

There are two possible methods of connectingPROFIBUS DP to PROFIBUS PA

b DPPA coupler if the PROFIBUS DP net-work can be operated at 4545 kbitss

b DPPA link that converts the data transferrates of PROFIBUS DP to the transfer rateof PROFIBUS PA

The DPPA coupler enables connection of PAfield devices to PROFIBUS DP On PROFI-BUS DP the DPPA coupler is a DP slave oper-ated at 4545 kbitss Up to 31 PA field devicescan be connected to one DPPA coupler Thesefield devices form a PROFIBUS PA segmentwith a data transfer rate of 3125 kbitss Takentogether all PROFIBUS PA segments form ashared PROFIBUS PA bus system

The DPPA coupler is available in two variantsa non-Ex version with up to 400 mA output cur-rent and an Ex version with up to 100 mA out-put current

The DPPA link enables connection of PA fielddevices to PROFIBUS DP at a data transfer rateof 96 kbitss to 12 Mbitss A DPPA link con-sists of an IM 157 interface module and up to 5DPPA couplers linked together via SIMATICS7 bus connectors It takes the bus system com-prising all the PROFIBUS PA segments andmaps it to a PROFIBUS DP slave You can con-nect up to 31 PA field devices per DPPA link

SIMATIC PDM (Process Device Managerpreviously SIPROM) is a vendor-independenttool for parameterizing startup and diagnosticsof intelligent field devices with PROFIBUS PAor HART functionality The DDL (DeviceDescription Language) is available for parame-terizing HART transducers (Highway Address-able Remote Transducers)

1 SIMATIC S7-300400 Programmable Controller

36

With STEP 7 V51 SP3 and higher the IampCmodules are parameterized with the hardwareconfiguration you must not use SIMATICPDM any more

Connection of PROFIBUS DP to AS-Interface

A DPAS-Interface link enables connection ofthe PROFIBUS DP to the AS-Interface OnPROFIBUS DP the link is a modular DP slavewith a transmission rate of up to 12 Mbits andIP 20 degree of protection On the AS-Interfaceit is an AS-i master which controls the AS-islaves The link is available in the versionsDPAS-i Link 20E and DPAS-i Link AdvancedThe following AS-i slaves can be controlled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing mode (ABslaves)

b Slaves with data transfer mechanisms ac-cording to AS-i specification V30 (DPAS-iLink Advanced)

Connection of PROFIBUS DP to a Serial Interface

The PROFIBUS DPRS 232C link is a con-verter between an RS 232C (V24) interface andPROFIBUS DP Devices with an RS 232Cinterface can be connected to PROFIBUS DPwith the DPRS 232C link The DPRS 232Clink supports the 3964R and free ASCII proto-col procedures

The PROFIBUS DPRS 232C link is connectedto the device via a point-to-point connectionConversion to the PROFIBUS DP protocoltakes place in the PROFIBUS DPRS 232Clink The data are transferred consistently inboth directions Up to 224 bytes of user data aretransmitted per frame

The data transfer rate on PROFIBUS DP can beup to 12 Mbitss RS 232C can be operated atup to 384 kbitss with no parity even or oddparity 8 data bits and 1 stop bit

Connection of two PROFINET subnets

With the PNPN coupler you interconnect twoEthernet subnets in order to exchange data be-tween the IO controllers of both subnets Thereis galvanic isolation between the subnets

The PNPN coupler is a 120-mm-wide modulethat is installed on a DIN rail The subnets areconnected using RJ45 connectors Two connec-tions with internal switch function are availablefor each subnet

From the viewpoint of the relevant IO control-ler the PNPN coupler is an IO device in itsown PROFINET IO system Both IO devicesare linked by a data transfer area with 256 inputbytes and 256 output bytes divisible into amaximum of 16 areas Input areas in one subnetmust correspond to output areas in the other

The PNPN coupler is configured and parame-terized with STEP 7 A GSDML file is avail-able for other configuring tools

Figure 17 Routers

DPPALink

DPDPcoupler

IEAS-iLink

DPAS-iLink

PROFIBUS DPS DP

PROFIBUS DP PROFINET IO PROFINET IO

PROFIBUS PA serial couplingPROFIBUS PA AS-Interface AS-Interface

IEPBLink

PNPN coupler

DPPAcoupler

DPRS232CLink

13 Communications

37

Connection of PROFINET IO to PROFIBUS DP

You can use the IEPB Link PNIO to connectthe Industrial Ethernet and PROFIBUS sub-nets If you are using PROFINET IO the IEPBLink PNIO takes over the role of a proxy for theDP slaves on the PROFIBUS An IO controllercan access both DP slaves and IO devices overthe IEPB Link In standard mode the IEPBLink allows PGOP communication and S7routing between subnets

The IEPB Link PNIO is a double-width mod-ule of S7-300 design You can connect theIEPB Link to Industrial Ethernet using an 8-pole RJ45 female connector and to PROFIBUSusing a 9-pole SUB-D female connector

The IEPB Link is configured using STEP 7 asthe IO device to which a DP master system isconnected When switching on the IO control-ler also provides the subordinate DP slaves withthe configuration data

Please note that limitations exist on the PROFI-BUS DP following an IEPB Link For exam-ple you cannot connect a DPPA Link the DPsegment has no CiR capability and isochronousmode cannot be configured

Connection of PROFINET IO to AS-Interface

An IEAS-i Link enables the connection ofPROFINET IO to the AS-Interface On PROFI-NET IO the link is an IO Device On the AS-In-terface it is the AS-i master that controls theAS-i slaves The IO controller can access theindividual binary and analog values of the AS-i slaves directly

Connection to PROFINET is made via twoRJ45 connectors with internal switch functionThe AS-Interface bus is connected to 4-pinplug-in screw-type contacts

The link is available in single or double masterversions (in accordance with AS-Interfacespecification V30) for connection of 62 AS-islaves each plus integral analog value transmis-sion The following AS-i slaves can be con-trolled

b Standard slaves AS-i analog slaves

b Slaves with extended addressing range (ABslaves)

b Slaves with data transfer mechanisms in ac-cordance with AS-i specification V30

The IEAS-i link is configured and parameter-ized using STEP 7 A GSDML file is availablefor other configuration tools

13 Communications

Communications ndash data exchange between pro-grammable modules ndash is an integral componentof SIMATIC S7 Almost all communicationsfunctions are handled via the operating systemYou can exchange data without any additionalhardware and with just one connecting cablebetween the two CPUs If you use CP modulesyou can achieve powerful network links and thefacility of linking to non-Siemens systems

SIMATIC NET is the umbrella term forSIMATIC communications It represents infor-mation exchange between programmable con-trollers and between programmable controllersand human machine interface devices Thereare various communications paths availabledepending on performance requirements

131 Introduction

The most significant communications objectsare initially SIMATIC stations or non-Siemensdevices between which you want to exchangedata You require modules with communica-tions capability here With SIMATIC S7 allCPUs have an MPI interface over which theycan handle communications

In addition there are communications proces-sors (CPs) available that enable data exchangeat higher throughput rates and with differentprotocols You must link these modules via net-works A network is the hardware connectionbetween communication nodes

Data is exchanged via a ldquoconnectionrdquo in accor-dance with a specific execution plan (ldquocommu-nications servicerdquo) which is based among otherthings on a specific coordination procedure(ldquoprotocolrdquo) S7 connection is the standardbetween S7 modules with communicationscapability for example

1 SIMATIC S7-300400 Programmable Controller

38

Figure 18 uses the example of an S7 connec-tion to show the objects involved in communi-cation between two stations In the user pro-gram of the left station the data to be transmit-ted are present in a data block (DB) In the ex-ample the communications function is asystem function block (SFB) You assign apointer to the RD parameter for the data to betransmitted and trigger the transmission fromthe program The communications function isadditionally assigned a connection ID withwhich the used connection is specified Theconnection occupies one connection resourcein the CPUrsquos system memory The data are sentvia the modulersquos bus interface eg to a CPmodule in another station Connection resourc-es are occupied in both the CP module and theCPU As a result of the connection ID (and theconfigured connection path) the communica-tions function ldquorecognizesrdquo the data addressedto it in the receiver station and writes these bymeans of the pointer in the RD parameter to thedata block of the user program

Network

A network is a connection between severaldevices for the purpose of communication Itcomprises one or more identical or differentsubnets linked together

Subnet

In a subnet all the communications nodes arelinked via a hardware connection with uniformphysical characteristics and transmissionparameters such as the data transfer rate andthey exchange data via a shared transmissionprocedure SIMATIC recognizes MPIPROFIBUS Industrial Ethernet and point-to-point connection (PTP) as subnets

Communications service

A communications service determines how thedata are exchanged between communicationsnodes and how the data are to be handled It isbased on a protocol that describes amongstother things the coordination procedurebetween the communications nodes

The services most frequently used with SI-MATIC are PG communication OP communi-cation S7 basic communication S7 communi-cation global data communication PtP com-munication S5-compatible communication(SENDRECEIVE interface)

Connection

A connection defines the communications rela-tionships between two communications nodesIt is the logical assignment of two nodes for theexecution of a specific communications serviceand also contains special characteristics such as

Figure 18 Data Exchange Between Two SIMATIC S7 Stations

13 Communications

39

the type of connection (dynamic static) andhow it is established

SIMATIC recognizes the following connectiontypes S7 connection S7 connection (fault-tol-erant) point-to-point connection FMS andFDL connection ISO transport connectionISO-on-TCP and TCP connection UDP con-nection and e-mail connection

Communications functions

The communications functions are the user pro-gramrsquos interface to the communications ser-vice For SIMATIC S7-internal communica-tions the communications functions are inte-grated in the operating system of the CPU andthey are called via system blocks Loadableblocks are available for communication withnon-Siemens devices via communications pro-cessors

Overview of communications objects

Table 11 shows the relationships between sub-nets modules with communications capabilityand communications services PGOP commu-nication over the MPI PROFIBUS and Indus-trial Ethernet subnets is possible in addition tothe communications services shown

132 Subnets

Subnets are communications paths with thesame physical characteristics and the samecommunications procedure Subnets are thecentral objects for communication in theSIMATIC Manager

The subnets differ in their performance capabil-ity

b MPILow-cost method of networking a fewSIMATIC devices with small data volumes

b PROFIBUSHigh-speed exchange of small and mid-range volumes of data used primarily withdistributed IO

b Industrial EthernetCommunications between computers andprogrammable controllers for high-speedexchange of large volumes of data alsoused with distributed IO (PROFINET IO)

b Point-to-point (PTP)Serial link between two communicationspartners with special protocols

From STEP 7 V5 you can use a programmingdevice to reach SIMATIC S7 stations via sub-nets for the purposes of say programming orparameterizing The gateways between the sub-nets must be located in an S7 station with ldquorout-ing capabilityrdquo

MPI

Every CPU has an ldquointerface with multipointcapabilityrdquo (multipoint interface or MPI) Itenables establishment of subnets in whichCPUs human machine interface devices andprogramming devices can exchange data witheach other Data exchange is handled via aSiemens proprietary protocol

The maximum number of nodes on the MPInetwork is 32 Each node has access to the busfor a specific length of time and may send dataframes After this time it passes the accessrights to the next node (ldquotoken passingrdquo accessprocedure)

As transmission medium MPI uses either ashielded twisted-pair cable or a glass or plasticfiber-optic cable The maximum cable length ina bus segment with non-electrically isolatedinterfaces can be up to 50 m depending on thetransmission rate and up to 1000 m with electri-cally isolated interfaces This can be increasedby inserting RS-485 repeaters (up to 1100 m) oroptical link modules (up to gt 100 km) The datatransfer rate is usually 1875 kbitss

Over the MPI network you can exchange databetween CPUs with global data communica-tions station-external S7 basic communica-tions or S7 communications No additionalmodules are required

PROFIBUS

PROFIBUS stands for ldquoProcess Fieldbusrdquo andis a vendor-independent standard complyingwith IEC 61158EN 50170 for universal auto-mation (PROFIBUS DP and PROFIBUS FMS)and IEC 61158-2 for process automation (PRO-FIBUS PA)

The maximum number of nodes in a PROFI-BUS network is 127 where the network is

Page 30: Berger Automating with STEP7 in STL and SCL
Page 31: Berger Automating with STEP7 in STL and SCL
Page 32: Berger Automating with STEP7 in STL and SCL
Page 33: Berger Automating with STEP7 in STL and SCL
Page 34: Berger Automating with STEP7 in STL and SCL
Page 35: Berger Automating with STEP7 in STL and SCL
Page 36: Berger Automating with STEP7 in STL and SCL
Page 37: Berger Automating with STEP7 in STL and SCL
Page 38: Berger Automating with STEP7 in STL and SCL
Page 39: Berger Automating with STEP7 in STL and SCL