2021-05mj s71200 System Manual en-US en-US
2021-05mj s71200 System Manual en-US en-US
2021-05mj s71200 System Manual en-US en-US
Product overview 1
New features 2
STEP 7 programming
SIMATIC software 3
Installation 4
S7
S7-1200 Programmable controller PLC concepts 5
Device configuration 6
System Manual Programming concepts 7
Basic instructions 8
Extended instructions 9
Technology instructions 10
Communication 11
Web server 12
Communication processor
and Modbus TCP 13
TeleService communication
(SMTP email) 14
Online and diagnostic tools 15
Technical specifications A
Calculating a power budget B
Ordering Information C
Device exchange and spare
parts compatibility D
V4.5 05/2021
A5E02486680-AO
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage
to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices
referring only to property damage have no safety alert symbol. These notices shown below are graded according to
the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will be
used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property
damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended or
approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance
are required to ensure that the products operate safely and without any problems. The permissible ambient
conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication may
be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software described.
Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this
publication is reviewed regularly and any necessary corrections are included in subsequent editions.
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is necessary
to implement – and continuously maintain – a holistic, state-of-the-art industrial security
concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be connected to
an enterprise network or the internet if and to the extent such a connection is necessary and only
when appropriate security measures (e.g. firewalls and/or network segmentation) are in place.
For additional information on industrial security measures that may be implemented, please
visit (https://www.siemens.com/industrialsecurity).
Siemens' products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends that product updates are applied as soon as they are available
and that the latest product versions are used. Use of product versions that are no longer
supported, and failure to apply the latest updates may increase customers' exposure to cyber
threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed
visit (https://www.siemens.com/industrialsecurity).
Note
Important note for maintaining operational safety of your plant
Plants with safety-related features are subject to special operational safety requirements on the
part of the operator. Even suppliers are required to observe special measures during product
monitoring. For this reason, we inform you in the form of personal notifications about product
developments and features that are (or could be) relevant to operation of systems from a safety
perspective.
By subscribing to the appropriate notifications, you will ensure that you are always up-to-date
and able to make changes to your system, when necessary.
Log onto Industry Online Support. Go to the following links and, on the side, right click on "email
on update":
• SIMATIC S7-300/S7-300F (https://support.industry.siemens.com/cs/ww/en/ps/13751)
• SIMATIC S7-400/S7-400H/S7-400F/FH (https://support.industry.siemens.com/cs/ww/en/ps/
13828)
• SIMATIC WinAC RTX (F) (https://support.industry.siemens.com/cs/ww/en/ps/13915)
• SIMATIC S7-1500/SIMATIC S7-1500F (https://support.industry.siemens.com/cs/ww/en/ps/
13716)
• SIMATIC S7-1200/SIMATIC S7-1200F (https://support.industry.siemens.com/cs/ww/en/ps/
13683)
• Distributed I/O (https://support.industry.siemens.com/cs/ww/en/ps/14029)
• STEP 7 TIA Portal (https://support.industry.siemens.com/cs/ww/en/ps/14667)
Preface ................................................................................................................................................... 3
1 Product overview ................................................................................................................................. 27
1.1 Introducing the S7-1200 PLC .............................................................................................. 27
1.2 Expansion capability of the CPU ......................................................................................... 31
1.3 Basic HMI panels ................................................................................................................ 32
2 New features ....................................................................................................................................... 35
3 STEP 7 programming software ............................................................................................................ 37
3.1 System requirements ......................................................................................................... 37
3.2 Different views to make the work easier.............................................................................. 39
3.3 Compatibility between STEP 7 and the S7-1200.................................................................. 40
4 Installation........................................................................................................................................... 43
4.1 Guidelines for installing S7-1200 devices............................................................................ 43
4.2 Power budget .................................................................................................................... 44
4.3 Installation and removal procedures ................................................................................... 46
4.3.1 Mounting dimensions for the S7-1200 devices ................................................................... 46
4.3.2 Installing and removing the CPU......................................................................................... 49
4.3.3 Installing and removing an SB, CB, or BB............................................................................. 51
4.3.4 Installing and removing an SM ........................................................................................... 53
4.3.5 Installing and removing a CM or CP .................................................................................... 54
4.3.6 Removing and reinstalling the S7-1200 terminal block connector ....................................... 55
4.3.7 Installing and removing the expansion cable ...................................................................... 56
4.4 Wiring guidelines ............................................................................................................... 58
5 PLC concepts ........................................................................................................................................ 65
5.1 Execution of the user program ........................................................................................... 65
5.1.1 Operating modes of the CPU .............................................................................................. 68
5.1.2 Processing the scan cycle in RUN mode .............................................................................. 71
5.1.3 Organization blocks (OBs) .................................................................................................. 72
5.1.3.1 Program cycle OB............................................................................................................... 72
5.1.3.2 Startup OB ......................................................................................................................... 73
5.1.3.3 Time delay interrupt OB ..................................................................................................... 73
5.1.3.4 Cyclic interrupt OB ............................................................................................................. 73
5.1.3.5 Hardware interrupt OB ....................................................................................................... 74
5.1.3.6 Time error interrupt OB ...................................................................................................... 75
5.1.3.7 Diagnostic error interrupt OB.............................................................................................. 76
5.1.3.8 Pull or plug of modules OB ................................................................................................. 78
5.1.3.9 Rack or station failure OB ................................................................................................... 79
5.1.3.10 Time of day OB .................................................................................................................. 79
5.1.3.11 Status OB........................................................................................................................... 80
9.2.3.1 S_CONV, STRG_VAL, and VAL_STRG (Convert to/from character string and number)
instructions ..................................................................................................................... 319
9.2.3.2 Strg_TO_Chars and Chars_TO_Strg (Convert to/from character string and array of CHAR)
instructions ..................................................................................................................... 328
9.2.3.3 ATH and HTA (Convert to/from ASCII string and hexadecimal number) instructions............ 330
9.2.4 String operation instructions ............................................................................................ 331
9.2.4.1 MAX_LEN (Maximum length of a character string)............................................................ 332
9.2.4.2 LEN (Determine the length of a character string) .............................................................. 332
9.2.4.3 CONCAT (Combine character strings)................................................................................ 333
9.2.4.4 LEFT, RIGHT, and MID (Read substrings in a character string) instructions .......................... 334
9.2.4.5 DELETE (Delete characters in a character string) ............................................................... 335
9.2.4.6 INSERT (Insert characters in a character string) ................................................................. 336
9.2.4.7 REPLACE (Replace characters in a character string) ........................................................... 337
9.2.4.8 FIND (Find characters in a character string)....................................................................... 338
9.2.5 Runtime information........................................................................................................ 339
9.2.5.1 GetSymbolName (Read out a tag on the input parameter) ................................................ 339
9.2.5.2 GetSymbolPath (Query composite global name of the input parameter assignment) ......... 342
9.2.5.3 GetInstanceName (Read out name of the block instance) ................................................. 344
9.2.5.4 GetInstancePath (Query composite global name of the block instance) ............................. 346
9.2.5.5 GetBlockName (Read out name of the block) .................................................................... 348
9.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) ................................................................... 350
9.3.1 Distributed I/O Instructions............................................................................................... 350
9.3.2 RDREC and WRREC (Read/write data record)...................................................................... 352
9.3.3 GETIO (Read process image)............................................................................................. 355
9.3.4 SETIO (Transfer process image) ........................................................................................ 356
9.3.5 GETIO_PART (Read process image area) ............................................................................ 357
9.3.6 SETIO_PART (Transfer process image area)........................................................................ 358
9.3.7 RALRM (Receive interrupt)................................................................................................ 359
9.3.8 D_ACT_DP (Enable/disable PROFINET IO devices) .............................................................. 362
9.3.9 STATUS parameter for RDREC, WRREC, and RALRM ............................................................ 367
9.3.10 Others ............................................................................................................................. 371
9.3.10.1 DPRD_DAT and DPWR_DAT (Read/write consistent data) .................................................... 371
9.3.10.2 RCVREC (I-device/I-slave receive data record) .................................................................... 374
9.3.10.3 PRVREC (I-device/I-slave make data record available) ......................................................... 376
9.3.10.4 DPNRM_DG (Read diagnostic data from a PROFIBUS DP slave) ........................................... 378
9.4 PROFIenergy .................................................................................................................... 380
9.5 Interrupts ........................................................................................................................ 382
9.5.1 ATTACH and DETACH (Attach/detach an OB and an interrupt event) instructions ................ 382
9.5.2 Cyclic interrupts ............................................................................................................... 385
9.5.2.1 SET_CINT (Set cyclic interrupt parameters)........................................................................ 385
9.5.2.2 QRY_CINT (Query cyclic interrupt parameters) .................................................................. 387
9.5.3 Time of day interrupts ...................................................................................................... 388
9.5.3.1 SET_TINTL (Set time of day interrupt) ............................................................................... 388
9.5.3.2 CAN_TINT (Cancel time of day interrupt) .......................................................................... 390
9.5.3.3 ACT_TINT (Activate time of day interrupt) ......................................................................... 390
9.5.3.4 QRY_TINT (Query status of time of day interrupt) ............................................................. 391
9.5.4 Time delay interrupts ....................................................................................................... 392
9.5.5 DIS_AIRT and EN_AIRT (Delay/enable execution of higher priority interrupts and
asynchronous error events) instructions ........................................................................... 394
9.6 Alarms............................................................................................................................. 395
11.5.11.1 Configuring logical network connections between two devices ......................................... 692
11.5.11.2 Configuring the Local/Partner connection path between two devices ................................ 692
11.5.11.3 Configuring transmit (send) and receive parameters ......................................................... 692
11.5.12 Configuring a CPU and PROFINET IO device....................................................................... 695
11.5.12.1 Adding a PROFINET IO device ........................................................................................... 695
11.5.12.2 Assigning CPUs and device names .................................................................................... 696
11.5.12.3 Assigning Internet Protocol (IP) addresses......................................................................... 697
11.5.12.4 Configuring the IO cycle time ........................................................................................... 697
11.5.13 Configuring a CPU and PROFINET I-device ......................................................................... 698
11.5.13.1 I-device functionality........................................................................................................ 698
11.5.13.2 Properties and advantages of the I-device......................................................................... 699
11.5.13.3 Characteristics of an I-device ............................................................................................ 700
11.5.13.4 Data exchange between higher- and lower-level IO system ............................................... 702
11.5.13.5 Configuring the I-device ................................................................................................... 705
11.5.14 Shared devices................................................................................................................. 707
11.5.14.1 Shared device functionality .............................................................................................. 707
11.5.14.2 Example: Configuring a shared device (GSD configuration)................................................ 710
11.5.14.3 Example: Configuring an I-device as a shared device ......................................................... 715
11.5.15 Media Redundancy Protocol (MRP) ................................................................................... 724
11.5.15.1 Media redundancy with ring topologies............................................................................ 726
11.5.15.2 Using Media Redundancy Protocol (MRP).......................................................................... 728
11.5.15.3 Configuring media redundancy ........................................................................................ 731
11.5.16 S7 routing........................................................................................................................ 734
11.5.16.1 S7 routing between CPU and CP interfaces ....................................................................... 735
11.5.16.2 S7 routing between two CP interfaces .............................................................................. 735
11.5.17 Disabling SNMP................................................................................................................ 736
11.5.17.1 Disabling SNMP................................................................................................................ 737
11.5.18 Diagnostics ...................................................................................................................... 739
11.5.19 Distributed I/O instructions............................................................................................... 739
11.5.20 Diagnostic instructions..................................................................................................... 739
11.5.21 Diagnostic events for distributed I/O ................................................................................. 739
11.6 PROFIBUS......................................................................................................................... 739
11.6.1 Communications services of the PROFIBUS CMs................................................................ 741
11.6.2 Reference to the PROFIBUS CM user manuals.................................................................... 741
11.6.3 Configuring a DP master and slave device ......................................................................... 742
11.6.3.1 Adding the CM 1243-5 (DP master) module and a DP slave ............................................... 742
11.6.3.2 Configuring logical network connections between two PROFIBUS devices ......................... 742
11.6.3.3 Assigning PROFIBUS addresses to the CM 1243-5 module and DP slave ............................. 743
11.6.4 Distributed I/O instructions............................................................................................... 744
11.6.5 Diagnostic instructions..................................................................................................... 744
11.6.6 Diagnostic events for distributed ...................................................................................... 745
11.7 AS-i ................................................................................................................................. 745
11.7.1 Configuring an AS-i master and slave device ..................................................................... 746
11.7.1.1 Adding the AS-i master CM 1243-2 and AS-i slave ............................................................. 746
11.7.1.2 Configuring logical network connections between two AS-i devices .................................. 747
11.7.1.3 Configuring the properties of the AS-i master CM1243-2 .................................................. 747
11.7.1.4 Assigning an AS-i address to an AS-i slave ......................................................................... 748
11.7.2 Exchanging data between the user program and AS-i slaves.............................................. 750
11.7.2.1 STEP 7 basic configuration................................................................................................ 750
11.7.2.2 Configuring slaves with STEP 7 ......................................................................................... 752
11.7.3 Distributed I/O instructions............................................................................................... 754
13.5.2.2 Selecting the version of the Modbus TCP instructions ....................................................... 964
13.5.2.3 Modbus TCP instructions .................................................................................................. 965
13.5.2.4 Modbus TCP examples.................................................................................................... 1024
13.5.3 Modbus RTU .................................................................................................................. 1028
13.5.3.1 Overview ....................................................................................................................... 1028
13.5.3.2 Selecting the version of the Modbus RTU instructions ..................................................... 1031
13.5.3.3 Maximum number of supported Modbus slaves.............................................................. 1031
13.5.3.4 Modbus RTU instructions ............................................................................................... 1032
13.5.3.5 Modbus RTU examples ................................................................................................... 1052
13.6 Legacy PtP communication (CM/CB 1241 only) ............................................................... 1056
13.6.1 Legacy point-to-point instructions .................................................................................. 1056
13.6.1.1 PORT_CFG (Configure communication parameters dynamically)...................................... 1056
13.6.1.2 SEND_CFG (Configure serial transmission parameters dynamically) ................................. 1058
13.6.1.3 RCV_CFG (Configure serial receive parameters dynamically)............................................ 1059
13.6.1.4 SEND_PTP (Transmit send buffer data) ............................................................................ 1063
13.6.1.5 RCV_PTP (Enable receive messages) ............................................................................... 1065
13.6.1.6 RCV_RST (Delete receive buffer)...................................................................................... 1067
13.6.1.7 SGN_GET (Query RS-232 signals) ................................................................................... 1068
13.6.1.8 SGN_SET (Set RS-232 signals)......................................................................................... 1069
13.7 Legacy USS communication (CM/CB 1241 only) .............................................................. 1070
13.7.1 Selecting the version of the USS instructions .................................................................. 1071
13.7.2 Requirements for using the USS protocol ........................................................................ 1072
13.7.3 Legacy USS instructions ................................................................................................. 1074
13.7.3.1 USS_PORT (Edit communication using USS network) instruction ..................................... 1074
13.7.3.2 USS_DRV (Swap data with drive) instruction ................................................................... 1075
13.7.3.3 USS_RPM (Readout parameters from the drive) instruction ............................................. 1078
13.7.3.4 USS_WPM (Change parameters in the drive) instruction.................................................. 1079
13.7.4 Legacy USS status codes ................................................................................................ 1080
13.7.5 Legacy USS general drive setup requirements ................................................................. 1082
13.8 Legacy Modbus TCP communication............................................................................... 1082
13.8.1 Overview ....................................................................................................................... 1082
13.8.2 Selecting the version of the Modbus TCP instructions ..................................................... 1083
13.8.3 Legacy Modbus TCP instructions..................................................................................... 1084
13.8.3.1 MB_CLIENT (Communicate using PROFINET as Modbus TCP client).................................. 1084
13.8.3.2 MB_SERVER (Communicate using PROFINET as Modbus TCP server) ................................ 1089
13.8.4 Legacy Modbus TCP examples ........................................................................................ 1095
13.8.4.1 Example: Legacy MB_SERVER Multiple TCP connections .................................................. 1095
13.8.4.2 Example: Legacy MB_CLIENT 1: Multiple requests with common TCP connection............. 1095
13.8.4.3 Example: Legacy MB_CLIENT 2: Multiple requests with different TCP connections ............ 1096
13.8.4.4 Example: Legacy MB_CLIENT 3: Output image write request ........................................... 1097
13.8.4.5 Example: Legacy MB_CLIENT 4: Coordinating multiple requests ...................................... 1098
13.9 Legacy Modbus RTU communication (CM/CB 1241 only)................................................. 1099
13.9.1 Overview ....................................................................................................................... 1099
13.9.2 Selecting the version of the Modbus RTU instructions ..................................................... 1099
13.9.3 Legacy Modbus RTU instructions .................................................................................... 1100
13.9.3.1 MB_COMM_LOAD (Configure port on the PtP module for Modbus RTU) ........................... 1100
13.9.3.2 MB_MASTER (Communicate using the PtP port as Modbus RTU master) .......................... 1103
13.9.3.3 MB_SLAVE (Communicate using the PtP port as Modbus RTU slave) ................................ 1108
13.9.4 Legacy Modbus RTU examples........................................................................................ 1114
13.9.4.1 Example: Legacy Modbus RTU master program ............................................................... 1114
A.14.3 Measurement ranges for analog inputs and outputs ....................................................... 1326
A.14.3.1 Step response of the analog inputs................................................................................. 1326
A.14.3.2 Sample time and update times for the analog inputs ...................................................... 1327
A.14.3.3 Measurement ranges of the analog inputs for voltage and current (SB and SM)............... 1327
A.14.3.4 Measurement ranges of the analog outputs for voltage and current (SB and SM) ............ 1328
A.14.4 Thermocouple signal boards (SBs).................................................................................. 1329
A.14.4.1 SB 1231 1 analog thermocouple input specifications ...................................................... 1329
A.14.4.2 Basic operation for a thermocouple ................................................................................ 1330
A.14.5 RTD signal boards (SBs) .................................................................................................. 1334
A.14.5.1 SB 1231 1 analog RTD input specifications...................................................................... 1334
A.14.5.2 Selection tables for the SB 1231 RTD .............................................................................. 1337
A.15 BB 1297 Battery board ................................................................................................... 1339
A.16 Communication interfaces ............................................................................................. 1340
A.16.1 PROFIBUS....................................................................................................................... 1340
A.16.1.1 CM 1242-5 PROFIBUS DP SLAVE ..................................................................................... 1340
A.16.1.2 Pinout of the D-sub socket of the CM 1242-5 .................................................................. 1342
A.16.1.3 CM 1243-5 PROFIBUS DP Master..................................................................................... 1342
A.16.1.4 Pinout of the D-sub socket of the CM 1243-5 .................................................................. 1344
A.16.2 CP 1242-7...................................................................................................................... 1344
A.16.2.1 CP 1242-7 GPRS ............................................................................................................. 1345
A.16.2.2 GSM/GPRS antenna ANT794-4MR ................................................................................... 1346
A.16.2.3 Flat antenna ANT794-3M ............................................................................................... 1347
A.16.3 CM 1243-2 AS-i master .................................................................................................. 1348
A.16.3.1 Technical data for the AS-i master CM 1243-2................................................................. 1348
A.16.3.2 Electrical connections of the AS-i master ........................................................................ 1349
A.16.4 RS232, RS422, and RS485 .............................................................................................. 1350
A.16.4.1 CB 1241 RS485 specifications......................................................................................... 1350
A.16.4.2 CM 1241 RS232 specifications........................................................................................ 1353
A.16.4.3 CM 1241 RS422/485 specifications................................................................................. 1354
A.17 TeleService (TS Adapter and TS Adapter modular) ........................................................... 1355
A.18 SIMATIC memory cards .................................................................................................. 1356
A.19 Input simulators............................................................................................................. 1356
A.20 S7-1200 Potentiometer module ..................................................................................... 1358
A.21 I/O expansion cable........................................................................................................ 1359
A.22 Companion products...................................................................................................... 1360
A.22.1 PM 1207 power module................................................................................................. 1360
A.22.2 CSM 1277 compact switch module................................................................................. 1360
A.22.3 CM CANopen module..................................................................................................... 1360
A.22.4 RF120C communications module ................................................................................... 1361
A.22.5 SM 1238 Energy meter module ...................................................................................... 1361
A.22.6 SIWAREX electronic weighing systems ............................................................................ 1362
B Calculating a power budget............................................................................................................. 1363
C Ordering Information ...................................................................................................................... 1367
C.1 CPU modules ................................................................................................................. 1367
C.2 Signal modules (SMs), signal boards (SBs), and battery boards (BBs)............................... 1367
C.3 Communication ............................................................................................................. 1369
① Power connector
② Memory card slot under top
door
③ Removable user wiring con‐
nectors (behind the doors)
④ Status LEDs for the on-board
I/O
⑤ PROFINET connector (on the
bottom of the CPU)
Several security features help protect access to both the CPU and the control program:
• Password protection (Page 152) that allows you to configure access to the CPU functions.
• "know-how protection" (Page 156) to hide the code within a specific block.
• Copy protection (Page 157) to bind your program to a specific memory card or CPU.
• Protection of confidential PLC configuration data (Page 150)
• Secure PG/PC and HMI communication (Page 155)
Feature CPU 1211C CPU 1212C CPU 1214C CPU 1215C CPU 1217C
Physical size (mm) 90 x 100 x 75 110 x 100 x 75 130 x 100 x 75 150 x 100 x 75
User memory Work 50 Kbytes 75 Kbytes 100 Kbytes 125 Kbytes 150 Kbytes
Load 1 Mbyte 2 Mbytes 4 Mbytes
Retentive 14 Kbytes
Local onboard I/O Digital 6 inputs/ 8 inputs/ 14 inputs/
4 outputs 6 outputs 10 outputs
Analog 2 inputs 2 inputs/2 outputs
Process image size Inputs (I) 1024 bytes
Outputs (Q) 1024 bytes
Bit memory (M) 4096 bytes 8192 bytes
Signal module (SM) expansion None 2 8
Signal board (SB), Battery board 1
(BB), or communication board (CB)
Communication module (CM) 3
(left-side expansion)
Feature CPU 1211C CPU 1212C CPU 1214C CPU 1215C CPU 1217C
High-speed coun‐ Total Up to 6 configured to use any built-in or SB inputs
ters 1 MHz - Ib.2 to Ib.5
100/ 80 kHz Ia.0 to Ia.5
1
Element Description
Blocks Type OB, FB, FC, DB
Size CPU Model CPU 1211C CPU 1212C CPU 1214C CPU 1215C CPU 1217C
Code blocks 50KB 64KB 64KB 64KB 64KB
Linked data blocks
1
50KB 75KB 100KB 125KB 150KB
Unlinked2 data blocks 256KB 256KB 256KB 256KB 256KB
Quantity Up to 1024 blocks total (OBs + FBs + FCs + DBs)
Nesting depth 16 from the program cycle or startup OB;
6 from any interrupt event OB3
Monitoring Status of 2 code blocks can be monitored simultaneously
Element Description
OBs Program cycle Multiple
Startup Multiple
Time-delay interrupts 4 (1 per event)
Cyclic interrupts 4 (1 per event)
Hardware interrupts 50 (1 per event)
Time error interrupts 1
Diagnostic error interrupts 1
Pull or plug of modules 1
Rack or station failure 1
Time of day Multiple
Status 1
Update 1
Profile 1
Timers Type IEC
Quantity Limited only by memory size
Storage Structure in DB, 16 bytes per timer
Counters Type IEC
Quantity Limited only by memory size
Storage Structure in DB, size dependent upon count type
• SInt, USInt: 3 bytes
• Int, UInt: 6 bytes
• DInt, UDInt: 12 bytes
1
Stored in work memory and load memory. Cannot exceed the size of the remaining work or load memory.
2
Stored only in load memory
3
Safety programs use two nesting levels. The user program therefore has a nesting depth of four in safety programs.
① Status LEDs
② Bus connector slide tab
③ Removable user wiring connector
Communication modules (CMs) and com‐
munications processors (CPs) add commu‐
nication options to the CPU, such as for PRO‐
FIBUS or RS232/RS485 connectivity (for PtP,
Modbus or USS), or the AS-i master.
A CP provides capabilities for other types of
communication, such as connecting to the
CPU over a GPRS, LTE, IEC, DNP3, or WDC
network.
• The CPU supports up to three CMs or CPs
• Each CM or CP connects to the left side
of the CPU (or to the left side of another
CM or CP) ① Status LEDs
② Communication connector
• KTP1200 Basic: 12" Touch screen with 10 configurable keys, a resolution of 800 x 480 and
800 tags
• KTP 1200 Basic DP: 12" Touch screen with 10 configurable keys, a resolution of 800 x 400 and
800 tags
Note
STEP 7 is the programming and configuration software component of the TIA Portal. The TIA
Portal, in addition to STEP 7, also includes WinCC for designing and executing runtime process
visualization, and includes online help for WinCC as well as STEP 7.
The new features in S7-1200 V4.5 require STEP 7 Professional V17.
Hardware/software Requirements
Processor type Intel® Core™ i3-6100U, 2.30 GHz or better
RAM 8 GB
Available hard disk space 20 GB on system drive C:\
Hardware/software Requirements
Operating systems You can use STEP 7 with the following operating systems:
• Windows 7 (64-bit):
– Windows 7 Home Premium SP1 **
– Windows 7 Professional SP1
– Windows 7 Enterprise SP1
– Windows 7 Ultimate SP1
• Windows 10 (64-bit):
– Windows 10 Home Version 1709 **
– Windows 10 Home Version 1803 **
– Windows 10 Professional Version 1709
– Windows 10 Professional Version 1803
– Windows 10 Enterprise Version 1709
– Windows 10 Enterprise Version 1803
– Windows 10 Enterprise 2016 LTSB
– Windows 10 IoT Enterprise 2015 LTSB
– Windows 10 IoT Enterprise 2016 LTSB
• Windows Server (64-bit)
– Windows Server 2012 R2 StdE (full installation)
– Windows Server 2016 Standard (full installation)
Graphics card 32 MB RAM
24-bit color depth
Screen resolution 1024 x 768
Network 100 Mbit/s Ethernet or faster, for communication between STEP 7
and the CPU
* Including all applicable security updates. For more detailed information on operating systems, refer to
the help on Microsoft Windows or the Microsoft Web site.
** Only for Basic editions
Portal view
① Portals for the different tasks
② Tasks for the selected portal
③ Selection panel for the selected ac‐
tion
④ Changes to the Project view
Project view
① Menus and toolbar
② Project navigator
③ Work area
④ Task cards
⑤ Inspector window
⑥ Changes to the Portal view
⑦ Editor bar
With all of these components in one place, you have easy access to every aspect of your project.
The work area consists of three tabbed views:
• Device view: Displays the device that you have added or selected and its associated modules
• Network view: Displays the CPUs and network connections in your network
• Topology view: Displays the PROFINET topology of the network including devices, passive
components, ports, interconnections, and port diagnostics
Each view also enables you to perform configuration tasks. The inspector window shows the
properties and information for the object that you have selected in the work area. As you select
different objects, the inspector window displays the properties that you can configure. The
inspector window includes tabs that allow you to see diagnostic information and other
messages.
By showing all of the editors that are open, the editor bar helps you work more quickly and
efficiently. To toggle between the open editors, simply click the different editor. You can also
arrange two editors to appear together, arranged either vertically or horizontally. This feature
allows you to drag and drop between editors.
The STEP 7 Information System provides extensive online help for all of the configuration,
programming, and monitoring tools of STEP 7. You can refer to it for detailed explanations
beyond what this manual provides.
WARNING
Risks with copying and pasting program logic from older versions of STEP 7
Copying program logic from an older version of STEP 7 can cause unpredictable behavior in
program execution or failures to compile. Different versions of STEP 7 implement program
elements differently. The compiler does not always detect the differences if you made the
changes by pasting from an older version into STEP 7 V15. Executing unpredictable program
logic could result in death or severe personal injury if you do not correct the program.
When using program logic from an older release of STEP 7, always upgrade the entire project
to the latest version of STEP 7. Then you can copy, cut, paste, and edit program logic as
necessary. In STEP 7 V16 or later, you can open a project from STEP 7 V13 or later. STEP 7 then
performs the necessary compatibility conversions and upgrades the program correctly. Such
upgrade conversions and corrections are necessary for proper program compilation and
execution. If your project is older than STEP 7 V13, you must upgrade the project incrementally
to STEP 7 V17 (Page 1379).
You cannot download projects for V1.0, V2.0, or V3.0 S7-1200 CPUs to an S7-1200 V4.x CPU. See
the Exchanging a V3.0 CPU for a V4.x CPU (Page 1380) topic for guidelines on upgrading older
projects to a project that you can download.
Note
Projects with S7-1200 V1.x CPU versions
You cannot open a STEP 7 project that contains S7-1200 V1.x CPUs in STEP 7 V15.1. To use your
existing project, you must use STEP 7 V13 (with any update) to open your project and convert
the S7‑1200 V1.x CPUs to V2.0 or later. You can then use STEP 7 V15.1 to open the saved project
with the converted CPUs.
See also
New features (Page 35)
WARNING
Improper installation of the S7-1200 can result in electrical faults or unexpected
operation of machinery.
Electrical faults or unexpected machine operation can result in death, severe personal injury,
and/or property damage.
All instructions for installation and maintenance of a proper operating environment must be
followed to ensure the equipment operates safely.
Separate the S7-1200 devices from heat, high voltage, and electrical noise
As a general rule for laying out the devices of your system, always separate the devices that
generate high voltage and high electrical noise from the low-voltage, logic-type devices such as
the S7-1200.
When configuring the layout of the S7-1200 inside your panel, consider the heat-generating
devices and locate the electronic-type devices in the cooler areas of your cabinet. Reducing the
exposure to a high-temperature environment will extend the operating life of any electronic
device.
Consider also the routing of the wiring for the devices in the panel. Avoid placing low-voltage
signal wires and communications cables in the same tray with AC power wiring and high-energy,
rapidly-switched DC wiring.
CAUTION
For vertical mounting, the maximum allowable ambient temperature is reduced by 10
degrees C.
Orient a vertically mounted S7-1200 system as shown in the following figure.
Ensure that the S7-1200 system is mounted correctly.
When planning your layout for the S7-1200 system, allow enough clearance for the wiring and
communications cable connections.
PP
PP
PP
PP
The CPU provides a 24 V DC sensor supply that can supply 24 V DC for input points, for relay coil
power on the signal modules, or for other requirements. If your 24 V DC power requirements
exceed the budget of the sensor supply, then you must add an external 24 V DC power supply
to your system. Refer to the technical specifications (Page 1183) for the 24 V DC sensor supply
power budget for your particular CPU.
If you require an external 24 V DC power supply, ensure that the power supply is not connected
in parallel with the sensor supply of the CPU. For improved electrical noise protection, it is
recommended that the commons (M) of the different power supplies be connected.
WARNING
Connecting an external 24 V DC power supply in parallel with the 24 V DC sensor supply
can result in a conflict between the two supplies as each seeks to establish its own
preferred output voltage level
The result of this conflict can be shortened lifetime or immediate failure of one or both power
supplies, with consequent unpredictable operation of the PLC system. Unpredictable operation
could result in death, severe personal injury and/or property damage.
The DC sensor supply and any external power supply should provide power to different points.
Some of the 24 V DC power input ports in the S7-1200 system are interconnected, with a
common logic circuit connecting multiple M terminals. For example, the following circuits are
interconnected when designated as "not isolated" in the data sheets: the 24 V DC power supply
of the CPU, the power input for the relay coil of an SM, or the power supply for a non-isolated
analog input. All non-isolated M terminals must connect to the same external reference
potential.
WARNING
Connecting non-isolated M terminals to different reference potentials will cause
unintended current flows that may cause damage or unpredictable operation in the PLC
and any connected equipment.
Failure to comply with these guidelines could cause damage or unpredictable operation which
could result in death or severe personal injury and/or property damage.
Always ensure that all non-isolated M terminals in an S7-1200 system are connected to the
same reference potential.
&38&&38&&38&
PHDVXUHPHQWVLQPP
&38&&38&
PHDVXUHPHQWVLQPP
1
Before installing the TS (TeleService) Adapter IE Advanced or IE Basic, you must first connect the TS
Adapter and a TS module. The total width ("width A") is 60 mm.
Each CPU, SM, CM, and CP supports mounting on either a DIN rail or on a panel. Use the DIN rail
clips on the module to secure the device on the rail. These clips also snap into an extended
position to provide screw mounting positions to mount the unit directly on a panel. The interior
dimension of the hole for the DIN clips on the device is 4.3 mm.
A 25 mm thermal zone must be provided above and below the unit for free air circulation.
2 4
1 3
① DIN rail installation ③ Panel installation
② DIN rail clip in latched position ④ Clip in extended position for panel mounting
Before you install or remove any electrical device, ensure that the power to that equipment has
been turned off. Also, ensure that the power to any related equipment has been turned off.
WARNING
Installation or removal of S7-1200 or related equipment with the power applied could
cause electric shock or unexpected operation of equipment.
Failure to disable all power to the S7-1200 and related equipment during installation or
removal procedures could result in death, severe personal injury and/or property damage due
to electric shock or unexpected equipment operation.
Always follow appropriate safety precautions and ensure that power to the S7-1200 is disabled
before attempting to install or remove S7-1200 CPUs or related equipment.
Always ensure that whenever you replace or install an S7-1200 device you use the correct
module or equivalent device.
WARNING
Incorrect installation of an S7-1200 module may cause the program in the S7-1200 to
function unpredictably.
Failure to replace an S7-1200 device with the same model, orientation, or order could result in
death, severe personal injury and/or property damage due to unexpected equipment
operation.
Replace an S7-1200 device with the same model, and be sure to orient and position it correctly.
WARNING
Do not disconnect equipment when a flammable or combustible atmosphere is present.
Disconnection of equipment when a flammable or combustible atmosphere is present may
cause a fire or explosion which could result in death, serious injury and/or property damage.
Always follow appropriate safety precautions when a flammable or combustible atmosphere is
present.
Note
Electrostatic discharge can damage the device or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap whenever
you handle the device.
Note
Attach any communication modules to the CPU and install the assembly as a unit. Install signal
modules separately after the CPU has been installed.
Consider the following when installing the units on the DIN rail or on a panel:
• For DIN rail mounting, make sure the upper DIN rail clip is in the latched (inner) position and
that the lower DIN rail clip is in the extended position for the CPU and attached CMs.
• After installing the devices on the DIN rail, move the lower DIN rail clips to the latched
position to lock the devices on the DIN rail.
• For panel mounting, make sure the DIN rail clips are pushed to the extended position.
To install the CPU on a panel, follow these steps:
1. Locate, drill, and tap the mounting holes (M4), using the dimensions shown in table,
Mounting dimensions (mm) (Page 46).
2. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical power.
3. Extend the mounting clips from the module. Make sure the DIN rail clips on the top and
bottom of the CPU are in the extended position.
4. Secure the module to the panel, using a Pan Head M4 screw with spring and flat washer. Do
not use a flat head screw.
Note
The type of screw will be determined by the material upon which it is mounted. You should
apply appropriate torque until the spring washer becomes flat. Avoid applying excessive
torque to the mounting screws. Do not use a flat head screw.
Note
Using DIN rail stops could be helpful if your CPU is in an environment with high vibration
potential or if the CPU has been installed vertically. Use an end bracket (8WA1808 or
8WA1805) on the DIN rail to ensure that the modules remain connected. If your system is in
a high-vibration environment, then panel-mounting the CPU will provide a greater level of
vibration protection.
Task Procedure
1. Install the DIN rail. Secure the rail to the mounting panel every 75 mm.
2. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical power.
3. Hook the CPU over the top of the DIN rail.
4. Pull out the DIN rail clip on the bottom of the CPU to allow the CPU to fit over the rail.
5. Rotate the CPU down into position on the rail.
6. Push in the clips to latch the CPU to the rail.
Task Procedure
1. Ensure that the CPU and all S7-1200 equipment are discon‐
nected from electrical power.
2. Disconnect the I/O connectors, wiring, and cables from the
CPU (Page 55).
3. Remove the CPU and any attached communication modules as
a unit. All signal modules should remain installed.
4. If an SM is connected to the CPU, retract the bus connector:
– Place a screwdriver beside the tab on the top of the signal
module.
– Press down to disengage the connector from the CPU.
– Slide the tab fully to the right.
5. Remove the CPU:
– Pull out the DIN rail clip to release the CPU from the rail.
– Rotate the CPU up and off the rail, and remove the CPU
from the system.
Task Procedure
1. Ensure that the CPU and all S7-1200 equipment are disconnected
from electrical power.
2. Remove the top and bottom terminal block covers from the CPU.
3. Place a screwdriver into the slot on top of the CPU at the rear of the
cover.
4. Gently pry the cover straight up and remove it from the CPU.
5. Place the module straight down into its mounting position in the
top of the CPU.
6. Firmly press the module into position until it snaps into place.
7. Replace the terminal block covers.
Task Procedure
1. Ensure that the CPU and all S7-1200 equipment are disconnected
from electrical power.
2. Remove the top and bottom terminal block covers from the CPU.
3. Remove the signal board connector (if installed) by gently disen‐
gaging with a screwdriver.
4. Place a screwdriver into the slot on top of the module.
5. Gently pry the module up to disengage it from the CPU.
6. Without using a screwdriver, remove the module straight up from
its mounting position in the top of the CPU.
7. Replace the cover onto the CPU.
8. Replace the terminal block covers.
WARNING
Installing an unspecified battery in the BB 1297, or otherwise connecting an unspecified
battery to the circuit can result in fire or component damage and unpredictable operation
of machinery.
Fire or unpredictable operation of machinery can result in death, severe personal injury, or
property damage.
Use only the specified CR1025 battery for backup of the Real-time clock.
Task Procedure
Install your SM after installing the CPU.
1. Ensure that the CPU and all S7-1200 equipment are disconnec‐
ted from electrical power.
2. Remove the cover for the connector from the right side of the
CPU:
– Insert a screwdriver into the slot above the cover.
– Gently pry the cover out at its top and remove the cover.
3. Retain the cover for reuse.
Connect the SM to the CPU:
1. Position the SM beside the CPU.
2. Hook the SM over the top of the DIN rail.
3. Pull out the bottom DIN rail clip to allow the SM to fit over the
rail.
4. Rotate the SM down into position beside the CPU and push the
bottom clip in to latch the SM onto the rail.
Extending the bus connector makes both mechanical and electrical
connections for the SM.
1. Place a screwdriver beside the tab on the top of the SM.
2. Slide the tab fully to the left to extend the bus connector into
the CPU.
Follow the same procedure to install a signal module to a signal
module.
Task Procedure
You can remove any SM without removing the CPU or other SMs in place.
1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical
power.
2. Remove the I/O connectors and wiring from the SM (Page 55).
3. Retract the bus connector.
– Place a screwdriver beside the tab on the top of the SM.
– Press down to disengage the connector from the CPU.
– Slide the tab fully to the right.
If there is another SM to the right, repeat this procedure for that SM.
Task Procedure
1. Ensure that the CPU and all S7-1200 equipment are discon‐
nected from electrical power.
2. Attach the CM to the CPU before installing the assembly as
a unit to the DIN rail or panel.
3. Remove the bus cover from the left side of the CPU:
– Insert a screwdriver into the slot above the bus cover.
– Gently pry out the cover at its top.
4. Remove the bus cover. Retain the cover for reuse.
5. Connect the CM or CP to the CPU:
– Align the bus connector and the posts of the CM with
the holes of the CPU
– Firmly press the units together until the posts snap into
place.
6. Install the CPU and CP on a DIN rail or panel.
Task Procedure
Remove the CPU and CM as a unit from the DIN rail or panel.
1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical
power.
2. Remove the I/O connectors and all wiring and cables from the CPU and CMs.
3. For DIN rail mounting, move the lower DIN rail clips on the CPU and CMs to the
extended position.
4. Remove the CPU and CMs from the DIN rail or panel.
5. Grasp the CPU and CMs firmly and pull apart.
NOTICE
Separate modules without using a tool.
Do not use a tool to separate the modules because this can damage the units.
Task Procedure
Prepare the system for terminal block connector removal by removing the power from the
CPU and opening the cover above the connector.
1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical pow‐
er.
2. Inspect the top of the connector and locate the slot for the tip of the screwdriver.
3. Insert a screwdriver into the slot.
4. Gently pry the top of the connector away from the CPU. The connector will release with
a snap.
5. Grasp the connector and remove it from the CPU.
Task Procedure
Prepare the components for terminal block installation by removing power from the CPU
and opening the cover for connector.
1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical pow‐
er.
2. Align the connector with the pins on the unit.
3. Align the wiring edge of the connector inside the rim of the connector base.
4. Press firmly down and rotate the connector until it snaps into place.
Check carefully to ensure that the connector is properly aligned and fully engaged.
Table 4-12 Installing and removing the male connector of the expansion cable
Task Procedure
To install the male connector:
1. Ensure that the CPU and all S7-1200 equipment are dis‐
connected from electrical power.
2. Push the connector into the bus connector on the right
side of the signal module or CPU.
To remove the male connector:
1. Ensure that the CPU and all S7-1200 equipment are dis‐
connected from electrical power.
2. Pull out the male connector to release it from the signal
module or CPU.
Task Procedure
1. Ensure that the CPU and all S7-1200 equipment are dis‐
connected from electrical power.
2. Place the female connector to the bus connector on the
left side of the signal module.
3. Slip the hook extension of the female connector into the
housing at the bus connector and press down slightly to
engage the hook.
4. Lock the connector into place:
– Place a screwdriver beside the tab on the top of the
signal module.
– Slide the tab fully to the left.
To engage the connector, you must slide the connector tab all
the way to the left. The connector tab must be locked into
place.
Task Procedure
1. Ensure that the CPU and all S7-1200 equipment are dis‐
connected from electrical power.
2. Unlock the connector:
– Place a screwdriver beside the tab on the top of the
signal module.
– Press down slightly and slide the tab fully to the right.
3. Lift the connector up slightly to disengage the hook ex‐
tension.
4. Remove the female connector.
Note
Installing the expansion cable in a vibration environment
If the expansion cable is connected to modules that move, or are not firmly fixed, the cable male
end snap-on connection can gradually become loose.
Use a cable tie to fix the male end cable on the DIN-rail (or other place) to provide extra strain
relief.
Avoid using excessive force when you pull the cable during installation. Ensure the cable-
module connection is in the correct position once installation is complete.
Prerequisites
Before you ground or install wiring to any electrical device, ensure that the power to that
equipment has been turned off. Also, ensure that the power to any related equipment has been
turned off.
Ensure that you follow all applicable electrical codes when wiring the S7-1200 and related
equipment. Install and operate all equipment according to all applicable national and local
standards. Contact your local authorities to determine which codes and standards apply to your
specific case.
WARNING
Installation or wiring the S7-1200 or related equipment with power applied could cause
electric shock or unexpected operation of equipment.
Failure to disable all power to the S7-1200 and related equipment during installation or
removal procedures could result in death, severe personal injury, and/or damage due to electric
shock or unexpected equipment operation.
Always follow appropriate safety precautions and ensure that power to the S7-1200 is disabled
before attempting to install or remove the S7-1200 or related equipment.
Always take safety into consideration as you design the grounding and wiring of your S7-1200
system. Electronic control devices, such as the S7-1200, can fail and can cause unexpected
operation of the equipment that is being controlled or monitored. For this reason, you should
implement safeguards that are independent of the S7-1200 to protect against possible personal
injury or equipment damage.
WARNING
Control devices can fail in an unsafe condition, resulting in unexpected operation of
controlled equipment.
Such unexpected operations could result in death, severe personal injury and/or property
damage.
Use an emergency stop function, electromechanical overrides, or other redundant safeguards
that are independent of the S7-1200.
WARNING
Use of non-isolated or single insulation supplies to supply low voltage circuits from an AC
line can result in hazardous voltages appearing on circuits that are expected to be touch
safe, such as communications circuits and low voltage sensor wiring.
Such unexpected high voltages could cause electric shock resulting in death, severe personal
injury and/or property damage.
Only use high voltage to low voltage power converters that are approved as sources of touch
safe, limited voltage circuits.
All ground wires should be as short as possible and should use a large wire size, such as 2 mm2
(14 AWG).
When locating grounds, consider safety-grounding requirements and the proper operation of
protective interrupting devices.
A summary of Wiring rules for the S7-1200 CPUs, SMs and SBs is shown below:
Table 4-15 Wiring rules for S7-1200 CPUs, SMs, and SBs
* To avoid damaging the connector, be careful that you do not over-tighten the screws.
Note
Ferrules or end sleeves on stranded conductors reduce the risk of stray strands causing short
circuits. Ferrules longer than the recommended strip length should include an insulating collar
to prevent shorts due to side movement of conductors. Cross-sectional area limits for bare
conductors also apply to ferrules.
See also
Technical specifications (Page 1183)
A good suppressor solution is to use contactors and other inductive loads for which the
manufacturer provides suppressor circuits integrated in the load device, or as an optional
accessory. However, some manufacturer provided suppressor circuits may be inadequate for
your application. An additional suppressor circuit may be necessary for optimal noise reduction
and contact life.
For AC loads, a metal oxide varistor (MOV) or other voltage clamping device may be used with
a parallel RC circuit, but is not as effective when used alone. An MOV suppressor with no parallel
RC circuit often results in significant high frequency noise up to the clamp voltage.
A well-controlled turn-off transient will have a ring frequency of no more than 10 kHz, with less
than 1 kHz preferred. Peak voltage for AC lines should be within +/- 1200 V of ground. Negative
peak voltage for DC loads using the PLC internal suppression will be ~40 V below the 24 V DC
supply voltage. External suppression should limit the transient to within 36 V of the supply to
unload the internal suppression.
Note
The effectiveness of a suppressor circuit depends on the application and must be verified for your
particular usage. Ensure that all components are correctly rated and use an oscilloscope to
observe the turn-off transient.
Typical suppressor circuit for DC or relay outputs that switch DC inductive loads
Typical suppressor circuit for relay outputs that switch AC inductive loads
If you design your own suppressor circuit, the following table suggests resistor and capacitor
values for a range of AC loads. These values are based on calculations with ideal component
parameters. I rms in the table refers to the steady-state current of the load when fully ON.
CPU and associated modules. The modules (SM, SB, BB, CB, CM or CP) are detected and logged
in only upon powerup.
• Inserting or removing a module in the central rack under power (hot) is not supported. Never
insert or remove a module from the central rack when the CPU has power.
WARNING
Safety requirements for inserting or removing modules
Failure to disable all power to the CPU before insertion or removal of a module (SM, SB, BB,
CD, CM or CP) from the central rack could cause damage or unpredictable behaviour which
could result in death or severe personal injury and/or property damage.
Always remove power from the CPU and central rack and follow appropriate safety
precautions before inserting or removing a module from the central rack.
• You can insert or remove a SIMATIC memory card while the CPU is under power. However,
inserting or removing a memory card when the CPU is in RUN mode causes the CPU to go to
STOP mode.
NOTICE
Risks with removing memory card when CPU is in RUN mode.
Insertion or removal of a memory card when the CPU is in RUN mode causes the CPU to go
to STOP, which might result in damage to the equipment or the process being controlled.
Whenever you insert or remove a memory card, the CPU immediately goes to STOP mode.
Before inserting or removing a memory card, always ensure that the CPU is not actively
controlling a machine or process. Always install an emergency stop circuit for your
application or process.
• If you insert or remove a module in a distributed I/O rack (AS‑i, PROFINET, or PROFIBUS) when
the CPU is in RUN mode, the CPU generates an entry in the diagnostics buffer, executes the
pull or plug of modules OB if present, and by default remains in RUN mode.
For I/O that is updated every scan cycle, the CPU performs the following tasks during each scan
cycle:
• The CPU writes the outputs from the process image output area to the physical outputs.
• The CPU reads the physical inputs just prior to the execution of the user program and stores
the input values in the process image input area. These values thus remain consistent
throughout the execution of the user instructions.
• The CPU executes the logic of the user instructions and updates the output values in the
process image output area instead of writing to the actual physical outputs.
This process provides consistent logic through the execution of the user instructions for a
given cycle and prevents the flickering of physical output points that might change state
multiple times in the process image output area.
For controlling whether your process updates I/O points automatically on every scan cycle, or
upon the triggering of events, the S7-1200 provides five process image partitions. The first
process image partition, PIP0, is designated for I/O that is to be automatically updated every scan
cycle, and is the default assignment. You can use the remaining four partitions, PIP1, PIP2, PIP3,
and PIP4 for assigning I/O process image updates to various interrupt events. You assign I/O to
process image partitions in Device Configuration and you assign process image partitions to
interrupt events when you create interrupt OBs (Page 168) or edit OB properties (Page 168).
By default, when you insert a module in the device view, STEP 7 sets its I/O process image update
to "Automatic update". For I/O configured for "Automatic update", the CPU handles the data
exchange between the module and the process image area automatically during every scan
cycle.
To assign digital or analog points to a process image partition, or to exclude I/O points from
process image updates, follow these steps:
1. View the Properties tab for the appropriate device in Device configuration.
2. Expand the selections under "General" as necessary to locate the desired I/O points.
3. Select "I/O addresses".
4. Optionally select a specific OB from the "Organization block" drop-down list.
5. From the "Process image" drop-down list, change "Automatic update" to "PIP1", "PIP2", "PIP3",
"PIP4" or "None". A selection of "None" means that you can only read from and write to this
I/O using immediate instructions. To add the points back to the process image automatic
update, change this selection back to "Automatic update".
You can immediately read physical input values and immediately write physical output values
when an instruction executes. An immediate read accesses the current state of the physical
input and does not update the process image input area, regardless of whether the point is
configured to be stored in the process image. An immediate write to the physical output updates
both the process image output area (if the point is configured to be stored in the process image)
and the physical output point. Append the suffix ":P" to the I/O address if you want the program
to immediately access I/O data directly from the physical point instead of using the process
image.
Note
Use of process image partitions
If you assign I/O to one of the process image partitions PIP1 - PIP4, and do not assign an OB to that
partition, then the CPU never updates that I/O to or from the process image. Assigning I/O to a
PIP that does not have a corresponding OB assignment, is the same as assigning the process
image to "None". You can read the I/O directly from the physical I/O with an immediate read
instruction, or write to the physical I/O with an immediate write instruction. The CPU does not
update the process image.
The CPU supports distributed I/O for PROFINET, PROFIBUS, and AS-i networks (Page 555).
detected errors prevent the CPU from entering the RUN mode. The CPU supports the following
configuration choices:
• No restart (stay in STOP mode)
• Warm restart - RUN
• Warm restart - mode prior to POWER OFF
NOTICE
Repairable faults can cause the CPU to enter STOP mode.
The CPU can enter STOP mode due to repairable faults, such as the following:
• Failure of a replaceable signal module
• Temporary faults, such as power line disturbance or erratic power up event
Such conditions could result in property damage.
If you have configured the CPU to "Warm restart - mode prior to POWER OFF", the CPU goes
to the operating mode that the CPU was in prior to the loss of power or fault. If the CPU was
in STOP mode at the time of power loss or fault, the CPU goes to STOP mode on power up.
The CPU stays in STOP mode until the CPU receives a command to go to RUN mode. If the
CPU was in RUN mode at the time of power loss or fault, the CPU goes to RUN mode on the
next power up. The CPU goes to RUN mode providing the CPU detects no errors that would
inhibit a transition to RUN mode.
Configure CPUs that you intend to operate independently of a STEP 7 connection to "Warm
restart - RUN". This startup mode sets the CPU to return to RUN mode on the next power
cycle.
You can use the "STOP" or "RUN" commands (Page 1150) from the online tools of the
programming software to change the current operating mode. You can also include an STP
instruction (Page 289) in your program to change the CPU to STOP mode. This instruction allows
you to stop the execution of your program based on the program logic.
• In STOP mode, the CPU handles any communication requests (as appropriate) and performs
self-diagnostics.The CPU does not execute the user program. Automatic updates of the
process image do not occur.
• In STARTUP and RUN modes, the CPU performs the tasks shown in the following figure:
' ུ
$ % & ( ཱ ི ཱི
STARTUP RUN
A Copies the state of the physical inputs to ① Writes Q memory to the physical outputs
I memory
B Initializes the Q output (image) memo‐ ② Copies the state of the physical inputs to I
ry area with either zero, the last value, memory
or the configured substitute value. Ze‐
roes PB, PN, and AS-i outputs
C Initializes non-retentive M memory and ③ Executes the program cycle OBs
data blocks to their initial value and en‐
ables configured cyclic interrupt and
time of day events.
Executes the startup OBs.
D Stores any interrupt events into the ④ Performs self-test diagnostics
queue to be processed after entering
RUN mode
E Enables the writing of Q memory to the ⑤ Processes interrupts and communications
physical outputs during any part of the scan cycle
Note
Communication, including HMI communication, cannot interrupt OBs other than program
cycle OBs.
STARTUP processing
Whenever the operating mode changes from STOP to RUN, the CPU clears the process image
inputs, initializes the process image outputs and processes the startup OBs. Any read accesses
to the process-image inputs by instructions in the startup OBs read zero rather than the current
physical input value. Therefore, to read the current state of a physical input during the startup
mode, you must perform an immediate read. The startup OBs and any associated FCs and FBs
are executed next. If more than one startup OB exists, the CPU executes each OB in order
according to the OB number, executing the lowest OB number first.
Each startup OB includes startup information that helps you determine the validity of retentive
data and the time-of-day clock. You can program instructions inside the startup OBs to examine
these startup values and to take appropriate action. The following startup locations are
supported by the Startup OBs:
The CPU also performs the following tasks during the startup processing:
• Interrupts are queued but not processed during the startup phase
• No cycle time monitoring is performed during the startup phase
• Configuration changes to HSC (high-speed counter), PWM (pulse-width modulation), and
PtP (point-to-point communication) modules can be made in startup
• Actual operation of HSC, PWM and point-to-point communication modules only occurs in
RUN
After the execution of the startup OBs finishes, the CPU goes to RUN mode and processes the
control tasks in a continuous scan cycle.
Communications processing occurs periodically throughout the scan, possibly interrupting user
program execution.
Self-diagnostic checks include periodic checks of the system and the I/O module status checks.
Interrupts can occur during any part of the scan cycle, and are event-driven. When an event
occurs, the CPU interrupts the scan cycle and calls the OB that was configured to process that
event. After the OB finishes processing the event, the CPU resumes execution of the user
program at the point of interruption.
OBs control the execution of the user program. Specific events in the CPU trigger the execution
of an organization block. OBs cannot call each other. An FC or FB cannot call an OB. Only an event
such as a diagnostic interrupt or a time interval can start the execution of an OB. The CPU
handles OBs according to their respective priority classes, with higher priority OBs executing
before lower priority OBs. The lowest priority class is 1 (for the main program cycle), and the
highest priority class is 26.
5.1.3.2 Startup OB
Startup OBs execute one time when the operating mode of the CPU changes from STOP to RUN,
including powering up in the RUN mode and in commanded STOP-to-RUN transitions. After
completion, the main "Program cycle" begins executing.
Startup events
The startup event happens one time on a STOP to RUN transition and causes the CPU to execute
the startup OBs. You can configure multiple OBs for the startup event. The startup OBs execute
in numerical order.
event and a 10 ms cyclic event, every ten milliseconds both events occur at the same moment.
If you phase shift the 5 ms event by 1 to 4 ms and the 10 ms event by 0 ms, then the two events
do not occur at the same moment.
The default phase offset is 0. To change the initial phase shift, or to change the cyclic time for a
cyclic event, follow these steps:
1. Right-click the cyclic interrupt OB in the project tree.
2. Select "Properties" from the context menu.
3. Click "Cyclic interrupt" from the "Cyclic interrupt [OB 30]" dialog, and enter the new initial
values.
The maximum phase offset is 6000 ms (6 seconds) or the maximum Cyclic time, whichever is
smaller.
You can also query and change the scan time and the phase shift from your program using the
Query cyclic interrupt (QRY_CINT) and Set cyclic interrupt (SET_CINT) instructions. Scan time
and phase shift values set by the SET_CINT instruction do not persist through a power cycle or
a transition to STOP mode; scan time and phase shift values return to the initial values following
a power cycle or a transition to STOP. The CPU supports a total of four cyclic interrupt events.
All time error events trigger the execution of the time error interrupt OB if it exists. If the time
error interrupt OB does not exist, then the CPU changes to STOP mode.
The user program can extend the program cycle execution time up to ten times the configured
maximum cycle time by executing the RE_TRIGR instruction (Page 288) to restart the cycle time
monitor. However, if two "maximum cycle time exceeded" conditions occur within the same
program cycle without resetting the cycle timer, then the CPU transitions to STOP, regardless of
whether the time error interrupt OB exists. See the section on "Monitoring the cycle time in the
S7-1200 System Manual" (Page 86).
Time error interrupt OB includes start information that helps you determine which event and OB
generated the time error. You can program instructions inside the OB to examine these start
values and to take appropriate action.
Table 5-6 Start information for the time error OB (OB 80)
To include a time error interrupt OB in your project, you must add a time error interrupt by
double-clicking "Add new block" under "Program blocks" in the tree, then choose "Organization
block", and then "Time error interrupt".
The priority for a new V4.0 CPU is 22. If you exchange a V3.0 CPU for a V4.0 CPU (Page 1380), the
priority is 26, the priority that was in effect for V3.0. In either case, the priority field is editable
and you can set the priority to any value in the range 22 to 26.
• Wire break
• Short circuit
Diagnostic error events trigger the execution of the diagnostic error interrupt OB (OB 82) if it
exists. If it does not exist, then the CPU ignores the error.
To include a diagnostic error interrupt OB in your project, you must add a diagnostic error
interrupt by double-clicking "Add new block" under "Program blocks" in the tree, then choose
"Organization block", and then "Diagnostic error interrupt".
Note
Diagnostic errors for multi-channel local analog devices (I/O, RTD, and Thermocouple)
The diagnostic error interrupt OB can process only one channel's diagnostic error at a time.
If two channels of a multi-channel device have an error, then the second error only triggers the
diagnostic error interrupt OB under the following conditions: the first channel error clears, the
execution of the diagnostic error interrupt OB that the first error triggered is complete, and the
second error still exists.
The diagnostic error interrupt OB includes startup information that helps you determine
whether the event is due to the occurrence or removal of an error, and the device and channel
which reported the error. You can program instructions inside the diagnostic error interrupt OB
to examine these startup values and to take appropriate action.
Note
Diagnostic error OB Start information references the submodule as a whole if no
diagnostic event is pending
In V3.0, the start information for an outgoing diagnostic error event always indicated the source
of the event. In V4.0, if the outgoing event leaves the submodule with no pending diagnostics,
the start information references the submodule as a whole (16#8000) even if the source of the
event was a specific channel.
For example, if a wire break triggers a diagnostic error event on channel 2, the fault is then
corrected, and the diagnostic error event is cleared, the Start information will not reference
channel 2, but the submodule (16#8000).
Regardless of whether you have programmed this OB, the CPU changes to STOP mode when any
of these conditions occur with a module in the central rack.
5.1.3.11 Status OB
Status OBs execute if a DPV1 or PNIO slave triggers a status interrupt. This might be the case if
a component (module or rack) of a DPV1 or PNIO slave changes its operating mode, for example
from RUN to STOP.
Status events
For detailed information on events that trigger a status interrupt, refer to the manufacturer's
documentation for the DPV1 or PNIO slave.
5.1.3.12 Update OB
Update OBs execute if a DPV1 or PNIO slave triggers an update interrupt.
Update events
For detailed information on events that trigger an update interrupt, refer to the manufacturer's
documentation for the DPV1 or PNIO slave.
5.1.3.13 Profile OB
Profile OBs execute if a DPV1 or PNIO slave triggers a profile-specific interrupt.
Profile events
For detailed information on events that trigger a profile interrupt, refer to the manufacturer's
documentation for the DPV1 or PNIO slave.
5.1.3.15 MC-PreServo
You can program the MC-PreServo OB to contain program logic for the STEP 7 program to
execute directly before the MC-Servo OB executes.
MC-PreServo events
The MC-PreServo OB allows you to read out the configured application cycle information in
microseconds.
5.1.3.16 MC-PostServo
You can program the MC-PreServo OB to contain program logic for the STEP 7 program to
execute directly after the MC-Servo OB executes.
MC-PostServo events
The MC-PreServo OB allows you to read out the configured application cycle information in
microseconds.
H[HFXWH2%
H[HFXWH2%
Note
If you configure the OB execution mode to be non-interruptible, then a time error OB cannot
interrupt OBs other than program cycle OBs. Prior to V4.0 of the S7-1200 CPU, a time error OB
could interrupt any executing OB. From V4.0 forward, you must configure OB execution to be
interruptible if you want a time error OB (or any other higher priority OB) to be able to interrupt
executing OBs that are not program cycle OBs.
For further information on CPU overload behavior and event queueing, refer to the STEP 7
Information System.
Each CPU event has an associated priority. In general, the CPU services events in order of priority
(highest priority first). The CPU services events of the same priority on a "first-come, first-
served" basis.
In addition, the CPU recognizes other events that do not have associated OBs. The following
table describes these events and the corresponding CPU actions:
Interrupt latency
The interrupt event latency (the time from notification of the CPU that an event has occurred
until the CPU begins execution of the first instruction in the OB that services the event) is
approximately 175 µsec, provided that a program cycle OB is the only event service routine
active at the time of the interrupt event.
The RE_TRIGR instruction (Page 288) (re-trigger cycle time monitoring) allows you to reset the
timer that measures the cycle time. If the elapsed time for the current program cycle execution
is less than ten times the configured maximum scan cycle time, the RE_TRIGR instruction
retriggers the cycle time monitoring and returns with ENO = TRUE. If not, the RE_TRIGR
instruction does not retrigger the cycle time monitoring. It returns ENO = FALSE.
Typically, the scan cycle executes as fast as it can be executed and the next scan cycle begins as
soon as the current one completes. Depending upon the user program and communication
tasks, the time period for a scan cycle can vary from scan to scan. To eliminate this variation, the
CPU supports an optional minimum scan cycle time. If you enable this optional feature and
provide a minimum scan cycle time in ms, then the CPU delays after the execution of the
program cycle OBs until the minimum scan cycle time elapses before repeating the program
cycle.
In the event that the CPU completes the normal scan cycle in less time than the specified
minimum cycle time, the CPU spends the additional time of the scan cycle performing runtime
diagnostics and/or processing communication requests.
In the event that the CPU does not complete the scan cycle in the specified minimum cycle time,
the CPU completes the scan normally (including communication processing) and does not
create any system reaction as a result of exceeding the minimum scan time. The following table
defines the ranges and defaults for the cycle time monitoring functions:
• Communication load: You can configure a percentage of the time to be dedicated for
communication tasks.
Note
Communication priority
Communication tasks have a priority of 1. Because 1 is the lowest priority, other CPU events can
interrupt communication processing. Interruptions from other events can negatively affect
communication processing during the scan cycle. You can adjust the "Cycle load due to
communication" percentage to increase the portion of the scan cycle dedicated to
communication processing.
For more information about the scan cycle, see "Monitoring the cycle time". (Page 86)
Memory management
The CPU provides the following memory areas to store the user program, data, and
configuration:
• Load memory is non-volatile storage for the user program, data and configuration. When you
download a project to the CPU, the CPU first stores the program in the Load memory area. This
area is located either in a memory card (if present) or in the CPU. The CPU maintains this non-
volatile memory area through a power loss. The memory card supports a larger storage space
than that built-in to the CPU.
• Work memory is volatile storage for some elements of the user project while executing the
user program. The CPU copies some elements of the project from load memory into work
memory. This volatile area is lost when power is removed, and is restored by the CPU when
power is restored.
• Retentive memory is non-volatile storage for a limited quantity of work memory values. The
CPU uses the retentive memory area to store the values of selected user memory locations
during power loss. When a power down or power loss occurs, the CPU restores these
retentive values upon power up.
To display the memory usage for a compiled program block, right-click the block in the "Program
blocks" folder in the STEP 7 project tree and select "Properties" from the context menu. The
Compiliation properties display the load memory and work memory for the compiled block.
To display the memory usage for the online CPU, double-click "Online and diagnostics" in STEP 7,
expand "Diagnostics", and select "Memory".
Retentive memory
You can avoid data loss after power failure by marking certain data as retentive. The CPU allows
you to configure the following data as retentive:
• Bit memory (M): You can define the size of retentive memory for bit memory in the PLC tag
table or in the assignment list. Retentive bit memory always starts at MB0 and runs
consecutively up through a specified number of bytes. Specify this value from the PLC tag
table or in the assignment list by clicking the "Retain" toolbar icon. Enter the number of M
bytes to retain starting at MB0.
Note: For any block, you can display the assignment list by selecting a block in the Program
Blocks folder and then selecting he Tools > Assignment list menu command.
• Tags of a function block (FB): If an FB is of type "Optimized block access", then the interface
editor for this FB includes a "Retain" column. In this column, you can select either "Retain",
"Non-retain", or "Set in IDB" individually for each tag. When you place such an FB in the
program, the instance DB that corresponds to the FB includes this "Retain" column as well.
You can only change the retentive state of a tag from within the instance DB interface editor
if you selected "Set in IDB" (Set in instance data block) in the Retain selection for the tag in the
optimized FB.
If an FB is not of type "Optimized block access", then the interface editor for this FB does not
include a "Retain" column. When you place such an FB in the program, the instance DB that
corresponds to the FB does, however, include a "Retain" column that is available for edit. In
this case, selecting the "Retain" option for any tag results in the selection of all tags. Similarly,
deselecting the option for any tag results in the deselection of all tags.
To view or modify whether an FB is optimized, open the properties of the FB and select the
attributes.
• Tags of a global data block: If you select "Optimized block access" for the attributes in the
properties of the data block, you can set each tag to be retentive or not. If you do not select
"Optimized block access", then all of the data block tags have the same state. The tags are
either all retentive or all non-retentive.
The CPU supports a total of 14336 bytes of retentive data for a V4.5 project loaded onto a PLC
with V4.5 firmware. If a V4.4 project is loaded, the retentive data is 10240 bytes. To see how
much is available, from the PLC tag table or the assignment list, click the "Retain" toolbar icon.
Although this is where the retentive range is specified for M memory, the second row indicates
the total remaining memory available for M and DB combined. Note that for this value to be
accurate, you must compile all data blocks with retentive tags.
Note
Downloading a program does not clear or make any changes to existing values in retentive
memory. If you want to clear retentive memory before a download, then reset your CPU to
factory settings prior to downloading the program.
CAUTION
Risks with overwriting the system memory or clock memory bits
Overwriting the system memory or clock memory bits can corrupt the data in these functions
and cause your user program to operate incorrectly, which can cause damage to equipment
and injury to personnel.
Because both the clock memory and system memory are unreserved in M memory, instructions
or communications can write to these locations and corrupt the data.
Avoid writing data to these locations to ensure the proper operation of these functions, and
always implement an emergency stop circuit for your process or machine.
System memory configures a byte with bits that turn on (value = 1) for a specific event.
7 6 5 4 3 2 1 0
Reserved Always off Always on Diagnostic status indica‐ First scan indicator
Value 0 Value 0 Value 1 tor • 1: First scan after start‐
• 1: Change up
• 0: No change • 0: Not first scan
Clock memory configures a byte that cycles the individual bits on and off at fixed intervals. Each
clock bit generates a square wave pulse on the corresponding M memory bit. These bits can be
used as control bits, especially when combined with edge instructions, to trigger actions in the
user code on a cyclic basis.
Bit number 7 6 5 4 3 2 1 0
Tag name
Period (s) 2.0 1.6 1.0 0.8 0.5 0.4 0.2 0.1
Frequency (Hz) 0.5 0.625 1 1.25 2 2.5 5 10
Because clock memory runs asynchronously to the CPU cycle, the status of the clock memory can change
several times during a long cycle.
If you choose to summarize security events within a time interval, you have the choice of setting
a time interval in seconds, minutes, or hours, and a numerical value in the range 1 .. 255.
If you choose to restrict security events, you will be restricting these types of events:
• Going online with the correct or incorrect password
• Manipulated communications data detected
• Manipulated data detected on memory card
• Manipulated firmware update file detected
• Changed protection level (access protection) downloaded to the CPU
• Password legitimization restricted or enabled (by instruction or CPU display)
• Online access denied due to the possible number of simultaneous access attempts being
exceeded
• Timeout when an existing online connection is inactive
• Logging in to the Web server with the correct or incorrect password
• Creating a backup of the CPU
• Restoring the CPU configuration
Note
Some distibuted I/O modules offer additional settings for the reaction to CPU stop mode. Select
from the list of choices in Device Configuration for those modules.
When the CPU changes from RUN to STOP, the CPU retains the process image and writes the
appropriate values for both the digital and analog outputs, based upon the configuration.
0
࿆ ࿇ ࿈࿉
࿊
࿋
A Memory area identifier E Bytes of the memory area
B Byte address: byte 3 F Bits of the selected byte
C Separator ("byte.bit")
D Bit location of the byte (bit 4 of 8)
In the example, the memory area and byte address (M = bit memory area, and 3 = Byte 3) are
followed by a period (".") to separate the bit address (bit 4).
I (process image input): The CPU samples the peripheral (physical) input points just prior to the
cyclic OB execution of each scan cycle and writes these values to the input process image. You
can access the input process image as bits, bytes, words, or double words. Both read and write
access is permitted, but typically, process image inputs are only read.
By appending a ":P" to the address, you can immediately read the digital and analog inputs of the
CPU, SB, SM or distributed module. The difference between an access using I_:P instead of I is
that the data comes directly from the points being accessed rather than from the input process
image. This I_:P access is referred to as an "immediate read" access because the data is retrieved
immediately from the source instead of from a copy that was made the last time the input
process image was updated.
Because the physical input points receive their values directly from the field devices connected
to these points, writing to these points is prohibited. That is, I_:P accesses are read-only, as
opposed to I accesses which can be read or write.
I_:P accesses are also restricted to the size of inputs supported by a single CPU, SB, or SM,
rounded up to the nearest byte. For example, if the inputs of a 2 DI / 2 DQ SB are configured to
start at I4.0, then the input points can be accessed as I4.0:P and I4.1:P or as IB4:P. Accesses to
I4.2:P through I4.7:P are not rejected, but make no sense since these points are not used.
Accesses to IW4:P and ID4:P are prohibited since they exceed the byte offset associated with the
SB.
Accesses using I_:P do not affect the corresponding value stored in the input process image.
Q (process image output): The CPU copies the values stored in the output process image to the
physical output points. You can access the output process image in bits, bytes, words, or double
words. Both read and write access is permitted for process image outputs.
By appending a ":P" to the address, you can immediately write to the physical digital and analog
outputs of the CPU, SB, SM or distributed module. The difference between an access using Q_:P
instead of Q is that the data goes directly to the points being accessed in addition to the output
process image (writes to both places). This Q_:P access is sometimes referred to as an
"immediate write" access because the data is sent immediately to the target point; the target
point does not have to wait for the next update from the output process image.
Because the physical output points directly control field devices that are connected to these
points, reading from these points is prohibited. That is, Q_:P accesses are write-only, as opposed
to Q accesses which can be read or write.
Q_:P accesses are also restricted to the size of outputs supported by a single CPU, SB, or SM,
rounded up to the nearest byte. For example, if the outputs of a 2 DI / 2 DQ SB are configured to
start at Q4.0, then the output points can be accessed as Q4.0:P and Q4.1:P or as QB4:P. Accesses
to Q4.2:P through Q4.7:P are not rejected, but make no sense since these points are not used.
Accesses to QW4:P and QD4:P are prohibited since they exceed the byte offset associated with
the SB.
Accesses using Q_:P affect both the physical output as well as the corresponding value stored in
the output process image.
M (bit memory area): Use the bit memory area (M memory) for both control relays and data to
store the intermediate status of an operation or other control information. You can access the
bit memory area in bits, bytes, words, or double words. Both read and write access is permitted
for M memory.
Temp (temporary memory): The CPU allocates the temp memory on an as-needed basis. The
CPU allocates the temp memory for the code block and initializes the memory locations to 0 at
the time when it starts the code block (for an OB) or calls the code block (for an FC or FB).
Temp memory is similar to M memory with one major exception: M memory has a "global"
scope, and temp memory has a "local" scope:
• M memory: Any OB, FC, or FB can access the data in M memory, meaning that the data is
available globally for all of the elements of the user program.
• Temp memory: The CPU restricts access to the data in temp memory to the OB, FC, or FB that
created or declared the temp memory location. Temp memory locations remain local and
different code blocks do not share temp memory, even when the code block calls another
code block. For example: When an OB calls an FC, the FC cannot access the temp memory of
the OB that called it.
The CPU provides temp (local) memory for each OB priority level:
• 16 Kbytes for startup and program cycle, including associated FBs and FCs
• 6 Kbytes for each additional interrupt event thread, including associated FBs and FCs
You access temp memory by symbolic addressing only.
You can find out the amount of temp (local) memory that the blocks in your program use
through the call structure in STEP 7. From the project tree select Program info and then select the
Call structure tab. You will see all of the OBs in your program and you can drill down to see the
blocks that they call. For each block, you can see the local data allocation. You can also access
the Call structure display from the STEP 7 Tools > Call structure menu command.
DB (data block): Use the DB memory for storing various types of data, including intermediate
status of an operation or other control information parameters for FBs, and data structures
required for many instructions such as timers and counters. You can access data block memory
in bits, bytes, words, or double words. Both read and write access is permitted for read/write data
blocks. Only read access is permitted for read-only data blocks.
Note
When you specify an absolute address in LAD or FBD, STEP 7 precedes this address with a "%"
character to indicate that it is an absolute address. While programming, you can enter an
absolute address either with or without the "%" character (for example %I0.0 or I.0). If omitted,
STEP 7 supplies the "%" character.
In SCL, you must enter the "%" before the address to indicate that it is an absolute address.
Without the "%", STEP 7 generates an undefined tag error at compile time
The figure shows an example of a CPU 1214C with two SMs and one SB. In this example, you
could change the address of the DI8 module to 2 instead of 8. The tool assists you by changing
address ranges that are the wrong size or conflict with other addresses.
The calculation for determining engineering units from the analog input value in this example
is as follows:
Engineering units value = 50 + (Analog input value) * (100 - 50) / (27648 - 0)
For the general case, the equation would be:
Network 2
• Time and Date (Page 103): Time (32-bit IEC time value), Date (16-bit date value), TOD (32-bit
time-of-day value), DTL (12-byte date-and-time structure)
• Character and String (Page 105): Char (8-bit single character), String (variable-length string
of up to 254 characters)
• Array (Page 107)
• Data structure (Page 108): Struct
• PLC data type (Page 108)
• Variant data type (Page 109)
Although not available as data types, the following BCD numeric format is supported by the
conversion instructions:
See also
Supported data types (Page 781)
* The underscore "_" is a thousands separator to enhance readability for numbers greater than eight digits.
Calculations that involve a long series of values including very large and very small numbers can
produce inaccurate results. This can occur if the numbers differ by 10 to the power of x, where
x > 6 (Real), or 15 (LReal). For example (Real): 100 000 000 + 1 = 100 000 000.
Time
TIME data is stored as a signed double integer interpreted as milliseconds. The editor format can
use information for day (d), hours (h), minutes (m), seconds (s) and milliseconds (ms).
It is not necessary to specify all units of time. For example T#5h10s and 500h are valid.
The combined value of all specified unit values cannot exceed the upper or lower limits in
milliseconds for the Time data type (-2,147,483,648 ms to +2,147,483,647 ms).
Date
DATE data is stored as an unsigned integer value which is interpreted as the number of days
added to the base date 01/01/1990, to obtain the specified date. The editor format must specify
a year, month and day.
TOD
TOD (TIME_OF_DAY) data is stored as an unsigned double integer which is interpreted as the
number of milliseconds since midnight for the specified time of day (Midnight = 0 ms). The hour
(24hr/day), minute, and second must be specified. The fractional second specification is
optional.
DTL
DTL (Date and Time Long) data type uses a12 byte structure that saves information on date and
time. You can define DTL data in either the Temp memory of a block or in a DB. A value for all
components must be entered in the "Start value" column of the DB editor.
Each component of the DTL contains a different data type and range of values. The data type of a
specified value must match the data type of the corresponding components.
The following example defines a WString with maximum character count of 500 and current
character count of 300. This means the String currently contains 300 one-word characters, but
could be expanded to contain up to 500 one-word characters.
Total Charac‐ Current Char‐ Character 1 Characters Character ... Character 500
ter Count acter Count 2 to 299 300
500 300 'ä' (16#0084) ASCII character 'M' ... -
words (16#004D)
Word 0 Word 1 Word 2 Words 3 to 300 Word 301 ... Word 501
ASCII control characters can be used in Char, Wchar, String and WString data. The following table
shows examples of control character syntax.
Control char‐ ASCII Hex ASCII Hex val‐ Control function Examples
acters value (Char) ue (WChar)
$L or $l 16#0A 16#000A Line feed '$LText', '$0AText'
$N or $n 16#0A and 16#000A and Line break '$NText', '$0A
16#0D 16#000D The new line shows two char‐ $0DText'
acters in the string.
$P or $p 16#0C 16#000C Form feed '$PText', '$0CText'
$R or $r 16#0D 16#000D Carriage return (CR) '$RText','$0DText'
$T or $t 16#09 16#0009 Tab '$TText', '$09Text'
$$ 16#24 16#0024 Dollar sign '100$$', '100$24'
$' 16#27 16#0027 Single quote '$'Text$'','$27Text
$27'
Arrays
You can create an array that contains multiple elements of the same data type. Arrays can be
created in the block interface editors for OB, FC, FB, and DB. You cannot create an array in the
PLC tags editor.
To create an array from the block interface editor, name the array and choose data type "Array
[lo .. hi] of type", then edit "lo", "hi", and "type" as follows:
• lo - the starting (lowest) index for your array
• hi - the ending (highest) index for your array
• type - one of the data types, such as BOOL, SINT, UDINT
If a new PLC data type is created, then the new PLC type name will appear in the data type
selector drop-down lists in the DB editor and code block interface editor.
You can potentially use PLC data types in the following ways:
• As a data type in a code block interface or in data blocks
• As a template for the creation of multiple global data blocks that use the same data structure
• As a data type for PLC tag declarations the I and Q memory areas of the CPU
For example, a PLC data type could be a recipe for mixing colors. You can then assign this PLC
data type to multiple data blocks. You can adjust the variables within each data block to create a
specific color.
Note
Valid data types that can be accessed by slice are Byte, Char, Conn_Any, Date, DInt, DWord,
Event_Any, Event_Att, Hw_Any, Hw_Device, HW_Interface, Hw_Io, Hw_Pwm, Hw_SubModule,
Int, OB_Any, OB_Att, OB_Cyclic, OB_Delay, OB_WHINT, OB_PCYCLE, OB_STARTUP,
OB_TIMEERROR, OB_Tod, Port, Rtm, SInt, Time, Time_Of_Day, UDInt, UInt, USInt, and Word. PLC
Tags of type Real can be accessed by slice, but data block tags of type Real cannot.
Examples
In the PLC tag table, "DW" is a declared tag of type DWORD. The examples show bit, byte, and
word slice access:
Declaration
To overlay a parameter, declare an additional parameter directly after the parameter that is to be
overlaid and select the data type "AT". The editor creates the overlay, and you can then choose
the data type, struct, or array that you wish to use for the overlay.
Example
This example shows the input parameters of a standard-access FB. An array of Booleans is an
overlay for the byte tag B1:
Another example is a DWord tag overlaid with a Struct. The Struct includes a Word, Byte, and two
Booleans:
The Offset column of the block interface shows the location of the overlaid data types relative
to the original tag.
You can address the overlay types directly in the program logic:
Rules
• In FB and FC blocks with standard (not optimized) access, overlaying of tags is possible.
• In optimized FB and FC blocks, overlaying of tags is possible for any tags that are retentive.
• You can overlay parameters for all block types and all declaration sections.
• You can use an overlaid parameter like any other block parameter.
• You cannot overlay parameters of type VARIANT.
• The size of the overlaying parameter must be less than or equal to the size of the overlaid
parameter.
• You must declare the overlaying variable immediately after the variable that it overlays and
select the keyword "AT" as the initial data type selection.
Note
The CPU supports only the pre-formatted SIMATIC memory cards (Page 1356).
Before you copy any program to the formatted memory card, delete any previously saved
program from the memory card.
NOTICE
Protect memory card and receptacle from electrostatic discharge
Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap when you
handle the memory card. Store the memory card in a conductive container.
Check that the memory card is not write-protected. Slide the protection switch
away from the "Lock" position.
Note that if you do insert a write-protected memory card into the CPU, STEP 7
will display a diagnostic message on the next power up alerting you to that
fact. The CPU will power up without failure, but instructions involving recipes
or data logs, for example, will return errors if the card is write-protected.
WARNING
Verify that the CPU is not running a process before inserting the memory card.
If you insert a memory card (whether configured as a program card, transfer card, or firmware
update card) into a running CPU, the CPU goes immediately to STOP mode, which might cause
process disruption that could result in death or severe personal injury.
Before inserting or removing a memory card, always ensure that the CPU is not actively
controlling a machine or process. Always install an emergency stop circuit for your application
or process.
Note
Do not insert V3.0 program transfer cards into S7-1200 V4.x CPUs.
Version 3.0 program transfer cards are not compatible with version S7-1200 V4.x CPUs.
Inserting a memory card that contains a V3.0 program causes a CPU error.
If you do insert an invalid version program transfer card (Page 115), you should remove the card,
and perform a STOP to RUN transition, a memory reset (MRES), or cycle power. After you recover
the CPU from the error condition, you can download a valid V4.x CPU program.
To transfer a V3.0 program to a V4.x program, you must use the TIA Portal to Change Device in
the Hardware Configuration.
Note
If you insert a memory card with the CPU in STOP mode, the diagnostic buffer displays a message
that the memory card evaluation has been initiated. The CPU will evaluate the memory card the
next time you either change the CPU to RUN mode, reset the CPU memory with an MRES, or
power-cycle the CPU.
If you configured the CPU to "Disable copy from internal load memory to external load memory"
in the Protection properties of the device configuration, the CPU behaves as follows:
• Empty memory card: A blank memory card does not have a job file (S7_JOB.S7S). If you
insert a blank memory card, the CPU does nothing. It does not create a program job file and
it does not copy internal load memory to external load memory (the program file on the
memory card). It does not erase internal load memory.
• Blank program card: A blank program card has a program job file that is empty. In this case,
the CPU performs no action. It does not copy internal load memory to external load memory
(the program file on the memory card). It does not erase internal load memory.
If you insert a program card (Page 118), transfer card (Page 115), or card that contains a
firmware update (Page 123)into the CPU, the configuration setting for "Disable copy from
internal load memory to external load memory" has no effect on how the CPU evaluates the
memory card.
5.5.2 Configuring the startup parameter of the CPU before copying the project to
the memory card
When you copy a program to a transfer card or a program card, the program includes the startup
parameter for the CPU. Before copying the program to the memory card, always ensure that you
have configured the operating mode for the CPU following a power-cycle. Select whether the
CPU starts in STOP mode, RUN mode, or in the previous mode (prior to the power cycle).
NOTICE
Protect memory card and receptacle from electrostatic discharge
Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Handle the memory card safely through one or both of the following means:
• Make contact with a grounded conductive pad.
• Wear a grounded wrist strap whenever you handle the memory card.
Store the memory card in a conductive container.
NOTICE
Do NOT delete the hidden files "__LOG__" and "crdinfo.bin" from the memory card.
The "__LOG__" and "crdinfo.bin" files are required for the memory card. If you delete these
files, you cannot use the memory card with the CPU.
2. In the Project tree (Project view), expand the "SIMATIC Card Reader" folder and select your
card reader.
3. Display the "Memory card" dialog by right-clicking the drive letter corresponding to the
memory card in the card reader and selecting "Properties" from the context menu.
4. In the "Memory card" dialog, select "Transfer" from the "Card type" drop-down menu.
At this point, STEP 7 creates the empty transfer card. If you are creating an empty transfer
card, such as to recover from a lost CPU password (Page 126), remove the transfer card from
the card reader.
5. Add the program by selecting the CPU device (such as PLC_1 [CPU 1214C DC/DC/DC]) in the
Project tree and dragging the CPU device to the memory card. (Another method is to copy the
CPU device and paste it to the memory card.) Copying the CPU device to the memory card
opens the "Load preview" dialog.
6. In the "Load preview" dialog, click the "Load" button to copy the CPU device to the memory
card.
7. When the dialog displays a message that the CPU device (program) has been loaded without
errors, click the "Finish" button.
WARNING
Verify that the CPU is not actively running a process before inserting the memory card.
Inserting a memory card will cause the CPU to go to STOP mode, which could affect the
operation of an online process or machine. Unexpected operation of a process or machine
could result in death or injury to personnel and/or property damage.
Before inserting a transfer card, always ensure that the CPU is in STOP mode and your process
is in a safe state.
Note
Do not insert V3.0 program transfer cards into later model CPUs.
Version 3.0 program transfer cards are not compatible with later model S7-1200 CPUs. Inserting
a memory card that contains a V3.0 program causes a CPU error.
If you do insert an invalid version program transfer card, then remove the card, perform a STOP
to RUN transition, a memory reset (MRES), or cycle power. After you recover the CPU from the
error condition, you can download a valid CPU program
Note
You must remove the transfer card before setting the CPU to RUN mode.
NOTICE
Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap when you
handle the memory card. Store the memory card in a conductive container.
Check that the memory card is not write-protected. Slide the protection switch
away from the "Lock" position.
Before you copy any program elements to the program card, delete any pre‐
viously saved programs from the memory card.
Note
If you insert a blank memory card into the CPU and perform a memory card evaluation by either
power cycling the CPU, performing a STOP to RUN transition, or performing a memory reset
(MRES), the program and force values in internal load memory of the CPU are copied to the
memory card. (The memory card is now a program card.) After the copy has been completed,
the program in internal load memory of the CPU is then erased. The CPU then goes to the
configured startup mode (RUN or STOP).
Always remember to configure the startup parameter of the CPU (Page 115) before copying a
project to the program card. To create a program card, follow these steps:
1. Insert a blank SIMATIC memory card that is not write-protected into an SD card reader/writer
attached to your computer. (If the card is write-protected, slide the protection switch away
from the "Lock" position.)
If you are reusing a SIMATIC memory card that contains a user program, data logs, recipes,
or a firmware update, you must delete the files before reusing the card. Use Windows
Explorer to display the contents of the memory card and delete the following files and folders
if they exist:
– S7_JOB.S7S
– SIMATIC.S7S
– FWUPDATE.S7S
– DataLogs
– Recipes
– UserFles
NOTICE
Do NOT delete the hidden files "__LOG__" and "crdinfo.bin" from the memory card.
The "__LOG__" and "crdinfo.bin" files are required for the memory card. If you delete these
files, you cannot use the memory card with the CPU.
2. In the Project tree (Project view), expand the "Card Reader/USB memory" folder and select
your card reader.
3. Display the "Memory card" dialog by right-clicking the drive letter corresponding to the
memory card in the card reader and selecting "Properties" from the context menu.
4. In the "Memory card" dialog, select "Program" from the shortcut menu.
5. Add the program by selecting the CPU device (such as PLC_1 [CPU 1214C DC/DC/DC]) in the
Project tree and dragging the CPU device to the memory card. (Another method is to copy the
CPU device and paste it to the memory card.) Copying the CPU device to the memory card
opens the "Load preview" dialog.
6. In the "Load preview" dialog, click the "Load" button to copy the CPU device to the memory
card.
7. When the dialog displays a message that the CPU device (program) has been loaded without
errors, click the "Finish" button.
WARNING
Risks associated with inserting a program card
Verify that the CPU is not actively running a process before inserting the memory card.
Inserting a memory card will cause the CPU to go to STOP mode, which could affect the
operation of an online process or machine. Unexpected operation of a process or machine
could result in death or injury to personnel and/or property damage.
Before inserting a memory card, always ensure that the CPU is offline and in a safe state.
WARNING
Risks associated with removing a program card
If you remove the program card, the CPU loses its external load memory and generates an error.
The CPU goes to STOP mode and flashes the error LED.
Control devices can fail in an unsafe condition, resulting in unexpected operation of controlled
equipment. Such unexpected operations could result in death or serious injury to personnel,
and/or damage to equipment.
Do not remove the program card without understanding that you are removing the program
from CPU.
Note
Effect of write and delete operations on SIMATIC memory card service life
Write or delete operations, particularly repeated (cyclic) write/delete operations, reduce the
service life of the SIMATIC memory card.
Cyclic execution of the following actions reduces the service life of the memory card depending
on the number of write operations and data:
• Data Log Handling (for example, DataLogWrite)
• Recipe Handling (for example, RecipeExport)
• System Function Calls (SFCs) that write/delete to the file system (for example, WRIT_DBL,
CREATE)
• System Function Blocks (SFBs) that write/delete to file system (for example, FileWriteC,
FileDelete)
• Any other cyclic action that changes data on the persistent store (for example, Tracing, SET-
TimeZone)
5.5.5 Using a memory card for protecting confidential PLC configuration data
You can use a SIMATIC memory card to set or change the password for Protection of
confidential PLC configuration data.
NOTICE
Protect memory card and receptacle from electrostatic discharge
Electrostatic discharge can damage the memory card or the receptacle on the CPU. Make
contact with a grounded conductive pad and/or wear a grounded wrist strap whenever you
handle the memory card. Store the memory card in a conductive container.
NOTICE
Do not use the Windows formatter utility or any other formatting utility to reformat the
memory card.
If a SIMATIC memory card is reformatted using the Microsoft Windows formatter utility, the
memory will no longer be usable by a S7-1200 CPU.
How to create a memory card with the Protection of confidential PLC configuration data password
To create the memory card with this password, follow these steps:
1. Insert a blank SIMATIC memory card that is not write-protected into an SD card reader/writer
attached to your computer. If the card is write-protected, slide the protection switch away
from the "Lock" position.
You can reuse a SIMATIC memory card that contains a user program or firmware update, but
you must delete some of the files on the memory card. To reuse a memory card, you must
delete the "S7_JOB.S7S" file before creating the Protection of confidential PLC configuration
data file. Use Windows Explorer to display the contents of the memory card and to delete the
"S7_JOB.S7S" file and folders.
NOTICE
Do NOT delete the hidden files "__LOG__" and "crdinfo.bin" from the memory card.
The "__LOG__" and "crdinfo.bin" files are required for the memory card. If you delete these
files, you cannot use the memory card with the CPU.
2. Create a file on the root of the memory card called "S7_JOB.S7S". Open the file with a text
editor and type the following: SET_PWD.
3. Create a folder on the root of the memory card called: SET_PWD.S7S.
4. Under the "SET_PWD.S7S" folder, create a text file called "PWD.TXT". The file must be named
"PWD.TXT". Enter your Protection of confidential PLC configuration data password as the text
contents of the file. The file must contain a single line of text representing the Protection of
confidential PLC configuration data password. Follow the STEP 7 rules for passwords when
creating the password, using these characters:
– 0123456789
– A...Z a...z
– !#$%&()*+,-./:;<=>?@ [\]_{|}~^
5. To clear the Protection of confidential PLC configuration data password on the PLC, the file
must be empty.
6. Safely eject the card from the card reader/writer.
NOTICE
Verify that the CPU is not actively running a process before setting the Protection of
confidential PLC configuration data password.
Setting the Protection confidential PLC configuration data password can cause the existing PLC
Program not to load. Before inserting the memory card, always ensure that the CPU is offline
and in a safe state.
1. Insert the memory card into the CPU. If the CPU is in RUN mode, the CPU then goes to STOP
mode. The maintenance (MAINT) LED flashes to indicate the memory card needs to be
evaluated.
2. Power cycle the CPU to start the process. After the CPU reboots, the setting of the Protection
of confidential PLC configuration data password occurs. When the RUN/STOP LED turns on
(solid yellow) and the MAINT LED flashes, the process has finished. You must then remove the
memory card.
3. After removing the memory card, reboot the CPU again to start using the new Protection of
confidential PLC configuration data password.
If the existing user program requires a different Protection of confidential PLC configuration data
password, it will not load after restarting. You must clear the existing program and download a
program that uses the Protection of confidential PLC configuration data password that you set in
the previous steps.
If the existing program requires the provided Protection of confidential PLC configuration data
password, the PLC can go to RUN based on the project configuration.
You can use a SIMATIC memory card for performing a firmware update.
NOTICE
Protect memory card and receptacle from electrostatic discharge
Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap whenever
you handle the memory card. Store the memory card in a conductive container.
You use a SIMATIC memory card when downloading firmware updates from Siemens Industry
Online Support (https://support.industry.siemens.com). From this Web site, navigate to
"Downloads". From there search for the specific type of module that you need to update.
Alternatively, you can access the S7-1200 downloads Web page (https://
support.industry.siemens.com/cs/ww/en/ps/13683/dl) directly.
Note
You cannot update an S7-1200 CPU V3.0 or earlier to S7-1200 V4.0 (or later) by firmware update.
NOTICE
Do not use the Windows formatter utility or any other formatting utility to reformat the
memory card.
If a Siemens memory card is reformatted using the Microsoft Windows formatter utility, then
the memory card will no longer be usable by a S7-1200 CPU.
To download the firmware update to your memory card, follow these steps:
1. Insert a blank SIMATIC memory card that is not write-protected into an SD card reader/writer
attached to your computer. (If the card is write-protected, slide the protection switch away
from the "Lock" position.)
You can reuse a SIMATIC memory card that contains a user program or another firmware
update. To avoid any confusion, you should also delete files S7_JOB.SYS, SIMATIC.S7S, and
FWUPDATE.S7S if they exist.
NOTICE
Do NOT delete the hidden files "__LOG__" and "crdinfo.bin" from the memory card.
The "__LOG__" and "crdinfo.bin" files are required for the memory card. If you delete these
files, you cannot use the memory card with the CPU.
2. Select the zip file for the firmware update that corresponds to your module, and download it
to your computer. Double-click the file, set the file destination path to be the root directory
of the SIMATIC memory card, and start the extraction process. After the extraction is
complete, the root directory (folder) of the memory card will contain a "FWUPDATE.S7S"
directory and the "S7_JOB.S7S" file.
3. Safely eject the card from the card reader/writer.
WARNING
Verify that the CPU is not actively running a process before installing the firmware update.
Installing the firmware update will cause the CPU to go to STOP mode, which could affect the
operation of an online process or machine. Unexpected operation of a process or machine
could result in death or injury to personnel and/or property damage.
Before inserting the memory card, always ensure that the CPU is offline and in a safe state.
1. Insert the memory card into the CPU. If the CPU is in RUN mode, the CPU then goes to STOP
mode. The maintenance (MAINT) LED flashes to indicate that the memory card needs to be
evaluated.
2. Power-cycle the CPU to start the firmware update. Alternative methods for rebooting the CPU
are to perform either a STOP-to-RUN transition or a memory reset (MRES) from STEP 7.
Note
To complete the firmware upgrade for the module, you must ensure that the external 24 V DC
power to the module remains on.
After the CPU reboots, the firmware update starts. The RUN/STOP LED alternately flashes
green and yellow to indicate that the update is being copied. When the RUN/STOP LED turns
on (solid yellow) and the MAINT LED flashes, the copy process has finished. You must then
remove the memory card.
3. After removing the memory card, reboot the CPU again (either by restoring power or by the
alternative methods for rebooting) to load the new firmware.
The user program and hardware configuration are not affected by the firmware update. When
the CPU is powered up, the CPU enters the configured start-up state. (If the startup mode for your
CPU was configured to "Warm restart - mode before POWER OFF", the CPU will be in STOP mode
because the last state of the CPU was STOP.)
During update, the firmware update procedure ignores UPD files that do not correspond to any
station hardware modules. This allows you to create a master firmware update memory card to
update all S7-1200 CPU stations in your facility. No Diagnostics buffer entry is made to identify
the ignored UPD files. This prevents the Diagnostics buffer from being clogged with extraneous,
mostly meaningless entries that might hide the update operation entries of interest to you. For
example, a Diagnostics buffer entry is made if firmware update attempts are made, whether
successful or not. You can then easily scan the Diagnostics buffer for any unexpected anomalies
without the noise of extraneous entries.
All firmware update attempts are logged in the Diagnostics buffer regardless of success. For
example, if a firmware update operation succeeds, a Diagnostics buffer message to that effect is
logged. Likewise, if a firmware update operation fails, that is also logged with a corresponding
explanation.
Only one UPD file of an MLFB (order number) identification is allowed on a firmware update card.
For example, if the updater finds UPD files with duplicate MLFBs on the firmware update card, a
firmware update is not performed and a Diagnostics buffer entry indicates this condition. This
could happen if the UPD files were the same MLFB, but different versions.
WARNING
Verify that the CPU is not actively running a process before inserting the memory card
If you insert a transfer card in a running CPU, the CPU goes to STOP. Control devices can fail in
an unsafe condition, resulting in unexpected operation of controlled equipment. Such
unexpected operations could result in death or serious injury to personnel, and/or damage to
equipment.
Before inserting a transfer card, always ensure that the CPU is in STOP mode and your process
is in a safe state.
You must remove the transfer card before setting the CPU to RUN mode.
Configuration control
Device configuration for the S7‑1200 also supports "configuration control (Page 132)" where
you can configure a maximum configuration for a project including modules that you might not
actually use. This feature, sometimes also called "option handling", allows you to configure a
maximum configuration that you might use with variations in the installed modules in multiple
applications.
• In the Project view, under the project name, double-click "Add new device".
From the "Add new device" dialog, select the correct model and firmware version from the list.
Clicking the CPU in the Device view displays the CPU properties in the inspector window.
You can assign an IP address for the CPU during the device configuration. If your CPU is
connected to a router on the network, you also enter the IP address for a router.
4. From the Online menu of STEP 7, select the "Upload device as new station (hardware and
software)" menu command.
STEP 7 uploads both the hardware configuration and the program blocks.
From the device configuration editor, you select the option for detecting the configuration of
the connected device.
After you select the CPU from the online dialog and click the Load button, STEP 7 uploads the
hardware configuration from the CPU, including any modules (SM, SB, or CM). You can then
configure the parameters for the CPU and the modules (Page 143).
device configuration and download the hardware configuration to the CPU for the modules to be
functional.
SB, BB or
CB
CM or CP
With the "configuration control" feature (Page 132), you can add signal modules and signal
boards to your device configuration that might not correspond to the actual hardware for a
specific application, but that will be used in related applications that share a common user
program, CPU model, and perhaps some of the configured modules.
4. Create a PLC data type to contain the control data record. Configure it as a struct that includes
four USints for configuration control information and additional USints to correspond to the
slots of a maximum S7‑1200 device configuration, as follows:
5. Create a data block of the PLC data type that you created.
6. In this data block, configure the Block_length, Block_ID, Version, and Subversion as shown
below. Configure the values for the slots based on their presence or absence and position in
your actual installation:
– 0: Configured module is not present in the actual configuration. (The slot is empty.)
– 1 to 9, 101 to 103: The actual slot position for the configured slot
– 255: The STEP 7 device configuration does not include a module in this slot.
Note
Configuration control not available for HSCs and PTOs on the signal board
If you have a signal board in the CPU that you configure for HSCs or PTOs, you must not disable
it with a "0" in Slot_1 of the configuration control data record. Configured HSC and PTO
devices of the CPU are mandatory regarding configuration control.
See Example of configuration control (Page 139) for an explanation of how to assign the slot
values.
7. In the startup OB, call the extended WRREC (Write data record) instruction to transfer the
control data record that you created to index 196 of hardware ID 33. Use a label and JMP
(jump) instruction to wait for the WRREC instruction to complete.
Network 1:
Network 2:
Note
Configuration control is not in effect until the WRREC instruction transfers the control data record
in the startup OB. If you have enabled configuration control and the CPU does not have the
control data record, it will go to STOP mode when it exits STARTUP mode. Be sure that you
program the startup OB to transfer the control data record.
Module arrangement
The following table shows the slot number assignment:
Slot Modules
1 Signal board or communication board (CPU annex card)
2 to 9 Signal modules
101 to 103 Communication modules
*Slot values:
0: Configured module is not present in the actual configuration. (The slot is empty.)
1 to 9, 101 to 103: The actual slot position for the configured slot
255: The STEP 7 device configuration does not include a module in this slot.
Note
Alternative to creating a PLC tag type
As an alternative to creating a custom PLC tag type, you can create a data block directly with all
of the structure elements of a control data record. You could even configure multiple structs in
this data block to serve as multiple control data record configurations. Either implementation is
an effective way to transfer the control data record during startup.
Rules
Observe the following rules:
• Configuration control does not support position changes for communication modules. Also,
you cannot use configuration control to deactivate communication modules. The control
data record slot positions for slots 101 to 103 must correspond to the actual installation. If
you have not configured a module for the slot in your device configuration, enter 255 for that
slot position in the control data record. If you have configured a module for the slot, enter the
configured slot as the actual slot for that slot position.
• F-I/O modules do not support configuration control. The control data record slot positions for
an F-I/O module must equal the configured slot position for the F-I/O module. If you attempt
to move or delete a configured F-I/O module using the control data record, then all actually-
installed F-I/O modules will raise a "parameter assignment" error and disallow exchange.
• You cannot have embedded empty (unused) slots between filled (used) slots. For example,
if the actual configuration has a module in slot 4, then the actual configuration must also
have modules in slots 2 and 3. Correspondingly, if the actual configuration has a
communication module in slot 102, then the actual configuration must also have a module
in slot 101.
• If you have enabled configuration control, the CPU is not ready for operation without a
control data record. The CPU returns from startup to STOP if a startup OB does not transfer
a valid control data record. The CPU does not initialize the central I/O in this case and enters
the cause for the STOP mode in the diagnostics buffer.
• The CPU saves a successfully-transferred control data record in retentive memory, which
means that it is not necessary to write the control data record 196 again at a restart if you
have not changed the configuration.
• Each real slot must be present only once in the control data record.
• You can only assign a real slot to one configured slot.
Note
Modifying a configuration
The writing of a control data record with a modified configuration triggers the following
automatic reaction by the CPU: Memory reset with subsequent startup with this modified
configuration.
As a result of this reaction, the CPU deletes the original control data record and saves the new
control data record retentively.
Error messages
The CPU returns the following error messages if an error occurs during writing of the control data
record:
Figure 6-1 Device configuration of maximum installation with three signal modules
Figure 6-2 Actual installation with module configured in slot 3 absent, and module configured for slot
4 in actual slot 3
To indicate the absence of the missing module, you must configure slot 3 in the control data
record with 0.
Figure 6-3 Device configuration compared to actual installation with modules in slots 3 and 4 swapped
To correlate the device configuration to the actual installation, edit the control data record to
assign the modules to the correct slot positions.
6.6.1 Overview
To configure the operational parameters for the CPU, select the CPU in the Device view (blue
outline around whole CPU), and use the "Properties" tab of the inspector window.
Property Description
PROFINET interface Sets the IP address for the CPU and time synchronization
DI, DO, and AI Configures the behavior of the local (onboard) digital and analog I/O (for example, digital input
filter times and digital output reaction to a CPU stop).
High-speed counters Enables and configures the high-speed counters (HSC) and the pulse generators used for pulse-
(Page 511) and pulse gener‐ train operations (PTO) and pulse-width modulation (PWM)
ators (Page 447) When you configure the outputs of the CPU or signal board as pulse generators (for use with the
PWM or motion control instructions), the corresponding output addresses are removed from the
Q memory and cannot be used for other purposes in your user program. If your user program
writes a value to an output used as a pulse generator, the CPU does not write that value to the
physical output.
Property Description
Startup (Page 68) Startup after POWER ON: Selects the behavior of the CPU following an off-to-on transition,
such as to start in STOP mode or to go to RUN mode after a warm restart
Supported hardware compatibility: Configures the substitution strategy for all system com‐
ponents (SM, SB, CM, CP and CPU):
• Allow acceptable substitute
• Allow any substitute (default)
Each module internally contains substitution compatibility requirements based on the number
of I/O, electrical compatibility, and other corresponding points of comparison. For example, a
16-channel SM could be an acceptable substitute for an 8-channel SM, but an 8-channel SM
could not be an acceptable substitute for a 16-channel SM. If you select "Allow acceptable
substitute", STEP 7 enforces the substitution rules; otherwise, STEP 7 allows any substitution.
Parameter assignment time for distributed I/O: Configures a maximum amount of time (de‐
fault: 60000 ms) for the distributed I/O to be brought online. (The CMs and CPs receive power
and communication parameters from the CPU during startup. This assignment time allows time
for the I/O connected to the CM or CP to be brought online.)
The CPU goes to RUN as soon as the distributed I/O is online, regardless of the assignment time.
If the distributed I/O has not been brought online within this time, the CPU still goes to RUN--
without the distributed I/O.
Note: If your configuration uses a CM 1243-5 (PROFIBUS master), do not set this parameter
below 15 seconds (15000 ms) to ensure that the module can be brought online.
OBs should be interruptible: Configures whether OB execution (for all OBs) in the CPU
is interruptible or non-interruptible (Page 83)
Cycle (Page 86) Defines a maximum cycle time or a fixed minimum cycle time
Communication load Allocates a percentage of the CPU time to be dedicated to communication tasks
System and clock memory Enables a byte for "system memory" functions and enables a byte for "clock memory" functions
(Page 90) (where each bit toggles on and off at a predefined frequency)
Web server (Page 803) Enables and configures the Web server feature
Time of day Selects the time zone and configures daylight saving time
Multilingual support Assigns a project language for the Web server to use for displaying diagnostic buffer entry texts
(Page 147) for each of the possible Web server user interface display languages.
Protection (Page 152) Sets the read/write protection and passwords for accessing the CPU
Configuration control Enables configuring a master device configuration that you can control for different actual
(Page 132) device configurations
Connection resources Provides a summary of the communication connection resources that are available for the CPU
(Page 561) and the number of connection resources that have been configured
Overview of addresses Provides a summary of the I/O addresses that have been configured for the CPU
than approximately 6.4 ms is not detected. If an input signal switches between ‘0’ and ‘1’ more
rapidly than the filter time, the input point value can change in the user program when the
accumulated duration of new value pulses over old value pulses exceeds the filter time.
The digital input filter works this way:
• When a "1" is input, it counts up, stopping at the filter time. The image register point changes
from "0" to "1" when the count reaches the filter time.
• When a "0" is input, it counts down, stopping at "0". The image register point changes from
"1" to "0" when the count reaches "0".
• If the input is changing back and forth, the counter will count up some and count down
some. The image register will change when the net accumulation of counts reaches either
the filter time or "0".
• A rapidly-changing signal with more "0’s" than "1’s" will eventually go to "0", and if there are
more "1’s" than "0’s", the image register will eventually change to "1".
Each input point has a single filter configuration that applies to all uses: process inputs,
interrupts, pulse catch, and HSC inputs. To configure input filter times, select "Digital Inputs".
The default filter time for the digital inputs is 6.4 ms. You can select a filter time from the Input
filters drop-down list. Valid filter times range from 0.1 us to 20.0 ms.
WARNING
Risks with changes to filter time for digital input channel
If you change the filter time for a digital input channel from a previous setting, a new "0" level
input value may need to stay at "0" for up to 20.0 ms before the filter becomes fully responsive
to new inputs. During this time, short "0" pulse events of duration less than 20.0 ms may not
be detected or counted.
This changing of filter times can result in unexpected machine or process operation, which may
cause death or serious injury to personnel, and/or damage to equipment.
To ensure that a new filter time goes immediately into effect, a power cycle of the CPU must be
applied.
6FDQF\FOH 1H[WVFDQF\FOH
,QSXWXSGDWH ,QSXWXSGDWH
3K\VLFDOLQSXW
IRUH[DPSOH,
2XWSXWIURPSXOVHFDWFK 7KH&38FDWFKHVWKLVSXOVHRQWKHSK\VLFDOLQSXW
(QDEOHG
3URFHVV,PDJH8SGDWH,
6FDQF\FOH 1H[WVFDQF\FOH
,QSXWXSGDWH ,QSXWXSGDWH
3K\VLFDOLQSXW
IRUH[DPSOH,
7KH&38PLVVHVWKLVSXOVHEHFDXVHWKHLQSXW
2XWSXWIURPSXOVHFDWFK WXUQHGRQDQGRIIEHIRUHWKH&38XSGDWHGWKH
SURFHVVLPDJHLQSXWUHJLVWHU
'LVDEOHG
3URFHVV,PDJH8SGDWH,
Note
Because the pulse catch function operates on the input after it passes through the input filter,
you must adjust the input filter time so that the filter does not remove the pulse.
The figure below shows a block diagram of the digital input circuit:
The figure below shows the response of an enabled pulse catch function to various input
conditions. If you have more than one pulse in a given scan, only the first pulse is read. If you
have multiple pulses in a given scan, you should use the rising/falling edge interrupt events:
6FDQF\FOH 1H[WVFDQF\FOH
,QSXWXSGDWH ,QSXWXSGDWH
,QSXWWRSXOVHFDWFK
2XWSXWIURPSXOVHFDWFK
,QSXWWRSXOVHFDWFK
2XWSXWIURPSXOVHFDWFK
,QSXWWRSXOVHFDWFK
2XWSXWIURPSXOVHFDWFK
The Web server can use one or two of the STEP 7 project languages for the display of diagnostic
buffer messages.
In the Multilingual support properties, the user interface languages on the right are not editable.
They are the pre-defined languages that are available for both the TIA Portal and for the Web
server user interfaces. The "Assign project language" setting is configurable and can be one of
two of your configured project languages, or it can be "None". Because the S7-1200 CPU only
supports two project languages, you cannot configure the project language to be the same as
the user interface language for all of the supported user interface languages.
In the configuration below, the Web server displays diagnostic buffer entries (Page 825) in
German when the Web server user interface is German, displays no texts for diagnostic buffer
events when the Web server user interface is Spanish, and displays diagnostic buffer entries in
English for all other languages.
You can also configure the mode for PG/PC and HMI communication (Page 155) in the
connection mechanisms in the device configuration of the CPU.
Overview
The overview selection of the security wizard displays your settings for the following areas:
• Protection of confidential PLC data (Page 150)
• Mode for PG/PC and HMI communication (Page 155)
• PLC access protection (Page 152)
Review your settings and use the Back button if necessary to make changes. When you are
satisfied with your settings, click "Finish". STEP 7 stores your settings in the project.
Launching the security wizard from the device configuration of the CPU
You can also launch the security wizard for a V4.5 or higher CPU from the device configuration
of the CPU in the Protection & Security section.
Security wizard
You can also use the security wizard (Page 149) to enable this feature and set the password. The
security wizard launches when you first insert a V4.5 or higher CPU. You can also launch the
security wizard from the Protection & Security section of the device configuration.
Encryption:
You enable the "Protection of confidential PLC configuration data" in the TIA Portal and set a pass‐
word. This password is the means to protect the confidential PLC configuration data.
Decryption:
You download the project to the CPU or alternatively load the project from a memory card
(Page 121).
The CPU can now read (unlock) project files.
The password encryption in the project and the subsequent decryption in the CPU thus provide
a high degree of protection for your confidential PLC configuration data.
① Project with password-protected confidential data on the memory card of the CPU
② Key information, generated from the password, in the memory area of the CPU that enables
access to the protected confidential configuration data.
Note
Responsibility for CPUs
If you have configured and downloaded protection for confidential PLC configuration data to a
CPU, securely dispose of the CPU when you decommission it.
If you have configured and downloaded protection for confidential PLC configuration data to a
CPU and you later download a project to the CPU where the firmware version of the CPU in the
STEP 7 project is earlier than V4.5, the CPU still contains the encrypted protection. If you
decomission this CPU, securely dispose of it.
Securely disposing of decommissioned CPUs protects against third parties gaining access to the
protected confidential configuration data.
Online tools
When the CPU is online, you can also set, delete, or change the password for "protection of
confidential PLC configuration data" from the online and diagnostics tools (Page 1145).
Additional information
For additional information on the functionality and implementation, refer to the "Secure
Communication" chapter in the TIA Portal Information System.
See also
Replacing a CPU that has protection of confidential configuration data (Page 1379)
Note that you can set an emergency (temporary) IP address (Page 769) for the CPU at any
security level.
Passwords are case-sensitive. To configure the protection level and passwords, follow these
steps:
1. In the "Device configuration", select the CPU.
2. In the inspector window, select the "Properties" tab.
3. Select the "Protection & Security" property to select the access level and to enter passwords.
V4.5 of the S7-1200 CPU supports improved storage of access level passwords. When changing
an S7-1200 CPU to V4.5, the "Update password encryption" button upgrades the storage format
of existing access level passwords.
When you download this configuration to the CPU, the user has HMI access and can access HMI
functions without a password. To read data or compare Offline/Online code blocks, the user must
enter the configured password for "Read access" or the password for "Full access (no protection)".
To write data, the user must enter the configured password for "Full access (no protection)". For
full access to fail-safe CPUs, the user must enter the configured password for "Full access incl. fail-
safe (no protection)".
WARNING
Unauthorized access to a protected CPU
Users with CPU full access or full access (incl. fail-safe) privileges have privileges to read and
write PLC variables. Regardless of the access level for the CPU, Web server users can have
privileges to read and write PLC variables. Unauthorized access to the CPU or changing PLC
variables to invalid values could disrupt process operation and could result in death, severe
personal injury and/or property damage.
Authorized users can perform operating mode changes, writes to PLC data, and firmware
updates. Siemens recommends that you observe the following security practices:
• Password protect CPU access levels and Web server user IDs (Page 808) with strong
passwords.
• Strong passwords are at least twelve characters, are not trivial or easy to guess, and include
at least three of the following:
– Uppercase letters
– Lowercase letters
– Digits
– Special characters
• A trivial password is one that is easy to guess. It is usually based on a characteristic of the
user, such as a pet’s name, family name, or the company where the user works. For
example: Siemens1$, June2015, or Qwerty1234.
• Best practices for generating strong but easy-to-remember passwords include the use of
meaningless short sentences and mixing several random words. For example:
PC;House#R3d
• Enable access to the Web server only with the HTTPS protocol.
• Do not extend the default minimum privileges of the Web server "Everybody" user.
• Perform error-checking and range-checking on your variables in your program logic
because Web page users can change PLC variables to invalid values.
Connections for which the local CPU is only a server (meaning that no configuration/
programming of the communication with the communication partner exists at the local CPU),
are therefore not possible during operation of the CPU, for example:
• PUT/GET, FETCH/WRITE or FTP access through communication modules
• PUT/GET access from other S7 CPUs
• HMI access through PUT/GET communication
If you want to allow access to CPU data from the client side, that is, you do not want to restrict
the communication services of the CPU, follow these steps:
1. Configure the protection access level to be any level other than "No access (complete
protection)".
2. Select the "Permit access with PUT/GET communication" check box.
When you download this configuration to the CPU, the CPU permits PUT/GET communication
from remote partners
6.8.4.2 Enabling secure PG/PC and HMI communication and creating certificates
Use the "Connection mechanisms" in the device configuration of your CPU to configure whether
the CPU accepts only secure communication or accepts both secure and legacy communication.
Secure communication uses X.509 certificates over TLS (Transport Layer Security) 1.3. The CPU
uses these certificates to provide secure communication between the CPU and clients. Clients
include:
• TIA Portal
• SIMATIC Automation Tool
• HMIs
Select "Permit only secure PG/PC and HMI communication" to disable legacy PG/PC and HMI
communication.
You can also create your own certificates. Click "..." next to "PLC communication certificate" to
add a new certificate for the CPU or to select an existing certificate. Refer to the topic "Create /
renew certificates" in the TIA Portal Information System for details about certificate
configuration parameters.
The configuration sections within "Protection & Security" of the device configuration provide on-
screen guidance about your security choices. These sections also provide links to topics in the
TIA Portal Information System for each configuration task and the related security concepts.
Legacy communication
If you need to communicate with a device that does not support secure communication,
deselect "Permit only secure PG/PC and HMI communication". This selection enables your PLC to
communicate using either secure communication or legacy communication (Page 556).
TIA Portal V17 and later defaults to the highest level of secure communications; however, for
commissioning reasons you can force the TIA Portal to use legacy PG/PC communications by
selecting "Use only legacy PG/PC communication" from the Online menu.
Security wizard
You can also use the security wizard (Page 149) to configure PG/PC and HMI communication for
V4.5 and higher CPUs.
Use the "Properties" task card of the code block to bind the block to a specific CPU or memory
card.
1. After opening the code block, select "Protection".
2. From the drop-down list under "Copy protection" task, select the type of copy protection that
you want to use.
3. For binding to the serial number of a CPU or memory card, select either to insert the serial
number when downloading, or enter the serial number for the memory card or CPU.
Note
The serial number is case-sensitive.
For dynamic binding with mandatory password, define the password that you must use to
download or copy the block.
When you subsequently download (Page 188) a block with dynamic binding, you must enter
the password to be able to download the block. Note that the copy protection password and
the know-how protection (Page 156) password are two separate passwords.
Note
To make a connection to your CPU, your network interface card (NIC) and the CPU must be on
the same class of network and on the same subnet. You can either set up your network interface
card to match the default IP address of the CPU, or you can change the IP address of the CPU to
match the network class and subnet of your network interface card.
Refer to "Assigning Internet Protocol (IP) addresses" (Page 568) for information about how to
accomplish this.
In the case of the S7-1200 and its local base components, only the CPU and some of the CP
modules have time‑of‑day clocks that might need to be synchronized. You can configure the
CPU’s time‑of‑day clock to be synchronized to an external master clock. The external master
clock might supply the time of day using an NTP server or through a CP in the local rack of the
S7-1200 that is connected to a SCADA system that includes a master clock.
Refer to S7-1200 CPs (https://support.industry.siemens.com/cs/us/en/ps) at Siemens Industry
Online Support, Product Support for further information on all S7-1200 CPs that support the
Time sychronization function.
By default, neither time synchronization using the NTP server nor time synchronization of the CP
clocks to the CPU’s clock is enabled.
You configure time synchronization of the CPU’s clock and time synchronization of the CP clocks
independently. Consequently, you can enable time synchronization of the CP clocks by the CPU
when the CPU’s clock is set by any of the above-mentioned methods.
You can select the update interval using the NTP server. The update interval of the NTP server is
set to 10 seconds by default.
When you activate time synchronization in a module, STEP 7 prompts you to select the "CPU
synchronizes the modules of the device." if you have not already selected the check box in the
CPU’s "Time synchronization" dialog. STEP 7 also warns you if you configured more than one
master clock source for time synchronization (for example, you activated time synchronization
on more than one CP or on both the CPU and a module).
Note
Activating time synchronization on a CP causes the CP to set the CPU’s clock.
If you select "CPU synchronizes the modules of the device" in the CPU "Time synchronization"
dialog, then the CPU is the time master. The CP modules then synchronize to the CPU’s clock.
Note
Only configure one time source for the CPU. Receiving time synchronizations for the CPU from
more than one source (NTP server or CP module, for example) could cause conflicting time
updates. Time synchronizations from multiple sources could adversely affect instructions and
events based on time of day.
)&
By creating generic code blocks that can be reused within the user program, you can simplify the
design and implementation of the user program. Using generic code blocks has a number of
benefits:
• You can create reusable blocks of code for standard tasks, such as for controlling a pump or
a motor. You can also store these generic code blocks in a library that can be used by
different applications or solutions.
• When you structure the user program into modular components that relate to functional
tasks, the design of your program can be easier to understand and to manage. The modular
components not only help to standardize the program design, but can also help to make
updating or modifying the program code quicker and easier.
• Creating modular components simplifies the debugging of your program. By structuring the
complete program as a set of modular program segments, you can test the functionality of
each code block as it is developed.
• Creating modular components that relate to specific technological functions can help to
simplify and reduce the time involved with commissioning the completed application.
calling block. Processing continues with execution of the instruction that follows after the block
call.
࿆ ࿇ A Calling block
2%)%)& 2%)%)&
B Called (or interrupting) block
ི
① Program execution
② Instruction or event that initiates the execution of
another block
ཱ
③ Program execution
④ Block end (returns to calling block)
ཱི
You can nest the block calls for a more modular structure. In the following example, the nesting
depth is 3: the program cycle OB plus 3 layers of calls to code blocks.
ཱ ① Start of cycle
② Nesting depth
2% )% )&
'%
'% '%
)& '%
Note: The maximum nesting depth is six. Safety programs use two nesting levels. The user program
therefore has a nesting depth of four in safety programs.
You can create other OBs to perform specific functions, such as for handling interrupts and
errors, or for executing specific program code at specific time intervals. These OBs interrupt the
execution of the program cycle OBs.
Use the "Add new block" dialog to create new OBs in your user program.
The CPU determines the order for handling interrupt events by priority. You can assign multiple
interrupt events to the same priority class. For more information, refer to the topics on
organization blocks (Page 72) and execution of the user program (Page 65).
Note
Note that you can assign a process image part number to an OB that corresponds to PIP0, PIP1,
PIP2, PIP3, or PIP4. If you enter a number for the process image part number, the CPU creates that
process image partition. See the topic "Execution of the user program (Page 65)" for an
explanation of the process image partitions.
'%
2%
)%
'%
)%'%
)%'%
)%'%
'%
In this example, FB 22 controls three separate devices, with DB 201 storing the operational data
for the first device, DB 202 storing the operational data for the second device, and DB 203 storing
the operational data for the third device.
You can also modify and download data blocks in RUN mode (Page 1167).
Note
Block access type for an FB and its instance DB
Be sure that if your FB setting is "Optimized block access" then the setting of the instance DB for
that FB is also "Optimized block access". Similarly if you have not selected "Optimized block
access" for the FB such that the FB is of type standard access, then be sure that the instance DB
is also standard, or not optimized block access.
If you do not have compatible block access types, then changes to the IN/OUT parameter values
of the FB from an HMI during execution of the FB could be lost.
You can store objects you want to reuse in libraries. For each project, there is a project library that
is connected to the project. In addition to the project library, you can create any number of global
libraries that can be used over several projects. Since the libraries are compatible with each
other, library elements can be copied and moved from one library to another.
Libraries are used, for example, to create templates for blocks that you first paste into the project
library and then further develop there. Finally, you copy the blocks from the project library to a
global library. You make the global library available to other colleagues working on your project.
They use the blocks and further adapt them to their individual requirements, where necessary.
For details about library operations, refer to the STEP 7 online Help library topics.
Call-by-value
When the user program passes a parameter to a function as "call-by-value", the user program
copies the actual parameter value into the input parameter of the block for the IN interface type.
This operation requires additional memory for the copied value.
FC / FB
„My_int“
IN
value: 31
value: 31
When the user program calls the block, it copies the values.
Call-by-reference
When the user program passes a parameter to a function as "call-by-reference", the user program
references the address of the actual parameter for the IN/OUT interface type and does not copy
the value. This operation does not require additional memory.
FC / FB
"My_string"
IN/OUT
value: 'test'
Reference to "My_string"
When the user program calls the block, it references the address of the actual parameters.
Note
Generally, use the IN/OUT interface type for structured tags (for example, ARRAY, STRUCT, and
STRING) in order to avoid increasing the required data memory unnecessarily.
elements within the DB is different for optimized versus non-optimized DBs. Refer to the
"Optimized blocks" section of the S7‑Programming Guideline for S7‑1200/1500, STEP 7 (TIA
Portal), 03/2014 (https://support.automation.siemens.com/WW/view/en/81318674) for a
discussion of optimized blocks.
You create FBs and FCs to process either optimized or non-optimized data. You can select the
"Optimized block access" check box as one of the attributes for the block. The user program
optimizes program blocks by default, and the program blocks expect data passed to the block to
be in the optimized format.
When the user program passes a complex parameter (for example, a STRUCT) to a function, the
system checks the optimization setting of the data block containing the structure and the
optimization setting of the program block. If you optimize both the data block and the function,
then the user program passes the STRUCT as a "call-by-reference". The same is true if you select
non-optimized for both the data block and the function.
However, if you make the function and data block optimization different (meaning that you
optimized one block and not the other block), the STRUCT must be converted to the format
expected by the function. For example, if you select non-optimized for the data block and
optimized for the function, then a STRUCT in the data block must be converted to an optimized
format before the function can process the STRUCT. The system does this conversion by making
a "copy" of the STRUCT and converting it to the optimized format that the function expects.
In summary, when the user program passes a complex data type (for example, a STRUCT) to a
function as an IN/OUT parameter, the function expects the user program to pass the STRUCT as
a "call-by-reference":
• If you select optimized or non-optimized for both the data block containing the STRUCT and
the function, the user program passes the data as "call-by-reference".
• If you do not configure the data block and the function with the same optimization settings
(one is optimized and the other is non-optimized), the system must make a copy of the
STRUCT before passing it to the function. Because the system has to make this copy of the
structure, this converts the "call-by-reference", effectively, into a "call-by-value".
Note
The use of the DIS_AIRT instruction delays the processing of interrupt OBs until the EN_AIRT
instruction is executed, affecting the interrupt latency (time from an event to the time when the
interrupt OB is executed) of your user program.
To create the logic for complex operations, you can insert branches to create the logic for parallel
circuits. Parallel branches are opened downwards or are connected directly to the power rail. You
terminate the branches upwards.
LAD provides "box" instructions for a variety of functions, such as math, timer, counter, and
move.
STEP 7 does not limit the number of instructions (rows and columns) in a LAD network.
Note
Every LAD network must terminate with a coil or a box instruction.
( )
+ *
Mathematical functions and other complex functions can be represented directly in conjunction
with the logic boxes.
STEP 7 does not limit the number of instructions (rows and columns) in an FBD network.
7.5.3 SCL
Structured Control Language (SCL) is a high-level, PASCAL-based programming language for the
SIMATIC S7 CPUs. SCL supports the block structure of STEP 7 (Page 167). Your project can include
program blocks in any of the three programming languages: SCL, LAD, and FBD.
SCL instructions use standard programming operators, such as for assignment (:=),
mathematical functions (+ for addition, - for subtraction, * for multiplication, and / for division).
SCL also uses standard PASCAL program control operations, such as IF-THEN-ELSE, CASE,
REPEAT-UNTIL, GOTO and RETURN. You can use any PASCAL reference for syntactical elements
of the SCL programming language. Many of the other instructions for SCL, such as timers and
counters, match the LAD and FBD instructions. For more information about specific instructions,
refer to the specific instructions in the chapters for Basic instructions (Page 197) and Extended
instructions (Page 309).
In the Interface section of the SCL code block you can declare the following types of parameters:
• Input, Output, InOut, and Ret_Val: These parameters define the input tags, output tags, and
return value for the code block. The tag name that you enter here is used locally during the
execution of the code block. You typically would not use the global tag name in the tag table.
• Static (FBs only; the illustration above is for an FC): The code block uses static tags for storage
of static intermediate results in the instance data block. The block retains static data until
overwritten, which can be after several cycles. The names of the blocks, which this block calls
as multi-instance, are also stored in the static local data.
• Temp: These parameters are the temporary tags that are used during the execution of the
code block.
• Constant: These are named constant values for your code block.
If you call the SCL code block from another code block, the parameters of the SCL code block
appear as inputs or outputs.
In this example, the tags for "Start" and "On" (from the project tag table) correspond to
"StartStopSwitch" and "RunYesNo" in the declaration table of the SCL program.
As a high-level programming language, SCL uses standard statements for basic tasks:
• Assignment statement: :=
• Mathematical functions: +, -, *, and /
• Addressing of global variables (tags): "<tag name>" (Tag name or data block name enclosed
in double quotes)
• Addressing of local variables: #<variable name> (Variable name preceded by "#" symbol)
The following examples show different expressions for different uses:
Control statements
A control statement is a specialized type of SCL expression that performs the following tasks:
• Program branching
• Repeating sections of the SCL program code
• Jumping to other parts of the SCL program
• Conditional execution
The SCL control statements include IF-THEN, CASE-OF, FOR-TO-DO, WHILE-DO, REPEAT-UNTIL,
CONTINUE, GOTO, and RETURN.
A single statement typically occupies one line of code. You can enter multiple statements on one
line, or you can break a statement into several lines of code to make the code easier to read.
Separators (such as tabs, line breaks and extra spaces) are ignored during the syntax check. An
END statement terminates the control statement.
The following examples show a FOR-TO-DO control statement. (Both forms of coding are
syntactically valid.)
FOR x := 0 TO max DO sum := sum + value(x); END_FOR;
FOR x := 0 TO max DO
sum := sum + value(x);
END_FOR;
A control statement can also be provided with a label. A label is set off by a colon at the beginning
of the statement:
Label: <Statement>;
The STEP 7 online help provides a complete SCL programming language reference.
Conditions
A condition is a comparison expression or a logical expression whose result is of type BOOL (with
the value of either TRUE or FALSE). The following example shows conditions of various types:
Addressing
As with LAD and FBD, SCL allows you to use either tags (symbolic addressing) or absolute
addresses in your user program. SCL also allows you to use a variable as an array index.
Absolute addressing
%I0.0 Precede absolute addresses with the "%" symbol.
%MB100 Without the "%", STEP 7 generates an undefined tag
error at compile time.
Symbolic addressing
"PLC_Tag_1" Tag in PLC tag table
"Data_block_1".Tag_1 Tag in a data block
"Data_block_1".MyArray[#i] Array element in a data block array
Note
To use the PEEK and POKE instructions with data blocks, you must use standard (not optimized)
data blocks. Also note that the PEEK and POKE instructions merely transfer data. They have no
knowledge of data types at the addresses.
For PEEK and POKE instructions, the following values for the "area", "area_src" and "area_dest"
parameters are applicable. For areas other than data blocks, the dbNumber parameter must be
0.
16#81 I
16#82 Q
16#83 M
16#84 DB
“MyFunction”
( IN1 := …
IN2 := … ,
OUT1 => #myOut,
ENO => ENO ); // block status flag of "MyFunction"
// is stored in the local block
See also
OK (Check validity) and NOT_OK (Check invalidity) (Page 219)
You can download your project from the programming device to your CPU from any of the
following locations:
• Project tree: Right-click the program element, and then click the context-sensitive
"Download" selection.
• Online menu: Click the "Download to device" selection.
• Toolbar: Click the "Download to device" icon.
• Device configuration: Right-click the CPU and select the elements to download.
Note that if you have applied dynamic binding with mandatory password (Page 157) to any of
the program blocks, you must enter the password for the protected blocks in order to download
them. If you have configured this type of copy protection for multiple blocks, you must enter the
password for each of the protected blocks in order to download them.
Note
Downloading a program does not clear or make any changes to existing values in retentive
memory. If you want to clear retentive memory before a download, then reset your CPU to
factory settings prior to downloading the program.
You can also download a panel project for the Basic HMI panels (Page 32) from the TIA Portal to
a memory card in the S7-1200 CPU.
Downloading when the configured CPU is different from the connected CPU
STEP 7 and the S7-1200 permit a download if the connected CPU has the capacity to store a
download from the configured CPU, based on the memory requirements of the project and the
compatibility of the I/O. You can download the configuration and program from a CPU to a larger
CPU, for example, from a CPU 1211C DC/DC/DC to a CPU 1215C DC/DC/DC because the I/O is
compatible and the memory is sufficient. In this case, the download operation displays a
warning, "Differences between configured and target modules (online)" along with the article
numbers and firmware versions in the "Load preview" dialog. You must choose either "No action"
if you do not want the download to proceed or "Accept all" if you do want the download to
proceed:
Note
When you go online (Page 1141) after downloading the configured CPU to a different connected
CPU, you see the project for the configured CPU with online status indicators in the project tree.
In the online and diagnostics view, however, you see the actual connected CPU module type.
Figure 7-1 Online view when configured CPU is different from connected CPU
You can, of course, change your device (Page 142) in the device configuration so that the
configured CPU is the same module type as the connected CPU. The "Change device" dialog
provides complete compatibility details when you try to change a device.
STEP 7 and the S7‑1200 prohibit a download if the connected CPU does not have the capacity to
store a download from the configured CPU; for example, you cannot download the hardware
configuration and program for the following cases:
• CPU 1215C DC/DC/DC to a CPU 1212C DC/DC/DC due to insufficient work memory
• CPU 1211C DC/DC/Relay to a CPU 1211C DC/DC/DC due to I/O differences
• CPU 1217C DC/DC/DC to any CPU 1211C, CPU 1212C, CPU 1214C, or CPU 1215C due to the
1.5 V DC outputs in the CPU 1217C
• CPU 1214C V4.2.x to CPU 1214C V4.0, due to downward firmware version incompatibility
The "Load preview" dialog displays an error in such cases:
In rare cases, the download succeeds but a subsequent power cycle of the CPU fails. In this case
you may see an error in the diagnostic buffer such as:
• 16# 02:4175 -- CPU error: Memory card evaluation error: Unknown or incompatible version
of CPU configuration description current card type: No memory card Function finished/
aborted, new startup inhibit set: ..- Memory card missing, wrong type, wrong content or
protected
If this occurs and additional attempts to download fail, you must clear the internal load memory
or external load memory:
1. If using internal load memory, reset the CPU to factory settings.
2. If using a SIMATIC memory card, remove it and delete the contents of the memory card
(Page 118) before reinserting.
3. Download the hardware configuration and software.
See also
Synchronizing the online CPU and offline project (Page 191)
Note
If you edit blocks or tags in the project that you used for the last download, you do not have to
make any choices about synchronization. STEP 7 and the CPU detect that the offline project
changes are newer than the online CPU and proceeds with a normal download operation.
Synchronization choices
When you download a project to the CPU, you see the synchronization dialog if STEP 7 detects
that data blocks or tags in the online CPU are newer than the project values. For example, if the
STEP 7 program has executed WRIT_DBL and changed a start value for a tag in Data_block_1,
STEP 7 displays the following synchronization dialog when you initiate a download:
This dialog lists the program blocks where differences exist. From this dialog, you have the
following choices:
• Online/offline comparison: If you click this button, STEP 7 displays the program blocks,
system blocks, technology objects, PLC tags, and PLC data types for the project as compared
to the online CPU (Page 1152). For each object, you can click to see a detailed analysis of the
differences including time stamps. You can use this information to decide what to do about
the differences between the online CPU and the project.
• Synchronize: If you click this button, STEP 7 uploads the data blocks, tags, and other objects
from the online CPU to the project. You can then continue with the program download,
unless program execution has again caused the project to be out of sync with the CPU.
• Continue without synchronization: If you click this button, STEP 7 downloads the project to
the CPU.
• Cancel: If you click this button, you cancel the download operation.
Monitoring with a
watch table
Refer to the "Online and diagnostics" chapter for more information about monitoring and
modifying data in the CPU (Page 1154).
Note
The force values are stored in the CPU and not in the watch table.
You cannot force an input (or "I" address). However, you can force a peripheral input. To force a
peripheral input, append a ":P" to the address (for example: "On:P").
STEP 7 also provides the capability of tracing and recording program variables based on trigger
conditions (Page 1171).
Note
You do not have to close the editor to see the cross-reference information.
You can sort the entries in the cross-reference. The cross-reference list provides an overview of
the use of memory addresses and tags within the user program.
• When creating and changing a program, you retain an overview of the operands, tags and
block calls you have used.
• From the cross-references, you can jump directly to the point of use of operands and tags.
• During a program test or when troubleshooting, you are notified about which memory
location is being processed by which command in which block, which tag is being used in
which screen, and which block is called by which other block.
Column Description
Object Name of the object that uses the lower-level objects or that is being used by the lower-
level objects
Number Number of uses
Point of use Each location of use, for example, network
Property Special properties of referenced objects, for example, the tag names in multi-instance
declarations
as Shows additional information about the object, such as whether an instance DB is
used as template or as a multiple instance
Access Type of access, whether access to the operand is read access (R) and/or write access (W)
Address Address of the operand
Type Information on the type and language used to create the object
Path Path of object in project tree
Depending on the installed products, the cross-reference table displays additional or different
columns.
Displaying the call structure provides you with a list of the blocks used in the user program.
STEP 7 highlights the first level of the call structure and displays any blocks that are not called by
any other block in the program. The first level of the call structure displays the OBs and any FCs,
FBs, and DBs that are not called by an OB. If a code block calls another block, the called block is
shown as an indentation under the calling block. The call structure only displays those blocks
that are called by a code block.
You can selectively display only the blocks causing conflicts within the call structure. The
following conditions cause conflicts:
• Blocks that execute any calls with older or newer code time stamps
• Blocks that call a block with modified interface
• Blocks that use a tag with modified address and/or data type
• Blocks that are called neither directly nor indirectly by an OB
• Blocks that call a non-existent or missing block
You can group several block calls and data blocks as a group. You use a drop-down list to see the
links to the various call locations.
You can also perform a consistency check to show time stamp conflicts. Changing the time
stamp of a block during or after the program is generated can lead to time stamp conflicts, which
in turn cause inconsistencies among the blocks that are calling and being called.
• Most time stamp and interface conflicts can be corrected by recompiling the code blocks.
• If compilation fails to clear up inconsistencies, use the link in the "Details" column to go to the
source of the problem in the program editor. You can then manually eliminate any
inconsistencies.
• Any blocks marked in red must be recompiled.
LAD contacts
• The Normally Open contact is closed (ON) when the assigned bit value is equal to 1.
• The Normally Closed contact is closed (ON) when the assigned bit value is equal to 0.
• Contacts connected in series create AND logic networks.
• Contacts connected in parallel create OR logic networks.
out := in1 OR in2; Any input of an OR box must be TRUE for the output to be TRUE.
out := in1 XOR in2; An odd number of the inputs of an XOR box must be TRUE for the
output to be TRUE.
1
For SCL: You must assign the result of the operation to a variable to be used for another statement.
• If there is power flow through an output coil or an FBD "=" box is enabled, then the output bit
is set to 1.
• If there is no power flow through an output coil or an FBD "=" assignment box is not enabled,
then the output bit is set to 0.
• If there is power flow through an inverted output coil or an FBD "/=" box is enabled, then the
output bit is set to 0.
• If there is no power flow through an inverted output coil or an FBD "/=" box is not enabled,
then the output bit is set to 1.
1
For LAD and FBD: These instructions can be placed anywhere in the network.
2
For SCL: You must write code to replicate this function within your application.
1
For LAD and FBD: These instructions must be the right-most instruction in a branch.
2
For SCL: You must write code to replicate this function within your application.
1
For LAD and FBD: These instructions must be the right-most instruction in a branch.
2
For SCL: You must write code to replicate this function within your application.
The "INOUT" tag assigns the bit address that is set or reset. The optional output Q follows the
signal state of the "INOUT" address.
For R_TRIG and F_TRIG, when you insert the instruction in the program, the "Call options" dialog
opens automatically. In this dialog you can assign
whether the edge memory bit is stored in its own data block (single instance) or as a local tag
(multiple instance) in the
block interface. If you create a separate data block, you will find it in the project tree in the
Table 8-17 Data types for the parameters (P and N contacts/coils, P=, N=, P_TRIG and N_TRIG)
All edge instructions use a memory bit (M_BIT: P/N contacts/coils, P_TRIG/N_TRIG) or (instance
DB bit: R_TRIG, F_TRIG) to store the previous state of the monitored input signal. An edge is
detected by comparing the state of the input with the previous state. If the states indicate a
change of the input in the direction of interest, then an edge is reported by writing the output
TRUE. Otherwise, the output is written to FALSE.
Note
Edge instructions evaluate the input and memory-bit values each time they are executed,
including the first execution. You must account for the initial states of the input and memory bit
in your program design either to allow or to avoid edge detection on the first scan.
Because the memory bit must be maintained from one execution to the next, you should use a
unique bit for each edge instruction, and you should not use this bit any other place in your
program. You should also avoid temporary memory and memory that can be affected by other
system functions, such as an I/O update. Use only M, global DB, or Static memory (in an instance
DB) for M_BIT memory assignments.
FBD only: PRESET_TIMER( The PT (Preset timer) coil loads a new PRESET time
PT:=_time_in_, value in the specified IEC_Timer.
TIMER:=_iec_timer_in
_);
FBD only: RESET_TIMER( The RT (Reset timer) coil resets the specified
_iec_timer_in_); IEC_Timer.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL examples, "IEC_Timer_0_DB" is the name of the instance DB.
Timer Changes in the PT and IN box parameters and the corresponding coil parameters
TP • Changing PT has no effect while the timer runs.
• Changing IN has no effect while the timer runs.
TON • Changing PT has no effect while the timer runs.
• Changing IN to FALSE, while the timer runs, resets and stops the timer.
TOF • Changing PT has no effect while the timer runs.
• Changing IN to TRUE, while the timer runs, resets and stops the timer.
TONR • Changing PT has no effect while the timer runs, but has an effect when the timer resumes.
• Changing IN to FALSE, while the timer runs, stops the timer but does not reset the timer. Changing IN
back to TRUE will cause the timer to start timing from the accumulated time value.
PT (preset time) and ET (elapsed time) values are stored in the specified IEC_TIMER DB data as
signed double integers that represent milliseconds of time. TIME data uses the T# identifier and
can be entered as a simple time unit (T#200ms or 200) and as compound time units like
T#2s_200ms.
The pulse timer is started on a 0 to 1 transition of the Tag_Input bit value. The timer runs for the
time specified by Tag_Time time value.
As long as the timer runs, the state of DB1.MyIEC_Timer.Q=1 and the Tag_Output value=1.
When the Tag_Time value has elapsed, then DB1.MyIEC_Timer.Q=0 and the Tag_Output
value=0.
Note
When you place timer instructions in an FB, you can select the "Multi-instance data block" option.
The timer structure names can be different with separate data structures, but the timer data is
contained in a single data block and does not require a separate data block for each timer. This
reduces the processing time and data storage necessary for handling the timers. There is no
interaction between the timer data structures in the shared multi-instance DB.
(7
37
37 37 37
4 37 37
4
37 37
Note
In the CPU, no dedicated resource is allocated to any specific timer instruction. Instead, each
timer utilizes its own timer structure in DB memory and a continuously-running internal CPU
timer to perform timing.
When a timer is started due to an edge change on the input of a TP, TON, TOF, or TONR
instruction, the value of the continuously-running internal CPU timer is copied into the START
member of the DB structure allocated for this timer instruction. This start value remains
unchanged while the timer continues to run, and is used later each time the timer is updated.
Each time the timer is started, a new start value is loaded into the timer structure from the
internal CPU timer.
When a timer is updated, the start value described above is subtracted from the current value of
the internal CPU timer to determine the elapsed time. The elapsed time is then compared with
the preset to determine the state of the timer Q bit. The ELAPSED and Q members are then
updated in the DB structure allocated for this timer. Note that the elapsed time is clamped at the
preset value (the timer does not continue to accumulate elapsed time after the preset is
reached).
A timer update is performed when and only when:
• A timer instruction (TP, TON, TOF, or TONR) is executed
• The "ELAPSED" member of the timer structure in DB is referenced directly by an instruction
• The "Q" member of the timer structure in DB is referenced directly by an instruction
Timer programming
The following consequences of timer operation should be considered when planning and
creating your user program:
• You can have multiple updates of a timer in the same scan. The timer is updated each time
the timer instruction (TP, TON, TOF, TONR) is executed and each time the ELAPSED or Q
member of the timer structure is used as a parameter of another executed instruction. This
is an advantage if you want the latest time data (essentially an immediate read of the timer).
However, if you desire to have consistent values throughout a program scan, then place your
timer instruction prior to all other instructions that need these values, and use tags from the
Q and ET outputs of the timer instruction instead of the ELAPSED and Q members of the timer
DB structure.
• You can have scans during which no update of a timer occurs. It is possible to start your timer
in a function, and then cease to call that function again for one or more scans. If no other
instructions are executed which reference the ELAPSED or Q members of the timer structure,
then the timer will not be updated. A new update will not occur until either the timer
instruction is executed again or some other instruction is executed using ELAPSED or Q from
the timer structure as a parameter.
• Although not typical, you can assign the same DB timer structure to multiple timer
instructions. In general, to avoid unexpected interaction, you should only use one timer
instruction (TP, TON, TOF, TONR) per DB timer structure.
• Self-resetting timers are useful to trigger actions that need to occur periodically. Typically,
self-resetting timers are created by placing a normally-closed contact which references the
timer bit in front of the timer instruction. This timer network is typically located above one
or more dependent networks that use the timer bit to trigger actions. When the timer expires
(elapsed time reaches preset value), the timer bit is ON for one scan, allowing the dependent
network logic controlled by the timer bit to execute. Upon the next execution of the timer
network, the normally closed contact is OFF, thus resetting the timer and clearing the timer
bit. The next scan, the normally closed contact is ON, thus restarting the timer. When
creating self-resetting timers such as this, do not use the "Q" member of the timer DB
structure as the parameter for the normally-closed contact in front of the timer instruction.
Instead, use the tag connected to the "Q" output of the timer instruction for this purpose. The
reason to avoid accessing the Q member of the timer DB structure is because this causes an
update to the timer and if the timer is updated due to the normally closed contact, then the
contact will reset the timer instruction immediately. The Q output of the timer instruction will
not be ON for the one scan and the dependent networks will not execute.
6. If necessary, open the FB interface editor (may have to click on the small arrow to expand the
view).
7. Under Static, locate the timer structure that was just created for you.
8. In the Retain column for this timer structure, change the selection to "Retain". Whenever this
FB is called later from another program block, an instance DB will be created with this
interface definition which contains the timer structure marked as retentive.
If the FB does not specify "Optimized block access", then the block access type is standard, which
is compatible with S7-300/400 classic configurations and allows symbolic and direct access. To
assign a multi-instance to a standard block access FB, follow these steps:
1. Open the FB for edit.
2. Place the timer instruction at the desired location in the FB.
3. When the Call options dialog appears, click on the multi instance icon. The multi instance
option is only available if the instruction is being placed into an FB.
4. In the Call options dialog, rename the timer if desired.
5. Click OK. The timer instruction appears in the editor, and the IEC_TIMER structure appears in
the FB Interface under Static.
6. Open the block that will use this FB.
7. Place this FB at the desired location. Doing so results in the creation of an instance data block
for this FB.
8. Open the instance data block created when you placed the FB in the editor.
9. Under Static, locate the timer structure of interest. In the Retain column for this timer
structure, check the box to make this structure retentive.
The number of counters that you can use in your user program is limited only by the amount of
memory in the CPU. Counters use the following amount of memory:
• For SInt or USInt data types, the counter instruction uses 3 bytes.
• For Int or UInt data types, the counter instruction uses 6 bytes.
• For DInt or UDInt data types, the counter instruction uses 12 bytes.
These instructions use software counters whose maximum counting rate is limited by the
execution rate of the OB in which they are placed. The OB that the instructions are placed in must
be executed often enough to detect all transitions of the CU or CD inputs. For faster counting
operations, see the CTRL_HSC instruction (Page 511).
Note
When you place counter instructions in an FB, you can select the multi-instance DB option, the
counter structure names can be different with separate data structures, but the counter data is
contained in a single DB and does not require a separate DB for each counter. This reduces the
processing time and data storage necessary for the counters. There is no interaction between
the counter data structures in the shared multi-instance DB.
Counter Operation
The CTU counter counts up by 1 when the value of parameter CU changes
from 0 to 1. The CTU timing diagram shows the operation for an unsigned &8
integer count value (where PV = 3).
5
• If the value of parameter CV (current count value) is greater than or
equal to the value of parameter PV (preset count value), then the coun‐
ter output parameter Q = 1.
• If the value of the reset parameter R changes from 0 to 1, then the
current count value is reset to 0. &9
Counter Operation
The CTD counter counts down by 1 when the value of parameter
CD changes from 0 to 1. The CTD timing diagram shows the op‐ &'
eration for an unsigned integer count value (where PV = 3). /'
• If the value of parameter CV (current count value) is equal to
or less than 0, the counter output parameter Q = 1.
• If the value of parameter LOAD changes from 0 to 1, the value
&9
at parameter PV (preset value) is loaded to the counter as the
new CV (current count value).
4
Counter Operation
The CTUD counter counts up or
&8
down by 1 on the 0 to 1 transition
of the count up (CU) or count
down (CD) inputs. The CTUD tim‐ &'
ing diagram shows the operation
for an unsigned integer count val‐
5
ue (where PV = 4).
• If the value of parameter CV is
equal to or greater than the /2$'
value of parameter PV, then
the counter output parameter
QU = 1.
• If the value of parameter CV is
&9
less than or equal to zero,
then the counter output pa‐
rameter QD = 1.
48
• If the value of parameter
LOAD changes from 0 to 1, 4'
then the value at parameter
PV is loaded to the counter as
the new CV.
• If the value of the reset param‐
eter R is changes from 0 to 1,
the current count value is re‐
set to 0.
Counter Data Type Corresponding Type for the Preset and Count Values
IEC_Counter INT
IEC_SCounter SINT
IEC_DCounter DINT
IEC_UCounter UINT
IEC_USCounter USINT
IEC_UDCounter UDINT
This option depends upon whether the FB properties specify "Optimized block access" (allows
symbolic access only). To verify how the access attribute is configured for an existing FB, right-
click on the FB in the Project tree, choose properties, and then choose Attributes.
If the FB specifies "Optimized block access" (allows symbolic access only):
1. Open the FB for edit.
2. Place the counter instruction at the desired location in the FB.
3. When the Call options dialog appears, click on the Multi instance icon. The Multi Instance
option is only available if the instruction is being placed into an FB.
4. In the Call options dialog, rename the counter if desired.
5. Click OK. The counter instruction appears in the editor with type INT for the preset and count
values, and the IEC_COUNTER structure appears in the FB Interface under Static.
6. If desired, change the type in the counter instruction from INT to one of the other types. The
counter structure will change correspondingly.
7. If necessary, open the FB interface editor (may have to click on the small arrow to expand the
view).
8. Under Static, locate the counter structure that was just created for you.
9. In the Retain column for this counter structure, change the selection to "Retain". Whenever
this FB is called later from another program block, an instance DB will be created with this
interface definition which contains the counter structure marked as retentive.
If the FB does not specify "Optimized block access", then the block access type is standard, which
is compatible with S7-300/400 classic configurations and allows symbolic and direct access. To
assign a multi-instance to a standard block access FB, follow these steps:
1. Open the FB for edit.
2. Place the counter instruction at the desired location in the FB.
3. When the Call options dialog appears, click on the multi instance icon. The multi instance
option is only available if the instruction is being placed into an FB.
4. In the Call options dialog, rename the counter if desired.
5. Click OK. The counter instruction appears in the editor with type INT for the preset and count
value, and the IEC_COUNTER structure appears in the FB Interface under Static.
6. If desired, change the type in the counter instruction from INT to one of the other types. The
counter structure will change correspondingly.
7. Open the block that will use this FB.
8. Place this FB at the desired location. Doing so results in the creation of an instance data block
for this FB.
9. Open the instance data block created when you placed the FB in the editor.
10.Under Static, locate the counter structure of interest. In the Retain column for this counter
structure, check the box to make this structure retentive.
Type shown in counter instruction (for preset Corresponding structure Type shown in FB in‐
and count values) terface
INT IEC_Counter
SINT IEC_SCounter
DINT IEC_DCounter
UINT IEC_UCounter
USINT IEC_USCounter
UDINT IEC_UDCounter
8.4.2 IN_Range (Value within range) and OUT_Range (Value outside range)
Table 8-31 Value within Range and value outside range instructions
out := OUT_RANGE(min,
val, max);
1
For LAD and FBD: Click the "???" and select the data type from the drop-down list.
Not available
1
For LAD and FBD: When the LAD contact is TRUE, the contact is activated and passes power flow. When the FBD box is TRUE,
then the box output is TRUE.
Table 8-38 IS_NULL (Query for EQUALS ZERO pointer) and NOT_NULL (Query for EQUALS ZERO pointer) instructions
Note
You also must create an input for any constants in your function. The constant value would then
be entered in the associated input for the CALCULATE instruction.
By entering constants as inputs, you can copy the CALCULATE instruction to other locations in
your user program without having to change the function. You then can change the values or
tags of the inputs for the instruction without modifying the function.
When CALCULATE is executed and all the individual operations in the calculation complete
successfully, then the ENO = 1. Otherwise, ENO = 0.
For an example of the CALCULATE instruction, see "AUTOHOTSPOT".
Table 8-45 Data types for the parameters (LAD and FBD)
To add an ADD or MUL input, click the "Create" icon or right-click on an input stub
for one of the existing IN parameters and select the "Insert input" command.
To remove an input, right-click on an input stub for one of the existing IN parameters (when
there are more than the original two inputs) and select the "Delete" command.
When enabled (EN = 1), the math instruction performs the specified operation on the input
values (IN1 and IN2) and stores the result in the memory address specified by the output
parameter (OUT). After the successful completion of the operation, the instruction sets ENO =
1.
ENO Description
1 No error
0 The Math operation result value would be outside the valid number range of the data type selected. The least
significant part of the result that fits in the destination size is returned.
0 Division by 0 (IN2 = 0): The result is undefined and zero is returned.
0 Real/LReal: If one of the input values is NaN (not a number) then NaN is returned.
0 ADD Real/LReal: If both IN values are INF with different signs, this is an illegal operation and NaN is returned.
0 SUB Real/LReal: If both IN values are INF with the same sign, this is an illegal operation and NaN is returned.
0 MUL Real/LReal: If one IN value is zero and the other is INF, this is an illegal operation and NaN is returned.
0 DIV Real/LReal: If both IN values are zero or INF, this is an illegal operation and NaN is returned.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
ENO Description
1 No error
0 Value IN2 = 0, OUT is assigned the value zero
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
ENO Description
1 No error
0 The resulting value is outside the valid number range of the selected data type.
Example for SInt: NEG (-128) results in +128 which exceeds the data type maximum.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
ENO Description
1 No error
0 The resulting value is outside the valid number range of the selected data type.
Example for SInt: INC (+127) results in +128, which exceeds the data type maximum.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
ENO Description
1 No error
0 The math operation result value is outside the valid number range of the selected data type.
Example for SInt: ABS (-128) results in +128 which exceeds the data type maximum.
Table 8-59 MIN (get minimum) and MAX (get maximum) instructions
out:= MAX( The MAX instruction compares the value of two parameters IN1
in1:=_variant_in_, and IN2 and assigns the maximum (greater) value to parameter
in2:=_variant_in_ OUT.
[,...in32]);
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
To add an input, click the "Create" icon or right-click on an input stub for one of the
existing IN parameters and select the "Insert input" command.
To remove an input, right-click on an input stub for one of the existing IN parameters (when
there are more than the original two inputs) and select the "Delete" command.
ENO Description
1 No error
0 For Real data type only:
• At least one input is not a real number (NaN).
• The resulting OUT is +/- INF (infinity).
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
ENO Description
1 No error
0 Real: If one or more of the values for MIN, IN and MAX is NaN (Not a Number), then NaN is returned.
0 If MIN is greater than MAX, the value IN is assigned to OUT.
SCL examples:
• MyVal := LIMIT(MN:=10,IN:=53, MX:=40); //Result: MyVal = 40
• MyVal := LIMIT(MN:=10,IN:=37, MX:=40); //Result: MyVal = 37
• MyVal := LIMIT(MN:=10,IN:=8, MX:=40); //Result: MyVal = 10
1
For LAD and FBD: Click the "???" (by the instruction name) and select a data type from the drop-down menu.
2
For SCL: You can also use the basic SCL math operators to create the mathematical expressions.
8.6.1 MOVE (Move value), MOVE_BLK (Move block), UMOVE_BLK (Move block
uninterruptible), and MOVE_BLK_VARIANT (Move block)
Use the Move instructions to copy data elements to a new memory address and convert from
one data type to another. The source data is not changed by the move process.
• The MOVE instruction copies a single data element from the source address specified by the
IN parameter to the destination addresses specified by the OUT parameter.
• The MOVE_BLK and UMOVE_BLK instructions have an additional COUNT parameter. The
COUNT specifies how many data elements are copied. The number of bytes per element
copied depends on the data type assigned to the IN and OUT parameter tag names in the PLC
tag table.
To add MOVE outputs, click the "Create" icon or right-click on an output stub for one
of the existing OUT parameters and select the "Insert output" command.
To remove an output, right-click on an output stub for one of the existing OUT parameters (when
there are more than the original two outputs) and select the "Delete" command.
Table 8-70 Data types for the MOVE_BLK and UMOVE_BLK instructions
Note
Rules for data copy operations
• To copy the Bool data type, use SET_BF, RESET_BF, R, S, or output coil (LAD) (Page 200)
• To copy a single elementary data type, use MOVE
• To copy an array of an elementary data type, use MOVE_BLK or UMOVE_BLK
• To copy a structure, use MOVE
• To copy a string, use S_MOVE (Page 319)
• To copy a single character in a string, use MOVE
• The MOVE_BLK and UMOVE_BLK instructions cannot be used to copy arrays or structures to
the I, Q, or M memory areas.
RET_VAL Description
(W#16#...)
0000 No error
80B4 Data types do not correspond.
8151 Access to the SRC parameter is not possible.
8152 The operand at the SRC parameter is an invalid type.
8153 Code generation error at the SRC parameter
8154 The operand at the SRC parameter has the data type Bool.
8281 The COUNT parameter has an invalid value.
8382 The value at the SRC_INDEX parameter is outside the limits of the
Variant.
8383 The value at parameter SRC_INDEX is outside the high limit of the
array.
8482 The value at the DEST_INDEX parameter is outside the limits of the
Variant.
8483 The value at parameter DEST_INDEX is outside the high limit of the
array.
8534 The DEST parameter is write-protected.
8551 Access to the DEST parameter is not possible.
8552 The operand at the DEST parameter is an invalid type.
8553 Code generation error at the DEST parameter
8554 The operand at the DEST parameter has the data type Bool.
*You can display error codes in the program editor as integer or hexadecimal values.
8.6.2 Deserialize
You can use the "Deserialize" instruction to convert the sequential representation of a PLC data
type (UDT) back to a PLC data type and to fill its entire contents. If the comparison is TRUE, then
the box output is TRUE.
The memory area which holds the sequential representation of a PLC data type must have the
Array of Byte data type and you must declare the data block to have standard (not optimized)
access. Make sure that there is enough memory space prior to the conversion.
The instruction enables you to convert multiple sequential representations of converted PLC
data types back to their original data types.
Note
If you only want to convert back a single sequential representation of a PLC data type (UDT), you
can also use the instruction "TRCV: Receive data via communication connection".
RET_VAL* Description
(W#16#...)
0000 No error
80B0 The memory areas for the SRC_ARRAY and DEST_VARIABLE parameters overlap.
8136 The data block at the DEST_VARIABLE parameter is not a block with standard access.
8150 The Variant data type at the SRC_ARRAY parameter contains no value.
8151 Code generation error at the SRC_ARRAY parameter.
RET_VAL* Description
(W#16#...)
8153 There is not enough free memory available at the SRC_ARRAY parameter.
8250 The Variant data type at the DEST_VARIABLE parameter contains no value.
8251 Code generation error at the DEST_VARIABLE parameter.
8254 Invalid data type at the DEST_VARIABLE parameter.
8382 The value at parameter POS is outside the limits of the array.
*
You can view the error codes as either integer or hexadecimal in the program editor.
The "MOVE" instruction moves the value "0" to the "#BufferPos" data block tag. The Deserialize
instruction then deserializes the sequential representation of the customer data from the
"Buffer" data block and writes it to the "Target" data block. The Deserialize instruction calculates
the number of bytes that the converted data uses and stores it in the "#BufferPos" data block tag.
Network 2:
The "Deserialize" instruction deserializes the sequential representation of the data stream
pointed to by "Buffer" and writes the characters to the "#Label" operand. The logic compares the
characters using the comparison instructions "arti" and "Bill". If the comparison for "arti" = TRUE,
the data is article data that is to be deserialized and written to the "Article" data structure of the
"Target" data block. If the comparison for "Bill" = TRUE, the data is billing data that is to be
deserialized and written to the "Bill" data structure of the "Target" data block.
Function block (or Function) interface:
Data blocks:
The two data blocks for this example are as follows:
8.6.3 Serialize
You can use the "Serialize" instruction to convert several PLC data types (UDTs) to a sequential
representation without any loss of structure.
You can use the instruction to temporarily save multiple structured data items from your
program to a buffer, for example to a global data block, and send them to another CPU. The
memory area in which the converted PLC data types are stored must have the ARRAY of BYTE
data type and be declared with standard access. Make sure that there is enough memory space
prior to the conversion.
The POS parameter contains information about the number of bytes that the converted PLC data
types use.
Note
If you only want to send a single PLC data type (UDT), you can use the instruction "TSEND: Send
data via communication connection".
RET_VAL* Description
(W#16#...)
0000 No error
80B0 The memory areas for the SRC_VARIABLE and DEST_ARRAY parameters overlap.
8150 The Variant data type at the SRC_VARIABLE parameter contains no value.
8152 Code generation error at the SRC_VARIABLE parameter.
8236 The data block at the DEST_ARRAY parameter is not a block with standard access.
8250 The Variant data type at the DEST_ARRAY parameter contains no value.
8252 Code generation error at the DEST_ARRAY parameter.
8253 There is not enough free memory available at the DEST_ARRAY parameter.
8254 Invalid data type at the DEST_VARIABLE parameter.
8382 The value at parameter POS is outside the limits of the array.
*
You can view the error codes as either integer or hexadecimal in the program editor.
The "MOVE" instruction moves the value "0" to the "#BufferPos" parameter. The "Serialize"
instruction serializes the customer data from the "Source" data block and writes it in sequential
representation to the "Buffer" data block. The instruction stores the number of bytes used by the
sequential representation in the "#BufferPos" parameter.
Network 2:
The logic now inserts some separator text to make it easier to deserialize the sequential
representation later. The "S_MOVE" instruction moves the text string "arti" to the "#Label"
parameter. The "Serialize" instruction writes these characters after the source client data to the
"Buffer" data block. The instruction adds the number of bytes in the text string "arti" to the
number already stored in the "#BufferPos" parameter.
Network 3:
The "Serialize" instruction serializes the data of a specific article, which is calculated in runtime,
from the "Source" data block and writes it in sequential representation to the "Buffer" data block
after the "arti" characters
Block Interface:
Data blocks:
Note
Rules for data fill operations
• To fill with the BOOL data type, use SET_BF, RESET_BF, R, S, or output coil (LAD)
• To fill with a single elementary data type, use MOVE
• To fill an array with an elementary data type, use FILL_BLK or UFILL_BLK
• To fill a single character in a string, use MOVE
• The FILL_BLK and UFILL_BLK instructions cannot be used to fill arrays in the I, Q, or M memory
areas.
The FILL_BLK and UFILL_BLK instructions copy the source data element IN to the destination
where the initial address is specified by the parameter OUT. The copy process repeats and a block
of adjacent addresses is filled until the number of copies is equal to the COUNT parameter.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
Parameters
The following table shows the parameters of the instruction "LOWER_BOUND: Read out ARRAY
low limit":
ARR Input ARRAY [*] FB: Section InOut ARRAY of which the variable
FC: Sections Input low limit is to be read.
and InOut
DIM Input UDINT I, Q, M, D, L or con‐ Dimension of the ARRAY of
stant which the variable low limit is
to be read.
OUT Output DINT I, Q, M, D, L Result
You can find additional information on valid data types under "Data types (Page 100)":
Example
In the function (FC) block interface, the input parameter ARRAY_A is a one-dimensional array
with variable dimensions.
If the "Enable_Start" operand returns signal state "1", the CPU executes the LOWER_BOUND
instruction. It reads out the variable low limit of the ARRAY #ARRAY_A from the one-dimensional
array. If the instruction executes without errors, it sets operand "Enable_Out" and sets the
"Result" operand to the low limit of the array.
Parameters
The following table shows the parameters of the instruction "UPPER_BOUND: Read out ARRAY
high limit":
You can find additional information on valid data types under "Data types (Page 100)":
Example
In the function (FC) block interface, the input parameter ARRAY_A is a one-dimensional array
with variable dimensions.
If the "Enable_Start" operand returns signal state "1", the CPU executes the instruction. It reads
out the variable high limit of the ARRAY #ARRAY_A from the one-dimensional array. If the
instruction executes without errors, it sets operand "Enable_Out" and sets the "Result" operand.
Note
To use the PEEK and POKE instructions with data blocks, you must use standard (not optimized)
data blocks. Also note that the PEEK and POKE instructions merely transfer data. They have no
knowledge of data types at the addresses.
For PEEK and POKE instructions, the following values for the "area", "area_src" and "area_dest"
parameters are applicable. For areas other than data blocks, the dbNumber parameter must be
0.
16#81 I
16#82 Q
16#83 M
16#84 DB
8.6.8.2 Read and write big and little Endian instructions (SCL)
The S7-1200 CPU provides SCL instructions for reading and writing data in little endian format
and in big endian format. Little endian format means that the byte with the least significant bit
is in the lowest memory address. Big endian format means that the byte with the most
significant bit is in the lowest memory address.
The four SCL instructions for reading and writing data in little endian and big endian format are
as follows:
• READ_LITTLE (Read data in little endian format)
• WRITE_LITTLE (Write data in little endian format)
Table 8-87 Read and write big and little endian instructions
RET_VAL* Description
(W#16#...)
0000 No error
80B4 The SRC_ARRAY or DEST_ARRAY is not an Array of Byte
8382 The value at parameter POS is outside the limits of the array.
8383 The value at parameter POS is within the limits of the Array but the size of the memory area exceeds the high
limit of the array.
*
You can view the error codes as either integer or hexadecimal in the program editor.
Note
To copy structures and arrays, you can use the "MOVE_BLK_VARIANT: Move block" instruction.
Note
To copy structures and ARRAYs, you can use the "MOVE_BLK_VARIANT: Move block" instruction.
If it is a one-dimensional ARRAY, the instruction returns the difference between the high and low
limit +1 is output. If it is a multi-dimensional ARRAY, the instruction returns the product of all
dimensions.
Note
If the Variant points to an Array of Bool, the instruction counts the fill elements to the nearest
byte boundary. For example, the instruction returns 8 as the count for an Array[0..1] of Bool.
Note
STEP 7 V10.5 did not support a variable reference as an array index or multi-dimensional arrays.
The FieldRead and FieldWrite instructions were used to provide variable array index operations
for a one-dimensional array. STEP 7 V11 and greater do support a variable as an array index and
multi-dimensional arrays. FieldRead and FieldWrite are included in STEP 7 V11 and greater for
backward compatibility with programs that have used these instructions.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
The logic with the variable array index is equivalent to the former method using the FieldRead
instruction:
FieldWrite and FieldRead instructions can be replaced with variable array indexing logic.
SCL has no FieldRead or FieldWrite instructions, but supports indirect addressing of an array with
a variable:
#Tag_1 := "Data_block_1".Bool_Array[#Index];
8.6.11 SCATTER
Note
Multi-dimensional ARRAY of BOOL
With the "Parse the bit sequence into individual bits" instruction, the use of a multidimensional
ARRAY of BOOL is not permitted.
Note
Length of the ARRAY, STRUCT or PLC data type
The ARRAY, the anonymous STRUCT or the PLC data type must have exactly the number of
elements that is specified by the bit sequence. This means for the data type BYTE, for example,
the ARRAY, STRUCT or the PLC data type must have exactly 8 elements (WORD = 16, and DWORD
= 32).
Note
Note Availability of the instruction
The instruction can be used with a CPU of the S7-1200 series as of firmware version >4.2, and
for a CPU of the S7-1500 series as of firmware version 2.1.
This way you can, for example, parse a status word, and read and change the status of the
individual bits using the index. Using GATHER, you can merge the bits once again into a bit
sequence.
The enable output ENO returns signal state "0" if one of the following conditions applies:
• Enable input EN has signal state "0".
• The ARRAY, STRUCT or PLC data type does not provide enough BOOL elements.
You can find additional information on valid data types under "See also".
6&$77(5
(QDEOH :25'
(QDEOH2XW
(1 (12 6
The following table shows how the instruction works using specific operand values:
If the operand #Enable returns the signal state "1" at the enable input EN, the instruction is
executed. The #SourceWord operand of the data type WORD is parsed into its individual bits (16)
and assigned to the individual elements of the #DestinationArray operand. If an error occurs
during the execution of the instruction, the operand #EnableOut returns the signal state "0" at
the enable output ENO.
You can find additional information and the program code for the above-named example here:
Sample Library for Instructions.
6&$77(5
(QDEOH :25'
(QDEOH2XW
(1 (12 6
The following table shows how the instruction works using specific operand values:
If the operand #Enable returns the signal state "1" at the enable input EN, the instruction is
executed. The #SourceWord operand of the data type WORD is parsed into its individual bits (16)
and assigned to the individual elements of the #DestinationArray operand. If an error occurs
during the execution of the instruction, the operand #EnableOut returns the signal state "0" at
the enable output ENO.
See also
New features (Page 35)
8.6.12 SCATTER_BLK
Note
NO data is written when ENO is false
In the S7-1200 CPU only for the SCATTER_BLK instruction, If ENO is FALSE, no data is written to
the output.
Note
Multi-dimensional ARRAY of BOOL
If the ARRAY is a multi-dimensional ARRAY of BOOL, the filling bits of the dimensions contained
are counted as well even if they were not explicitly declared.
Example 1: An ARRAY[1..10,0..4,1..2] of BOOL is handled like an ARRAY[1..10,0..4,1..8] of BOOL
or like an ARRAY[0..399] of BOOL.
Example 2: At the IN parameter, an ARRAY[0..5] of WORD (sourceArrayWord[2]) is
interconnected. The COUNT_IN parameter has the value "3". At the OUT parameter, an
ARRAY[0..1,0..5,0..7] of BOOL (destinationArrayBool[0,0,0]) is interconnected. Both the array
at the IN parameter and at the OUT parameter has a size of 96 bits. The ARRAY of WORD is parsed
into 48 individual bits
Note
If the ARRAY low limit of the target ARRAY is not "0", note the following:
For performance reasons the index must always start at a BYTE, WORD, or DWORD limit. This
means the index must be calculated starting at the low limit of the ARRAY. The following formula
is used as basis for this calculation:
Valid indices = ARRAY low limit + n(number of bit sequences) × number of bits of the desired bit
sequence
For an ARRAY[-2..45] of BOOL and the bit sequence WORD the calculation looks as follows:
• Valid index (-2) = -2 + 0 × 16
• Valid index (14) = -2 + 1 × 16
• Valid index (30) = -2 + 2 × 16
You can find an example described below.
Note
Availability of the instruction
The instruction can be used with a CPU of the S7-1200 series as of firmware version >4.2, and
for a CPU of the S7-1500 series as of firmware version 2.1.
This way you can, for example, parse status words, and read and change the status of the
individual bits using the index. Using GATHER, you can merge the bits once again into a bit
sequence.
The enable output ENO returns signal state "0" if one of the following conditions applies:
• Enable input EN has signal state "0".
• The source ARRAY has fewer elements than specified at the COUNT_IN parameter.
• The index of the destination ARRAY does not start at a BYTE, WORD, or DWORD limit. In this
case, no result is written to the ARRAY of BOOL.
• The ARRAY[*] of BOOL, STRUCT or PLC data type does not provide the required number of
elements.
– S7-1500-CPU: In this case as many bit sequences as possible are parsed and written to the
ARRAY of BOOL, the anonymous STRUCT or the PLC data type. The remaining bit
sequences are no longer taken into account.
– S7-1200-CPU: There is no copying procedure.
You can select the required bit sequence from the "???" drop-down list of the instruction box.
You can find additional information on valid data types under "See also".
6&$77(5B%/.
(QDEOH :25'
(QDEOH2XW
(1 (12 6
&RXQWHU,QSXW &2817B,1
The following table shows how the instruction works using specific operand values:
If the operand #Enable returns the signal state "1" at the enable input EN, the instruction is
executed. The 3rd, 4th and 5th WORD of the #SourceArrayWord operand is parsed into its
individual bits (48) and as of the 1st element assigned to the individual elements of the
#DestinationArrayBool operand. If an error occurs during the execution of the instruction, the
operand #EnableOut returns the signal state "0" at the enable output ENO.
6&$77(5B%/.
(QDEOH :25'
(QDEOH2XW
(1 (12 6
&RXQWHU,QSXW &2817B,1
The following table shows how the instruction works using specific operand values:
If the operand #Enable returns the signal state "1" at the enable input EN, the instruction is
executed. The 3rd, 4th and 5th WORD of the #SourceArrayWord operand is parsed into its
individual bits (48) and as of the 16th Element assigned to the individual elements of the
#DestinationArrayBool operand. If an error occurs during the execution of the instruction, the
operand #EnableOut returns the signal state "0" at the enable output ENO. The remaining 32 bits
are not written.
You can find additional information and the program code for the above-named example here:
Sample Library for Instructions.
8.6.13 GATHER
GATHER
The "Merge individual bits into a bit sequence" instruction merges the bits from an ARRAY of
BOOL, an anonymous STRUCT or a PLC data type exclusively with Boolean elements into a bit
sequence. The bit sequence is saved in a tag of the data type BYTE, WORD, DWORD or LWORD.
Note
Multi-dimensional ARRAY of BOOL
With the "Merge individual bits into a bit sequence" instruction, the use of a multidimensional
ARRAY of BOOL is not permitted.
Note
Length of the ARRAY, STRUCT or PLC data type
The ARRAY, STRUCT or the PLC data type must have exactly the number of elements that is
specified by the bit sequence.
This means for the data type BYTE, for example, the ARRAY, anonymous STRUCT or the PLC data
type must have exactly 8 elements (WORD = 16, and DWORD = 32).
Note
Availability of the instruction
The instruction can be used with a CPU of the S7-1200 series as of firmware version >4.2, and
for a CPU of the S7-1500 series as of firmware version 2.1.
The enable output ENO returns signal state "0" if one of the following conditions applies:
• Enable input EN has signal state "0".
• The ARRAY, anonymous STRUCT or the PLC data type (UDT) has fewer or more BOOL elements
than specified by the bit sequence. In this case the BOOL elements are not transferred.
• Fewer than the necessary number of bits are available.
You can select the required bit sequence from the "???" drop-down list of the instruction box.
You can find additional information on valid data types under "See also".
*$7+(5
(QDEOH :25'
(QDEOH2XW
(1 (12 6
The following table shows how the instruction works using specific operand values:
If the operand #Enable returns the signal state "1" at the enable input EN, the instruction is
executed. The bits of the #SourceArray operand are merged into a WORD. If an error occurs
during the execution of the instruction, the operand #EnableOut returns the signal state "0" at
the enable output ENO.
You can find additional information and the program code for the above-named example here:
Sample Library for Instructions.
*$7+(5
(QDEOH :25'
(QDEOH2XW
(1 (12 6
The following table shows how the instruction works using specific operand values:
If the operand #Enable returns the signal state "1" at the enable input EN, the instruction is
executed. The bits of the #SourceUDT operand are merged into a WORD. If an error occurs during
the execution of the instruction, the operand #EnableOut returns the signal state "0" at the
enable output ENO.
8.6.14 GATHER_BLK
Description
The "Merge individual bits into multiple elements of an ARRAY of bit sequence" instruction
merges the bits from an ARRAY of BOOL, an anonymous STRUCT or a PLC data type exclusively
with Boolean elements into one or multiple elements of an ARRAY of <bit sequence>. At the
COUNT_OUT parameter you specify how many elements of the destination ARRAY are going to
be written. With this step you also implicitly specify how many elements of the ARRAY of BOOL,
the anonymous STRUCT or the PLC data type are required. The destination ARRAY at the OUT
parameter may have more elements than specified at the COUNT_OUT parameter. The ARRAY of
<bit sequence> must have sufficient elements to save the bits that are going to be merged.
However, the destination ARRAY may also be larger.
Note
NO data is written when ENO is false
In the S7-1200 CPU only for the GATHER_BLK instruction, If ENO is FALSE, no data is written to
the output.
Note
Multi-dimensional ARRAY of BOOL
If the ARRAY is a multi-dimensional ARRAY of BOOL, the filling bits of the dimensions contained
are counted as well even if they were not explicitly declared.
Example 1: An ARRAY[1..10,0..4,1..2] of BOOL is handled like an ARRAY[1..10,0..4,1..8] of BOOL
or like an ARRAY[0..399] of BOOL.
Example 2: At the OUT parameter, an ARRAY[0..5] of WORD (sourceArrayWord[2]) is
interconnected. The COUNT_IN parameter has the value "3". At the IN parameter, an
ARRAY[0..1,0..5,0..7] of BOOL (destinationArrayBool[0,0,0]) is interconnected. Both the array
at the IN parameter and at the OUT parameter has a size of 96 bits. 48 individual bits are merged
from the ARRAY of BOOL.
Note
If the ARRAY low limit of the source ARRAY is not "0", note the following:
For performance reasons the index must always start at a BYTE, WORD, or DWORD limit. This
means the index must be calculated starting at the low limit of the ARRAY. The following formula
is used as basis for this calculation:
Valid indices = ARRAY low limit + n(number of bit sequences) × number of bits of the desired bit
sequence
For an ARRAY[-2..45] of BOOL and the bit sequence WORD the calculation looks as follows:
• Valid index (-2) = -2 + 0 × 16
• Valid index (14) = -2 + 1 × 16
• Valid index (30) = -2 + 2 × 16
You can find an example described below.
Note
Availability of the instruction
The instruction can be used with a CPU of the S7-1200 series as of firmware version >4.2, and
for a CPU of the S7-1500 series as of firmware version 2.1.
The enable output ENO returns signal state "0" if one of the following conditions applies:
• Enable input EN has signal state "0".
• The index of the source ARRAY does not start at a BYTE, WORD, or DWORD limit. In this case,
no result is written to the ARRAY of <bit sequence>.
• The ARRAY[*] of <bit sequence> does not provide the required number of elements.
– S7-1500-CPU: In this case as many bit sequences as possible are merged and written to
the ARRAY of <bit sequence>. The remaining bits are no longer taken into account.
– S7-1200-CPU: There is no copying procedure.
You can select the required bit sequence from the "???" drop-down list of the instruction box.
You can find additional information on valid data types under "See also".
*$7+(5B%/.
(QDEOH :25'
(QDEOH2XW
(1 (12 6
&RXQWHU2XWSXW &2817B287
The following table shows how the instruction works using specific operand values:
If the operand #Enable returns the signal state "1" at the enable input EN, the instruction is
executed. As of the 1st element of the #SourceArrayBool operand, 48 bits are merged in the
#DestinationArrayWord operand. The starting point in the destination ARRAY is the 3rd element.
This means that the first 16 bits are written into the 3rd word, the second 16 bits into the 4th
word and the third 16 bits into the 5th word of the destination ARRAY. If an error occurs during
the execution of the instruction, the operand #EnableOut returns the signal state "0" at the
enable output ENO.
*$7+(5B%/.
(QDEOH :25'
(QDEOH2XW
(1 (12 6
&RXQWHU2XWSXW &2817B287
The following table shows how the instruction works using specific operand values:
If the operand #Enable returns the signal state "1" at the enable input EN, the instruction is
executed. Starting with the 16th element of the #SourceArrayBool operand, 48 bits are merged
into the #DestinationArrayWord operand. The starting point in the destination ARRAY is the 3rd
element. This means the first 16 bits of the source ARRAY are ignored. The second 16 bits are
written into the 3rd word, the third 16 bits into the 4th word and the fourth 16 bits into the 5th
word of the destination ARRAY. The remaining 64 bits of the source ARRAY are not taken into
account either. If an error occurs during the execution of the instruction, the operand
#EnableOut returns the signal state "0" at the enable output ENO.
You can find additional information and the program code for the above-named example here:
Sample Library for Instructions.
1
For LAD and FBD: Click the "???" and select the data types from the drop-down menu.
2
For SCL: Construct the conversion instruction by identifying the data type for the input parameter (in) and output parameter
(out). For example, DWORD_TO_REAL converts a DWord value to a Real value.
8.7.3 ROUND (Round numerical value) and TRUNC (Truncate numerical value)
1
For LAD and FBD: Click the "???" (by the instruction name) and select a data type from the drop-down menu.
8.7.4 CEIL and FLOOR (Generate next higher and lower integer from floating-point
number)
out := FLOOR(in); Converts a real number (Real or LReal) to the closest integer
smaller than or equal to the selected real number (IEEE "round to
-infinity").
1
For LAD and FBD: Click the "???" (by the instruction name) and select a data type from the drop-down menu.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
Note
SCALE_X parameter VALUE should be restricted to ( 0.0 <= VALUE <= 1.0 )
If parameter VALUE is less than 0.0 or greater than 1.0:
• The linear scaling operation can produce OUT values that are less than the parameter MIN
value or above the parameter MAX value for OUT values that fit within the value range of the
OUT data type. SCALE_X execution sets ENO = TRUE for these cases.
• It is possible to generate scaled numbers that are not within the range of the OUT data type.
For these cases, the parameter OUT value is set to an intermediate value equal to the least-
significant portion of the scaled real number prior to final conversion to the OUT data type.
SCALE_X execution sets ENO = FALSE in this case.
NORM_X parameter VALUE should be restricted to ( MIN <= VALUE <= MAX )
If parameter VALUE is less than MIN or greater than MAX, the linear scaling operation can
produce normalized OUT values that are less than 0.0 or greater than 1.0. NORM_X execution
sets ENO = TRUE in this case.
Note that if the analog input was from an analog signal module or signal board using voltage,
the MIN value for the NORM_X instruction would be -27648 instead of 0.
Note that if the analog output was for an analog signal module or signal board using voltage, the
MIN value for the SCALE_X instruction would be -27648 instead of 0.
Additional information on analog input representations (Page 1285) and analog output
representations (Page 1286) in both voltage and current can be found in the Technical
Specifications.
Err Description
(W#16#...)
0000 No error
252C The Variant data type at IN parameter has the value 0. The CPU
changes to STOP mode.
8131 The data block does not exist or is too short (first access).
8132 The data block is too short and not an Array data block (second ac‐
cess).
8134 The data block is write-protected
8150 The data type Variant at parameter IN provides the value "0". To re‐
ceive this error message, the "Handle errors within block" block prop‐
erty must be activated. Otherwise the CPU changes to STOP mode
and sends the error code 16#252C
8154 The data block has the incorrect data type.
*You can display error codes in the program editor as integer or hexadecimal values.
Err Description
(W#16#...)
0000 No error
8130 The number of the data block is 0.
8131 The data block does not exist or is too short.
8132 The data block is too short and not an Array data block.
8134 The data block is write-protected.
8154 The data block has the incorrect data type.
8155 Unknown type code
*You can display error codes in the program editor as integer or hexadecimal values.
8.8.1 JMP (Jump if RLO = 1), JMPN (Jump if RLO = 0), and Label (Jump label)
instructions
1
You create your label names by typing in the LABEL instruction directly. Use the parameter helper icon to select the available
label names for the JMP and JMPN label name field. You can also type a label name directly into the JMP or JMPN instruction.
For LAD and FBD: When the JMP_LIST box is first placed in your program, there are two jump
label outputs. You can add or delete jump destinations.
Click the create icon inside the box (on the left of the last DEST parameter) to
add new outputs for jump labels.
Click a comparison operator inside the box and select a new operator
from the drop-down list.
Click the create icon inside the box (to the left of the last DEST param‐
eter) to add new comparison-destination parameters.
Table 8-139 SWITCH box data type selection and allowed comparison operations
You are not required to use a RET instruction as the last instruction in a block; this is done
automatically for you. You can have multiple RET instructions within a single block.
For SCL, see the RETURN (Page 301) statement.
Sample steps for using the RET instruction inside an FC code block:
1. Create a new project and add an FC:
2. Edit the FC:
– Add instructions from the instruction tree.
– Add a RET instruction, including one of the following for the "Return_Value" parameter:
TRUE, FALSE, or a memory location that specifies the required return value.
– Add more instructions.
3. Call the FC from MAIN [OB1].
The EN input on the FC box in the MAIN code block must be true to begin execution of the FC.
The value specified by the RET instruction in the FC will be present on the ENO output of the FC
box in the MAIN code block following execution of the FC for which power flow to the RET
instruction is true.
Calling ENDIS_PW with REQ=1 disallows password types where the corresponding password
input parameter is FALSE. Each password type can be allowed or disallowed independently. For
example, if the fail-safe password is allowed and all other passwords disallowed, then you can
restrict CPU access to a small group of employees.
ENDIS_PW is executed synchronously in a program scan and the password output parameters
always show the current state of password allowance independent of the input parameter REQ.
All passwords that you set to allow must be changeable to disallowed/allowed. Otherwise, an
error is returned and all passwords are allowed that were allowed before ENDIS_PW execution.
This means that in a standard CPU (where the fail-safe password is not configured) F_PWD must
always be set to 1, to result in a return value of 0. In this case, F_PWD_ON is always 1.
Note
• ENDIS_PW execution can block the access of HMI devices, if the HMI password is disallowed.
• Client sessions that were authorized prior to ENDIS_PW execution may be terminated by
ENDIS_PW execution dependent on the existing legitimization level. For example, a
connection legitimized with READ password protection will be aborted by ENDIS_PW
(REQ=1, R_PWD=0). Other lower protection level connections are also aborted under this
scenario. Accordingly, connections legitimized with FULL access are retained.
After a power‑up, CPU access is restricted by passwords previously defined in the regular CPU
protection configuration. The ability to disallow a valid password must be re-established with a
new ENDIS_PW execution. However, if ENDIS_PW is immediately executed and necessary
passwords are disallowed, then TIA portal access can be locked out. You can use a timer
instruction to delay ENDIS_PW execution and allow time to enter passwords, before the
passwords become disallowed.
Note
Restoring a CPU that locks out TIA portal communication
Refer to the "Recovery from a lost password (Page 126)" topic for details about how to erase the
internal load memory of a PLC using a memory card.
An operating mode change to STOP caused by errors, STP execution or STEP 7 does not abolish
the protection. The protection is valid until the CPU is power cycled. See the following table for
details.
WARNING
Unauthorized access to a protected CPU
Users with CPU full access or full access (incl. fail-safe) privileges have privileges to read and
write PLC variables. Regardless of the access level for the CPU, Web server users can have
privileges to read and write PLC variables. Unauthorized access to the CPU or changing PLC
variables to invalid values could disrupt process operation and could result in death, severe
personal injury and/or property damage.
Authorized users can perform operating mode changes, writes to PLC data, and firmware
updates. Siemens recommends that you observe the following security practices:
• Password protect CPU access levels (Page 152) and Web server user IDs (Page 808) with
strong passwords.
• Strong passwords are at least twelve characters, are not trivial or easy to guess, and include
at least three of the following:
– Uppercase letters
– Lowercase letters
– Digits
– Special characters
• A trivial password is one that is easy to guess. It is usually based on a characteristic of the
user, such as a pet’s name, family name, or the company where the user works. For
example: Siemens1$, June2015, or Qwerty1234.
• Best practices for generating strong but easy-to-remember passwords include the use of
meaningless short sentences and mixing several random words. For example:
PC;House#R3d
• Enable access to the Web server only with the HTTPS protocol.
• Do not extend the default minimum privileges of the Web server "Everybody" user.
• Perform error-checking and range-checking on your variables in your program logic
because Web page users can change PLC variables to invalid values.
• Use a secure Virtual Private Network (VPN) to connect to the S7-1200 PLC Web server from
a location outside your protected network.
RET_VAL Description
(W#16#...)
0000 No error
8090 The instruction is not supported.
80D0 The password for fail-safe is not configured.
80D1 The password for read/write access is not configured.
80D2 The password for read access is not configured.
80D3 The password for HMI access is not configured.
Use the RE_TRIGR instruction to restart the scan cycle monitoring timer during a single scan
cycle. This has the effect of extending the allowed maximum scan cycle time by one maximum
cycle time period, from the last execution of the RE_TRIGR function.
Note
Prior to S7-1200 CPU firmware version 2.2, RE_TRIGR was restricted to execution from a program
cycle OB and could be used to extend the PLC scan time indefinitely. ENO = FALSE and the
watchdog timer is not reset when RE_TRIGR was executed from a start up OB, an interrupt OB,
or an error OB.
For firmware version 2.2 and later, RE_TRIGR can be executed from any OB (including start up,
interrupt, and error OBs). However, the PLC scan can only be extended by a maximum of 10x the
configured maximum cycle time.
Watchdog timeout
If the maximum scan cycle timer expires before the scan cycle has been completed, an error is
generated. If the user program includes a time error interrupt OB (OB 80), the CPU executes the
time error interrupt OB, which can include program logic to create a special reaction.
If the user program does not include a time error interrupt OB, the first timeout condition is
ignored and the CPU remains in RUN mode. If a second maximum scan time timeout occurs in
the same program scan (2 times the maximum cycle time value), then an error is triggered that
causes a transition to STOP mode.
In STOP mode, your program execution stops while CPU system communications and system
diagnostics continue.
For more information see: Configuring the outputs on a RUN-to-STOP transition (Page 93).
If EN = TRUE, then the CPU goes to STOP mode, the program execution stops, and the ENO state
is meaningless. Otherwise, EN = ENO = 0.
8.8.8 GET_ERROR and GET_ERROR_ID (Get error and error ID locally) instructions
The get error instructions provide information about program block execution errors. If you add
a GET_ERROR or GET_ERROR_ID instruction to your code block, you can handle program errors
within your program block.
GET_ERROR
GET_ERROR_ID
Operation
By default, the CPU responds to a block execution error by logging an error in the diagnostics
buffer. However, if you place one or more GET_ERROR or GET_ERROR_ID instructions within a
code block, this block is now set to handle errors within the block. In this case, the CPU does not
log an error in the diagnostics buffer. Instead, the error information is reported in the output of
the GET_ERROR or GET_ERROR_ID instruction. You can read the detailed error information with
the GET_ERROR instruction, or read just the error identifier with GET_ERROR_ID instruction.
Normally the first error is the most important, with the following errors only consequences of the
first error.
The first execution of a GET_ERROR or GET_ERROR_ID instruction within a block returns the first
error detected during block execution. This error could have occurred anywhere between the
start of the block and the execution of either GET_ERROR or GET_ERROR_ID. Subsequent
executions of either GET_ERROR or GET_ERROR_ID return the first error since the previous
execution of GET_ERROR or GET_ERROR_ID. The history of errors is not saved, and execution of
either instruction will re-arm the PLC system to catch the next error.
The ErrorStruct data type used by the GET_ERROR instruction can be added in the data block
editor and block interface editors, so your program logic can access these values. Select
ErrorStruct from the data type drop-down list to add this structure. You can create multiple
ErrorStruct elements by using unique names. The members of an ErrorStruct cannot be
renamed.
If you want to measure the runtime of your entire program, call the instruction "Measure
program runtime" in OB 1. Measurement of the runtime is started with the first call and the
output RET_VAL returns the runtime of the program after the second call. The measured runtime
includes all CPU processes that can occur during the program execution, for example,
Note
The CPU cannot exactly determine the runtime of a command sequence, because the sequence
of instructions within a command sequence changes during optimized compilation of the
program.
Network 2:
Network 3:
When the "Tag_1" operand in network 1 has the signal state "1", the RUNTIME instruction
executes. The starting point for the runtime measurement is set with the first call of the
instruction and buffered as reference for the second call of the instruction in the "Mem" operand.
The function block FB1 executes in network 2.
When the FB1 program block completes and the "Tag_1" operand has the signal state "1", the
RUNTIME instruction in network 3 executes. The second call of the instruction calculates the
runtime of the program block and writes the result to the output RET_VAL_2.
SCL Description
IF "condition" THEN If "condition" is TRUE or 1, then execute the following statements until en‐
statement_A; countering the END_IF statement.
statement_B; If "condition" is FALSE or 0, then skip to END_IF statement (unless the program
statement_C; includes optional ELSIF or ELSE statements).
;
[ELSIF "condition-n" THEN The optional ELSEIF1 statement provides additional conditions to be evaluated.
statement_N; For example: If "condition" in the IF-THEN statement is FALSE, then the pro‐
;] gram evaluates "condition-n". If "condition-n" is TRUE, then execute "state‐
ment_N".
[ELSE The optional ELSE statement provides statements to be executed when the
statement_X; "condition" of the IF-THEN statement is FALSE.
;]
END_IF; The END_IF statement terminates the IF-THEN instruction.
1
You can include multiple ELSIF statements within one IF-THEN statement.
Variables Description
"condition" Required. The logical expression is either TRUE (1) or FALSE (0).
"statement_A" Optional. One or more statements to be executed when "condition" is TRUE.
"condition-n" Optional. The logical expression to be evaluated by the optional ELSIF statement.
"statement_N" Optional. One or more statements to be executed when "condition-n" of the ELSIF statement is
TRUE.
"statement_X" Optional. One or more statements to be executed when "condition" of the IF-THEN statement is
FALSE.
SCL Description
CASE "Test_Value" OF The CASE statement executes one of several
"ValueList": Statement[; Statement, ...] groups of statements, depending on the value
"ValueList": Statement[; Statement, ...] of an expression.
[ELSE
Else-statement[; Else-statement, ...]]
END_CASE;
Parameter Description
"Test_Value" Required. Any numeric expression of data type Int
"ValueList" Required. A single value or a comma-separated list of values or ranges of values. (Use two
periods to define a range of values: 2..8) The following example illustrates the different variants
of the value list:
1: Statement_A;
2, 4: Statement _B;
3, 5..7,9: Statement _C;
Statement Required. One or more statements that are executed when "Test_Value" matches any value in
the value list
Else-statement Optional. One or more statements that are executed if no match with a value of the "ValueList"
stated matches
CASE "var1" OF
1 : #var2 := 'A';
2 : #var2 := 'B';
ELSE
CASE "var3" OF
#var2:= 'SpecialCharacter';
END_CASE;
END_CASE;
SCL Description
FOR "control_variable" := "begin" TO "end" A FOR statement is used to repeat a sequence of
[BY "increment"] DO statements as long as a control variable is within the
statement; specified range of values. The definition of a loop
; with FOR includes the specification of an initial and
END_FOR; an end value. Both values must be the same type as
the control variable.
You can nest FOR loops. The END_FOR statement
refers to the last executed FOR instruction.
Parameter Description
"control_variable" Required. An integer (Int or DInt) that serves as a loop counter
"begin" Required. Simple expression that specifies the initial value of the control variables
"end" Required. Simple expression that determines the final value of the control variables
"increment" Optional. Amount by which a "control variable" is changed after each loop. The "increment" has
the same data type as "control variable". If the "increment" value is not specified, then the value
of the run tags will be increased by 1 after each loop. You cannot change "increment" during the
execution of the FOR statement.
SCL Description
WHILE "condition" DO The WHILE statement performs a series of statements until a given condition is TRUE.
Statement; You can nest WHILE loops. The END_WHILE statement refers to the last executed WHILE
Statement; instruction.
...;
END_WHILE;
Parameter Description
"condition" Required. A logical expression that evaluates to TRUE or FALSE. (A "null" condition is interpreted as
FALSE.)
Statement Optional. One or more statements that are executed until the condition evaluates to TRUE.
Note
The WHILE statement evaluates the state of "condition" before executing any of the statements.
To execute the statements at least one time regardless of the state of "condition", use the REPEAT
statement (Page 299).
SCL Description
REPEAT The REPEAT statement executes a group of statements until a given condition is TRUE.
Statement; You can nest REPEAT loops. The END_REPEAT statement always refers to the last executed
; Repeat instruction.
UNTIL "condition"
END_REPEAT;
Parameter Description
Statement Optional. One or more statements that are executed until the condition is TRUE.
"condition" Required. One or more expressions of the two following ways: A numeric expression or string
expression that evaluates to TRUE or FALSE. A "null" condition is interpreted as FALSE.
Note
Before evaluating the state of "condition", the REPEAT statement executes the statements during
the first iteration of the loop (even if "condition" is FALSE). To review the state of "condition"
before executing the statements, use the WHILE statement (Page 298).
To end the loop regardless of the state of the "condition" expression, use the EXIT statement
(Page 300). The EXIT statement executes the statement immediately following the END_REPEAT
statement.
Use the CONTINUE statement (Page 300) to skip the subsequent statements of a REPEAT loop
and to continue the loop with the examination of whether the condition is met for termination.
SCL Description
CONTINUE The CONTINUE statement skips the subsequent statements of a program loop (FOR, WHILE,
Statement; REPEAT) and continues the loop with the examination of whether the condition is met for
; termination. If this is not the case, the loop continues.
SCL Description
EXIT; An EXIT statement is used to exit a loop (FOR, WHILE or REPEAT) at any point, regardless of whether the
terminate condition is satisfied.
CASE value[i, 0] OF
1..10: value [i, 1]:="A";
11..40: value [i, 1]:="B";
41..100: value [i, 1]:="C";
ELSE
EXIT;
END_CASE;
END_FOR;
SCL Description
GOTO JumpLabel; The GOTO statement skips over statements by jumping to a label in the same block.
Statement; The jump label ("JumpLabel") and the GOTO statement must be in the same block. The
... ; name of a jump label can only be assigned once within a block. Each jump label can
JumpLabel: Statement; be the target of several GOTO statements.
It is not possible to jump to a loop section (FOR, WHILE or REPEAT). It is possible to jump from
within a loop.
Example: GOTO statement
In the following example: Depending on the value of the "Tag_value" operand, the execution of
the program resumes at the point defined by the corresponding jump label. If "Tag_value" equals
2, the program execution resumes at the jump label "MyLabel2" and skips "MyLabel1".
CASE "Tag_value" OF
1 : GOTO MyLabel1;
2 : GOTO MyLabel2;
ELSE GOTO MyLabel3;
END_CASE;
MyLabel1: "Tag_1" := 1;
MyLabel2: "Tag_2" := 1;
MyLabel3: "Tag_4" := 1;
SCL Description
RETURN; The Return instruction exits the code block being executed without conditions. Program execution
returns to the calling block or to the operating system (when exiting an OB).
Note
After executing the last instruction, the code block automatically returns to the calling block. Do
not insert a RETURN instruction at the end of the code block.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
To add an input, click the "Create" icon or right-click on an input stub for one of the
existing IN parameters and select the "Insert input" command.
To remove an input, right-click on an input stub for one of the existing IN parameters (when
there are more than the original two inputs) and select the "Delete" command.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
The DECO parameter OUT data type selection of a Byte, Word, or DWord restricts the useful range
of parameter IN. If the value of parameter IN exceeds the useful range, then a modulo operation
is performed to extract the least significant bits shown below.
DECO parameter IN range:
• 3 bits (values 0-7) IN are used to set 1 bit position in a Byte OUT
• 4-bits (values 0-15) IN are used to set 1 bit position in a Word OUT
• 5 bits (values 0-31) IN are used to set 1 bit position in a DWord OUT
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
1
For LAD and FBD: Click the "???" and select a data type from the drop-down menu.
To add an input, click the "Create" icon or right-click on an input stub for one of
the existing IN parameters and select the "Insert input" command.
To remove an input, right-click on an input stub for one of the existing IN parameters (when
there are more than the original two inputs) and select the "Delete" command.
To add an output, click the "Create" icon or right-click on an output stub for one of
the existing OUT parameters and select the "Insert output" command.
To remove an output, right-click on an output stub for one of the existing OUT parameters (when
there are more than the original two outputs) and select the "Delete" command.
Table 8-185 ENO status for the MUX and DEMUX instructions
1
For LAD and FBD: Click the "???" and select the data types from the drop-down menu.
Shift the bits of a Word to the left by inserting zeroes from the right (N = 1)
IN 1110 0010 1010 1101 OUT value before first shift: 1110 0010 1010 1101
After first shift left: 1100 0101 0101 1010
After second shift left: 1000 1010 1011 0100
After third shift left: 0001 0101 0110 1000
1
For LAD and FBD: Click the "???" and select the data types from the drop-down menu.
Rotate bits out the right -side into the left -side (N = 1)
IN 0100 0000 0000 0001 OUT value before first rotate: 0100 0000 0000 0001
After first rotate right: 1010 0000 0000 0000
After second rotate right: 0101 0000 0000 0000
out := TIME_TO_DINT(
in:=_variant_in);
1
For LAD and FBD boxes: Click "???" and select the source/target data types from the drop-down menu.
2
For SCL: Drag T_CONV from instruction tree and drop into the program editor, then select the source/target data types.
Note
Using T_CONV to convert a larger data size to a smaller data size
Data values can be truncated when you convert a larger data type with more bytes to a smaller
data type with less bytes. If this error occurs, then ENO is set to 0.
Table 9-3 T_ADD (Add times) and T_SUB (Subtract times) instructions
Table 9-4 Data types for the T_ADD and T_SUB parameters
Condition codes: ENO = 1 means no error occurred. ENO = 0 and parameter OUT = 0 errors:
• Invalid DTL value
• Invalid Time value
1
Note that the T_COMBINE instruction in the Extended Instructions equates to the CONCAT_DATE_TOD function in SCL.
WARNING
Risk of attacker accessing your networks through Network Time Protocol (NTP)
synchronization
If an attacker can access your networks through Network Time Protocol (NTP) synchronization,
the attacker can possibly disrupt control of your process by shifting the CPU system time.
Disruptions to process control can possibly cause death, severe injury, or property damage.
The NTP client feature of the S7‑1200 CPU is disabled by default, and, when enabled, only
allows configured IP addresses to act as an NTP server. The CPU disables this feature by default,
and you must configure this feature to allow remotely-controlled CPU system time corrections.
The S7‑1200 CPU supports "time of day" interrupts and clock instructions that depend upon
accurate CPU system time. If you configure NTP and accept time synchronization from a server,
you must ensure that the server is a trusted source. Failure to do so can cause a security breach
that allows an unknown user to disrupt control of your process by shifting the CPU system time.
For security information and recommendations, please see our "Operational Guidelines for
Industrial Security" (https://www.industry.siemens.com/topics/global/en/industrial-security/
Documents/operational_guidelines_industrial_security_en.pdf) on the Siemens Service and
Support site.
Use the clock instructions to set and read the CPU system clock. The data type DTL (Page 103)
is used to provide date and time values.
• The local time is calculated by using the time zone and daylight saving time offsets that you
set in the device configuration general tab "Time of day" parameters.
• Time zone configuration is an offset to UTC or GMT time.
• Daylight saving time configuration specifies the month, week, day, and hour when daylight
saving time begins.
• Standard time configuration also specifies the month, week, day, and hour when standard
time begins.
• The time zone offset is always applied to the system time value. The daylight saving time
offset is only applied when daylight saving time is in effect.
Note
Daylight saving and standard start time configuration
The "Time of day" properties for "Start for daylight saving time" of the CPU device
configuration must be your local time.
Condition codes: ENO = 1 means no error occurred. ENO = 0 means an execution error
occurred, and a condition code is provided at the RET_VAL output.
Description
The changeover rules for standard and daylight saving time are defined in the
TimeTransformationRule structure. The structure is as follows:
1
In the SCL example, "SET_TIMEZONE_DB" is the name of the instance DB.
To manually configure the time zone parameters for the CPU, use the "Time of day" properties of
the "General" tab of the device configuration.
Use the SET_TIMEZONE instruction to set the local time configuration. The parameters of the
"TimeTransformationRule (Page 314)" structure assign the local time zone and timing for
automatic switching between standard time and daylight saving time.
Note
Effect of the SET_TIMEZONE instruction on flash memory
The SET_TIMEZONE instruction performs write operations in flash memory (internal load
memory or memory card). To avoid reducing the lifetime of the flash memory, use the
SET_TIMEZONE instruction for infrequent updates.
Condition codes: ENO = 1 means no error occurred. ENO = 0 means an execution error
occurred, and a condition code is provided at the STATUS output.
STATUS Description
(W#16#....)
0 No error
7000 No job processing active
7001 Start of job processing. Parameter BUSY = 1, DONE = 0
7002 Intermediate call (REQ irrelevant): Instruction already active; BUSY has the value "1".
808x Error at x-th component: For example 8084 indicates that DaylightStartWeekif is not a value from 1to 5.
The CPU operates up to 10 runtime hour meters to track the runtime hours of critical control
subsystems. You must start the individual hour meters with one RTM execution for each timer.
All runtime hour meters are stopped when the CPU makes a run-to-stop transition. You can also
stop individual timers with RTM execution mode 2.
When a CPU makes a stop-to-run transition, you must restart the hour timers with one RTM
execution for each timer that is started. After a runtime meter value is greater than 2147483647
hours, counting stops and the "Overflow" error is sent. You must execute the RTM instruction
once for each timer to reset or modify the timer.
A CPU power failure or power cycle causes a power-down process that saves the current runtime
meter values in retentive memory. Upon CPU power-up, the stored runtime meter values are
reloaded to the timers and the previous runtime hour totals are not lost. The runtime meters
must be restarted to accumulate additional runtime.
Your program can also use RTM execution mode 7 to save the runtime meter values in a memory
card. The states of all timers at the instant RTM mode 7 is executed are stored in the memory
card. These stored values can become incorrect over time as the hour timers are started and
stopped during a program run session. You must periodically update the memory card values to
capture important runtime events. The advantage that you get from storing the RTM values in
the memory card is that you can insert the memory card in a substitute CPU where your program
and saved RTM values will be available. If you did not save the RTM values in the memory card,
then the timer values would be lost (in a substitute CPU).
Note
Avoid excessive program calls for memory card write operations
Minimize flash memory card write operations to extend the life of the memory card.
If the actual length of the string at the input IN exceeds the maximum length of a string stored
at output OUT, then the part of the IN string which can fit in the OUT string is copied.
9.2.3.1 S_CONV, STRG_VAL, and VAL_STRG (Convert to/from character string and number)
instructions
You can convert number character strings to number values or number values to number
character strings with these instructions:
• S_CONV converts (number string to a number value) or (number value to a number string)
• STRG_VAL converts a number string to a number value with format options
• VAL_STRG converts a number value to a number string with format options
1
For LAD / FBD: Click the "???" and select the data type from the drop-down list.
2
For SCL: Select S_CONV from the Extended Instructions, and answer the prompts for the data types for the conversion. STEP 7
then provides the appropriate conversion instruction.
Conversion of the string parameter IN starts at the first character and continues until the end of
the string, or until the first character is encountered that is not "0" through "9", "+", "-", or ".". The
result value is provided at the location specified in parameter OUT. If the output number value
does not fit in the range of the OUT data type, then parameter OUT is set to 0 and ENO is set to
FALSE. Otherwise, parameter OUT contains a valid result and ENO is set to TRUE.
Input String format rules:
• If a decimal point is used in the IN string, you must use the "." character.
• Comma characters "," used as a thousands separator to the left of the decimal point are
allowed and ignored.
• Leading spaces are ignored.
IN data type Character po‐ Converted string example1 Total string length including maximum and current
sitions allo‐ length bytes
cated by
S_CONV
USInt 4 "x255" 6
SInt 4 "-128" 6
UInt 6 "x65535" 8
Int 6 "-32768" 8
UDInt 11 "x4294967295" 13
DInt 11 "-2147483648" 13
Real 14 "x-3.402823E+38" 16
"x-1.175495E-38"
"x+1.175495E-38"
"x+3.402823E+38"
LReal 21 "-1.7976931348623E+308" 23
"-2.2250738585072E-308"
"+2.2250738585072E-308"
"+1.7976931348623E+308"
1
The "x" characters represent space characters that fill empty positions in the right-justified field that is allocated for the
converted value.
1
For LAD / FBD: Click the "???" and select the data type from the drop-down list.
Conversion begins in the string IN at character offset P and continues until the end of the string,
or until the first character is encountered that is not "+", "-", ".", ",", "e", "E", or "0" to "9". The result
is placed at the location specified in parameter OUT.
String data must be initialized before execution as a valid string in memory.
The FORMAT parameter for the STRG_VAL instruction is defined below. The unused bit positions
must be set to zero.
1
For LAD / FBD: Click the "???" and select the data type from the drop-down list.
The FORMAT parameter for the VAL_STRG instruction is defined below. The unused bit positions
must be set to zero.
FORMAT (WORD) Number sign character Notation format Decimal point representa‐
tion
W#16#0000 "-" only Fixed point "."
W#16#0001 ","
W#16#0002 Exponential "."
W#16#0003 ","
W#16#0004 "+" and "-" Fixed Point "."
W#16#0005 ","
W#16#0006 Exponential "."
W#16#0007 ","
W#16#0008 to W#16#FFFF Illegal values
• When the FORMAT is set to fixed point notation, integer, unsigned integer, and real data type
values are written to the output buffer as:
<leading spaces><sign><digits without leading zeroes>'.'<PREC digits>
• Leading zeros to the left of the decimal point (except the digit adjacent to the decimal point)
are suppressed.
• Values to the right of the decimal point are rounded to fit in the number of digits to the right
of the decimal point specified by the PREC parameter.
• The size of the output string must be a minimum of three bytes more than the number of
digits to the right of the decimal point.
• Values are right-justified in the output string.
ENO Description
1 No error
0 Illegal or invalid parameter; for example, an access to a DB that does not exist
0 Illegal string where the maximum length of the string is 0 or 255
0 Illegal string where the current length is greater than the maximum length
0 The converted number value is too large for the specified OUT data type.
0 The OUT parameter maximum string size must be large enough to accept the number of characters
specified by parameter SIZE, starting at the character position parameter P.
0 Illegal P value where P=0 or P is greater than the current string length
0 Parameter SIZE must be greater than parameter PREC.
The following examples of VAL_STRG conversions are based on an OUT string initialized as
follows:
"Current Temp = xxxxxxxxxx C"
where the "x" character represents space characters allocated for the converted value.
9.2.3.2 Strg_TO_Chars and Chars_TO_Strg (Convert to/from character string and array of
CHAR) instructions
Strg_TO_Chars copies an ASCII character string into an array of character bytes.
Chars_TO_Strg copies an array of ASCII character bytes into a character string.
Note
Only the zero based array types (Array [0..n] of Char) or (Array [0..n] of Byte) are allowed as the
input parameter Chars for the Chars_TO_Strg instruction, or as the IN_OUT parameter Chars for
the Strg_TO_Chars instruction.
ENO Description
1 No error
0 Chars_TO_Strg: Attempt to copy more character bytes to the output string than allowed by the maximum
length byte in the string declaration
0 Chars_TO_Strg: The nul character (16#00) value was found in the input character byte array.
0 Strg_TO_Chars: Attempt to copy more character bytes to the output array than are allowed by the element
number limit
9.2.3.3 ATH and HTA (Convert to/from ASCII string and hexadecimal number) instructions
Use the ATH (ASCII to hexadecimal) and HTA (hexadecimal to ASCII) instructions for conversions
between ASCII character bytes (characters 0 to 9 and uppercase A to F only) and the
corresponding 4-bit hexadecimal nibbles.
Conversion begins at the location specified by parameter IN and continues for N bytes. The result
is placed at the location specified by OUT. Only valid ASCII characters 0 to 9, lower case a to f, and
uppercase A to F can be converted. Any other character will be converted to zero.
8-bit ASCII coded characters are converted to 4-bit hexadecimal nibbles. Two ASCII characters
can converted into a single byte containing two 4-bit hexadecimal nibbles.
The IN and OUT parameters specify byte arrays and not hexadecimal String data. ASCII
characters are converted and placed in the hexadecimal output in the same order as they are
read. If there are an odd number of ASCII characters, then zeros are put in the right-most nibble
of the last converted hexadecimal digit.
Conversion begins at the location specified by parameter IN and continues for N bytes. Each 4-
bit nibble converts to a single 8-bit ASCII character and produces 2N ASCII character bytes of
output. All 2N bytes of the output are written as ASCII characters 0 to 9 through uppercase A to
F. The parameter OUT specifies a byte array and not a string.
Each nibble of the hexadecimal byte is converted into a character in the same order as they are
read in (left-most nibble of a hexadecimal digit is converted first, followed by the right-most
nibble of that same byte).
IN value N OUT character bytes ENO (ENO always TRUE after HTA execution)
W#16#0123 2 '0123' TRUE
DW#16#123AF012 4 '123AF012' TRUE
Your control program can use the following string and character instructions to create messages
for operator display and process logs.
9.2.4.4 LEFT, RIGHT, and MID (Read substrings in a character string) instructions
out := RIGHT(in, L); RIGHT (Right substring) provides the last L characters of a string.
• If L is greater than the current length of the IN string, then the entire
IN string is returned in parameter OUT.
• If an empty string is the input, then an empty string is returned in OUT.
If parameter L is equal to zero, then the string IN2 is inserted at position P of string IN1 without
deleting any characters from string IN1.
If P is equal to one, then the first L characters of string IN1 are replaced with string IN2 characters.
Parameter
The following table shows the parameters of the GetSymbolName instruction:
You specify the input parameters of the block interface at the VARIABLE parameter. Use only an
interface parameter for this parameter and not a PLC or data block tag.
To limit the length of the read tag name, use the SIZE parameter. If the instruction truncates the
name, it indicates the truncation by the characters "..." (Unicode character 16#2026) appears at
the end of the name. Note that this character has the length 1.
You can find additional information on valid data types under "Data types (Page 100)".
Create an input parameter inputValue with the BYTE data type in the Level1 block. Call the
GetSymbolName instruction in the Level1 block. Interconnect the parameters of the instruction
as follows.
The GetSymbolName instruction is executed in the Level1 block. Input parameter inputValue of
the Level1 block is examined for its interconnection using input parameter VARIABLE of the
instruction. In doing so, the symbolVALUE tag is read out and output as a character string at
output parameter OUT ("MySymNAME"). According to the value of input parameter SIZE, the
length of the character string is limited to 60 characters.
9.2.5.2 GetSymbolPath (Query composite global name of the input parameter assignment)
Parameter
The following table shows the parameters of the GetSymbolPath instruction:
You can find additional information on valid data types under "Data types (Page 100)".
Usage
Note the following tips on using the GetSymbolPath instruction:
• Specify the block interface through which the name of the input tag is read at the VARIABLE
parameter of the instruction:
– If a data block tag supplies the input parameter, GetSymbolPath outputs the name of the
DB, contained structures and the name of the tag.
– If a PLC tag supplies the input parameters GetSymbolPath outputs the name of the PLC tag.
– If a constant supplies the input parameter, GetSymbolPath outputs the constant value.
• To limit the length of the read tag name, use the SIZE parameter. If the name has been
truncated, this is indicated by the character "..." (Unicode character 16#2026) at the end of
the name. Note that this character has the length 1.
2%
)%B/HYHOB
(1 (12
ಯ0\'DWD%ORFNಯ0\6758&7
5(4 2XWSXWB ಯ7DJBಯ
0\6WDUWHU%LW
ಯ7DJBಯ ,QSXWB
ಯ7DJBಯ ,QSXWB
)%B/HYHOB
)%B/HYHOB
(1 (12
ಯ7DJBಯ ,QSXWB
ಯ7DJBಯ ,QSXWB
)%B/HYHOB
*HW6\PERO3DWK
(1 (12
5(4 YDULDEOH
:675,1*ಫ
VL]H ಯ0\'DWD%ORFNಯ
287 0\6758&7
0\6WDUWHU%LW
Parameter
The following table shows the parameters of the GetInstanceName instruction:
You can find additional information on valid data types under "Data types (Page 100)".
GetInstanceName writes out the name of the instance data block to the OUT parameter. The
instruction truncates the name if the name of the instance data block is longer than the
maximum length of WSTRING.
The Level1_gin block executes the GetInstanceName instruction, which determines the
associated instance data block of the Level1_gin block and outputs the name as a character
string at output parameter OUT (outputInstName). According to the value 0 of parameter SIZE
(limitSIZE), the length of the character string is unlimited.
Parameter
The following table shows the parameters of the GetInstancePath instruction:
You can find additional information on valid data types under "Data types (Page 100)".
The GetInstancePath instruction returns the following values for this example, depending on the
value of the SIZE parameter:
Note
Use of GetInstancePath in function blocks with single instance
If the function block in which you call GetInstancePath saves data in its own instance data block,
GetInstancePath outputs the name of the single instance as the global name. The result at
parameter OUT corresponds in this case to the GetInstanceName (Page 344) instruction.
Parameter
The following table shows the parameters of the GetBlockName instruction:
You can find additional information on valid data types under "Data types (Page 100)".
GetBlockName writes the name of the block at the RET_VAL parameter. If the name of the block
is longer than the maximum length of WSTRING, it truncates the name.
The Level1_gbn block executes the GetBlockName instruction. GetBlockName reads out the
name of the Level1_gbn block and outputs the name as a character string at output parameter
RET_VAL(outputBlockName). Because the SIZE parameter is 0 (limitSIZE), the length of the
character string is unlimited.
• SETIO instruction (Page 356): Consistently transfers data from the source range defined by
the OUTPUTS parameter to the addressed DP standard slave / PROFINET IO device.
• GETIO_PART instruction (Page 357): Consistently reads out a related part of the inputs of an
IO module.
• SETIO_PART instruction (Page 358): Consistently writes data from the source area spanned
by the OUTPUTS parameter to the outputs of an IO module.
• RALRM instruction (Page 359): Allows you to receive an interrupt with all corresponding
information from a module or device and supply this information to its output parameters.
• DPRD_DAT instruction (Page 371): Allows you to read consistent data areas greater than
64 bytes from a module or device with the DPRD_DAT instruction.
• DPWR_DAT instruction (Page 371): Allows you to write consistent data areas greater than
64 bytes to a module or device with the DPWR_DAT instruction.
The D_ACT_DP instruction (Page 362) allows you to disable and enable configured PROFINET IO
devices in a targeted manner. You can also determine whether each assigned PROFINET IO
device is currently activated or deactivated.
Note
Note: You can only use the D_ACT_DP instruction with PROFINET IO devices. You cannot use the
instruction with PROFIBUS DP slaves.
The DPNRM_DG instruction (Page 378) allows you to read the current diagnostic data of a DP
slave in the format specified by EN 50 170 Volume 2, PROFIBUS.
Note
You can only use the DPNRM_DG instruction with PROFIBUS.
record:=_variant_inout_);
"WRREC_DB"( Use the WRREC instruction to transfer a da‐
req:=_bool_in_, ta RECORD with the record number INDEX
ID:=_word_in_, to a DP slave/PROFINET IO device compo‐
index:=_dint_in_, nent addressed by ID, such as a module in
len:=_uint_in_, the central rack or a distributed component
done=>_bool_out_, (PROFIBUS DP or PROFINET IO).
busy=>_bool_out_, Assign the byte length of the data record to
error=>_bool_out_, be transmitted. The selected length of the
status=>_dword_out_, source area RECORD should, therefore,
have at least the length of LEN bytes.
record:=_variant_inout_);
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL examples, "RDREC_DB" and "WRREC_DB" are the names of the instance DBs.
Table 9-76 RDREC and WRREC data types for the parameters
The RDREC and WRREC instructions operate asynchronously, that is, processing covers multiple
instruction calls. Start the job by calling RDREC or WRREC with REQ = 1.
The job status is displayed via output parameter BUSY and the two central bytes of output
parameter STATUS. The transfer of the data record is complete when the output parameter BUSY
has been set to FALSE
A value of TRUE (only for one scan) on the output parameter VALID (RDREC) or DONE (WRREC)
verifies that the data record has been successfully transferred into the target area RECORD
(RDREC) or to the target device (WRREC). In the case of the RDREC, the output parameter LEN
contains the length of the fetched data in bytes.
The output parameter ERROR (only for one scan when ERROR = TRUE) indicates that a data record
transmission error has occurred. In this case, the output parameter STATUS (only for the one scan
when ERROR = TRUE) contains the error information.
Data records are defined by the hardware device manufacturer. Refer to the hardware
manufacturer's device documentation for details about a data record.
You can have up to four RDREC instructions and four WRREC instructions in use at the same time.
Note
If you configure a DPV1 slave with a GSD file (GSD rev. 3 and higher) and the DP interface of the
DP master is set to "S7 compatible", then you might not read any data records from the I/O
modules in the user program with "RDREC" or write to the I/O modules with "WRREC". In this case,
the DP master addresses the wrong slot (configured slot + 3).
Remedy: set the interface of the DP master to "DPV1".
Note
The interfaces of the "RDREC" and "WRREC" instructions are identical to the "RDREC" and "WRREC"
FBs defined in "PROFIBUS Guideline PROFIBUS Communication and Proxy Function Blocks
according to IEC 61131-3".
Note
If you use "RDREC" or "WRREC" to read or write a data record for PROFINET IO, then the CPU
interprets negative values in the INDEX, MLEN, and LEN parameters as unsigned 16-bit integers.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "GETIO_DB" is the name of the instance DB.
The destination area must have a length that is greater than or equal to the length of the selected
component.
If you read from a DP standard slave with a modular configuration or with several DP identifiers,
you only access the data of one component / DP identifier at the configured start address with
a "GETIO" call.
Parameters
The following table shows the parameters of the "GETIO" instruction:
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "SETIO_DB" is the name of the instance DB.
The source range must have a length that is greater than or equal to the length of the selected
component.
In the case of a DP standard slave / PROFINET IO device with modular configuration or with
several DP identifiers, you can only access one DP identifier / component per "SETIO" call.
Parameters
The following table shows the parameters of the "SETIO" instruction:
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "GETIO_PART_DB" is the name of the instance DB.
Use the ID input parameter to select the IO module by means of the hardware ID.
Use the OFFSET and LEN parameters to specify the portion of the process image area to be read.
If the input area spanned by OFFSET and LEN is not completely covered by the module, the block
returns the error code DW#16#4080B700.
The length of the destination area must be larger than or equal to the amount of bytes to be read:
• If there is no error during the data transmission, ERROR receives the value FALSE. The data
that is read is written to the destination area defined at the INPUTS parameter.
• If there is an error during the data transmission, ERROR receives the value TRUE. The STATUS
parameter receives the error information from DPRD_DAT.
• If the destination area is greater than LEN, the instruction writes to the first LEN bytes of the
destination area. ERROR receives the value FALSE.
Parameters
The following table shows the parameters of the GETIO_PART instruction:
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "SETIO_PART_DB" is the name of the instance DB.
With the input parameter ID, you select the I/O module based on the hardware identified.
With the parameters OFFSET and LEN, you assign the portion of the process image area to be
written for the component addressed by ID. If the output area spanned by OFFSET and LEN is not
completely covered by the module, the block returns the error code DW#16#4080B700.
The length of the destination area must be larger than or equal to the amount of bytes to be read:
• If there is no error during the data transmission, ERROR receives the value FALSE.
• If there is an error during the data transmission, ERROR receives the value TRUE, and STATUS
receives the error information of DPWR_DAT.
• If the source area is greater than LEN, the instruction transfers the first LEN bytes from
OUTPUTS. ERROR receives the value FALSE.
Parameters
The following table shows the parameters of the SETIO_PART instruction:
Note
If you call "RALRM" in an OB whose start event is not an I/O interrupt, the instruction will provide
correspondingly reduced information in its outputs.
Make sure to use different instance DBs when you call "RALRM" in different OBs. If you evaluate
data from an "RALRM" call outside of the associated interrupt OB, use a separate instance DB per
OB start event.
Note
The interface of the "RALRM" instruction is identical to the "RALRM" FB defined in "PROFIBUS
Guideline PROFIBUS Communication and Proxy Function Blocks according to IEC 61131-3".
Calling RALRM
You can call the RALRM instruction in three different operating modes (MODE).
MODE Description
0 • ID contains the hardware identifier of the I/O module that triggered the interrupt.
• Output parameter NEW is set to TRUE.
• LEN produces an output of 0.
• AINFO and TINFO are not updated with any information.
1 • ID contains the hardware identifier of the I/O module that triggered the interrupt.
• Output parameter NEW is set to TRUE.
• LEN produces an output of the amount in bytes of AINFO data that is returned.
• AINFO and TINFO are updated with interrupt-related information.
2 If the hardware identifier assigned to input parameter F_ID has triggered the interrupt then:
• ID contains the hardware identifier of the I/O module that triggered the interrupt. Should be the same as
the value at F_ID.
• Output parameter NEW is set to TRUE.
• LEN produces an output of the amount in bytes of AINFO data that is returned.
• AINFO and TINFO are updated with interrupt-related information.
Note
If you assign a destination area for TINFO or AINFO that is too short, RALRM cannot return the full
information.
MLEN can limit the amount of AINFO data that is returned.
Refer to the AINFO parameters and TINFO parameters of the online information system of STEP 7
for information on how to interpret the TINFO and AINFO data.
Same for OBs: Status, Update, Profile, Diag‐ 0 SI_Format OB_Class OB_Nr
nostic error interrupt, Pull or plug of mod‐
ules, Rack or station failure
4 LADDR
Note
Refer to the online information system of STEP 7 for more detailed information on TINFO data.
Note
You can only use the D_ACT_DP instruction with PROFINET IO devices. You cannot use the
instruction with PROFIBUS DP slaves.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "D_ACT_DP_SFB_DB" is the name of the instance DB.
You cannot disable/enable an IE/PB Link PN IO type of gateway using the D_ACT_DP instruction.
If you nevertheless use D_ACT_DP on the gateway named, the CPU returns the value
W#16#8093 (there is no hardware object that can be activated or deactivated for the address
specified in LADDR).
Note
The disabling or enabling job requires several runs through the cycle control point. Therefore,
you cannot wait for the end of such a job in a programmed loop.
Functional description
D_ACT_DP is an asynchronous instruction, which means that the job processing extends over
multiple D_ACT_DP instruction executions. You start the job by calling D_ACT_DP with REQ = 1.
The output parameters RET_VAL and BUSY indicate the status of the job.
Application
If you configure PROFINET IO devices in a CPU which are not actually present or not currently
required, the CPU nevertheless continues to access these PROFINET IO devices at regular
intervals. After the devices are deactivated, further CPU accessing stops. The corresponding
error events no longer occur.
Examples
From a machine OEM's point of view, there are numerous device options possible in series
production of machines. However, each delivered machine includes only one combination of
selected options.
The manufacturer configures every one of these possible machine options as a PROFINET IO
device. The manufacturer does this in order to create and maintain a common user program
having all possible options. Use D_ACT_DP to deactivate all PROFINET IO devices not present at
machine startup.
A similar situation exists for machine tools having numerous tooling options available, but
actually using only a few of them at any given time. These tools are implemented as PROFINET
IO devices. With D_ACT_DP, the user program activates the tools currently needed and
deactivates those required later.
Identification of a job
If you have started a deactivation or activation job and you call D_ACT_DP again before the job
is complete, the behavior of the instruction depends on whether or not the new call involves the
same job. If the input parameter LADDR matches, the call is interpreted as a follow-on call.
Note
Activating a PROFINET IO device can be time-consuming. If you want to cancel a currently
running activation job, start D_ACT_DP with the same value for LADDR and MODE = 2. You
repeat the call for D_ACT_DP with MODE = 2 until the successful cancellation of the activation
job is displayed with RET_VAL = 0.
Parameters
The following table shows the parameters of the D_ACT_DP instruction:
Parameter RET_VAL
9.3.10 Others
• The S7-1200 CPU supports consistent peripheral I/O read or write of 1, 2, or 4 bytes. Use the
DPRD_DAT instruction to consistently read and the DPWR_DAT instruction to consistently
write data of lengths other than 1, 2, or 4 bytes.
• You can use these instructions for data areas of 1 or more bytes. If the access is rejected, error
code W#16#8090 results.
• PROFINET supports up to 1024 bytes of consistent data. You do not need to use these
instructions for consistent transfers between the S7-1200 and PROFINET devices.
Note
If you are using the DPRD_DAT and DPWR_DAT instructions with consistent data, you must
remove this consistent data from the process-image automatic update. Refer to "PLC concepts:
Execution of the user program" (Page 65) for more information.
DPRD_DAT operations
Use the parameter LADDR to select the module of the DP standard slave / PROFINET IO device.
If an access error occurs on the addressed module, the error code W#16#8090 is output.
Use the parameter RECORD to define the target range of the read data:
• The target range has to be at least as long as the inputs of the selected module. Only the
inputs are transferred; the other bytes are not considered. If you read from a DP standard
slave with a modular configuration or with several DP identifiers, you can only access the data
of a module of the configured hardware identifier for each DPRD_DAT instruction call. If you
select a target range that is too small, the error code W#16#80B1 is output at the RET_VAL
parameter.
• The following data types can be used: Byte, Char, Word, DWord, Int, UInt, USInt, SInt, DInt,
UDInt. The use of these data types in a User Defined Type (UDT) data structure of the type
ARRAY or STRUCT is permissible.
• The data type STRING is not supported.
• If there was no error during the data transmission, the data that have been read are entered
in the target range defined at the parameter RECORD.
DPWR_DAT operations
Use the parameter LADDR to select the module of the DP standard slave / PROFINET IO device.
If an access error occurs on the addressed module, the error code W#16#8090 is output.
Use the parameter RECORD to define the source range of the data to be written:
• The source range has to be at least as long as the outputs of the selected module. Only the
outputs are transferred; the other bytes are not considered. If the source range at the
parameter RECORD is longer than the outputs of the configured module, only the data up to
the maximum length of the outputs is transferred. If the source range at the parameter
RECORD is shorter than the outputs of the configured module, the error code W#16#80B1 is
output at the RET_VAL parameter.
• The following data types can be used: Byte, Char, Word, DWord, Int, UInt, USInt, SInt, DInt,
UDInt. The use of these data types in a User Defined Type (UDT) data structure of the type
ARRAY or STRUCT is permissible.
Error codes
Note
If you access DPV1 slaves, error information from these slaves can be forwarded from the DP
master to the instruction.
Note
If the I-device has received a request for a data record receipt, you must recognize the delivery
of this request within a certain duration. After recognition, you must send an answer to the
higher-level controller within this time period. Otherwise, the I-device experiences a timeout
error which causes the operating system of the I-device to send a negative answer to the higher-
level controller. For information on the value for the time period, refer to the specifications of
your CPU.
The STATUS output parameter receives the error information after the occurrence of an error.
Operating modes
You can determine the operating mode of the RCVREC instruction with the input parameter
MODE. This step is explained in the following table:
MODE Meaning
0 Check whether a request for a data record receipt exists
If a data record from a higher-level controller exists on the I-device, the instruction only writes to the NEW, SLOT,
SUBSLOT, INDEX, and LEN output parameters. If you call the instruction several times with MODE = 0, then the
output parameter only refers to one and the same request.
1 Receiving a data record for any subslot of the I-device
If a data record from a higher-level controller exists on the I-device for any subslot of the I-device, the instruction
writes to the output parameter and transfers the data record to the parameter RECORD.
2 Receiving a data record for a specific subslot of the I-device
If a data record from a higher-level controller exists on the I-device for a specific subslot of the I-device, the
instruction writes to the output parameter and transfers the data record to the parameter RECORD.
3 Sending a positive answer to the higher-level controller
The instruction checks the request of the higher-level controller to receive a data record, accepts the existing data
record, and sends a positive acknowledgment to the higher-level controller.
4 Sending a negative answer to the higher-level controller
The instruction checks the request of the higher-level controller to receive a data record, rejects the existing data
record, and sends a negative acknowledgment to the higher-level controller. Enter the reason for the rejection in
the input parameters CODE1 and CODE2.
Note
After the receipt of a data record (NEW = 1), you must call the RCVREC instruction twice to ensure
complete processing. You must do this in the following order:
• First call with MODE = 1 or MODE = 2
• Second call with MODE = 3 or MODE = 4
Parameters
The following table shows the parameters of the RCVREC instruction:
If a request to make a data record available exists, (MODE = 0), the output parameter NEW is set
to TRUE.
If the request for making a data record available is accepted, write RECORD for the positive
answer to the higher-level controller with the requested data record and write zero for CODE1
and CODE2. If the request for making a data record available is to be rejected, enter the negative
answer to the higher-level controller in Error Code 1 of the CODE1 and in Error Code 2 of the
CODE2.
Note
If the I-device has received a request for making a data record available, you must recognize the
delivery of this request within a certain time period. After recognition, you must send an answer
to the higher-level controller within this time period. Otherwise, the I-device experiences a
timeout error which causes the operating system of the I-device to send a negative answer to the
higher-level controller. For information on the value for the time period, refer to the
specifications of your CPU.
The STATUS output parameter receives the error information after the occurrence of an error.
Operating modes
You can determine the operating mode of the PRVREC instruction with the input parameter
MODE. This step is explained in the following table:
MODE Meaning
0 Check whether a request for making a data record available exists
If a request from a higher-level controller for making a data record available exists on the I-device, the instruction
only writes to the NEW, SLOT, SUBSLOT, INDEX, and RLEN output parameters. If you call the instruction several
times with MODE = 0, then the output parameter only refers to one and the same request.
1 Receiving a request for making a data record available for any subslot of the I-device
If such a request from a higher-level controller for any subslot of the I-device exists on the I-device, the instruction
writes to the output parameter.
2 Receiving a request for making a data record available for a specific subslot of the I-device
If such a request from a higher-level controller for a specific subslot of the I-device exists on the I-device, the
instruction writes to the output parameter.
3 Make the data record available and send a positive answer to the higher-level controller
The instruction checks the request of the higher-level controller to make a data record available, makes the request
data record available to RECORD, and sends a positive acknowledgement to the higher-level controller.
4 Sending a negative answer to the higher-level controller
The instruction checks the request of the higher-level controller to make a data record available, rejects this
request, and sends a negative acknowledgement to the higher-level controller. Enter the reason for the rejection
in the input parameters CODE1 and CODE2.
Note
After the receipt of a request (NEW = 1), you must call the PRVREC instruction twice to ensure
complete processing. You must do this in the following order:
• First call with MODE = 1 or MODE = 2
• Second call with MODE = 3 or MODE = 4
Parameters
The following table shows the parameters of the PRVREC instruction:
You start the read job by assigning 1 to the input parameter REQ in the DPNRM_DG instruction
call. The read job is executed asynchronously, in other words, it requires several DPNRM_DG
instruction calls. The status of the job is indicated by the output parameters RET_VAL and BUSY.
Byte Description
0 Station status 1
1 Station status 2
2 Station status 3
3 Master station number
4 Vendor ID (high byte)
5 Vendor ID (low byte)
6 ... Additional slave-specific diagnostic information
Refer to "Extended instructions, Distributed I/O: Error information for RDREC, WRREC, and
RALRM" (Page 367) for more information on general error codes.
9.4 PROFIenergy
PROFIenergy is a manufacturer- and device-neutral profile for energy management with
PROFINET. To reduce electricity consumption during breaks in production and unplanned
interruptions, it is possible to shut down equipment in a coordinated and centralized manner
using PROFIenergy.
The PROFINET IO controller switches off the PROFINET devices/power modules using special
commands in the user program. You require no additional hardware. The PROFINET devices
interpret the PROFIenergy commands directly.
The S7-1200 CPU does not support the PE controller functionality. The S7-1200 CPU can only act
as a PROFIenergy entity (with I-device functionality).
Reference information
You can find further information on PROFIenergy in the TIA Portal STEP 7 online help. You can
find examples that use the PROFIenergy instructions in the Industry Online Support in the entry
"PROFIenergy - Saving Energy with SIMATIC S7 (https://support.automation.siemens.com/WW/
view/en/41986454)".
9.5 Interrupts
OB_NR parameter
All existing hardware-interrupt OB names appear in the device configuration "HW interrupt:"
drop-down list and in the ATTACH / DETACH parameter OB_NR drop-list.
EVENT parameter
When a hardware interrupt event is enabled, a unique default event name is assigned to this
particular event. You can change this event name by editing the "Event name:" edit box, but it
must be a unique name. These event names become tag names in the "Constants" tag table, and
appear on the EVENT parameter drop-down list for the ATTACH and DETACH instruction boxes.
The value of the tag is an internal number used to identify the event.
General operation
Each hardware event can be attached to a hardware-interrupt OB which will be queued for
execution when the hardware interrupt event occurs. The OB-event attachment can occur at
configuration time or at run time.
You have the option to attach or detach an OB to an enabled event at configuration time. To
attach an OB to an event at configuration time, you must use the "HW interrupt:" drop-down list
(click on the down arrow on the right) and select an OB from the list of available hardware-
interrupt OBs. Select the appropriate OB name from this list, or select "<not connected>" to
remove the attachment.
You can also attach or detach an enabled hardware interrupt event during run time. Use the
ATTACH or DETACH program instructions during run time (multiple times if you wish) to attach
or detach an enabled interrupt event to the appropriate OB. If no OB is currently attached (either
from a "<not connected>" selection in device configuration, or as a result of executing a DETACH
instruction), the enabled hardware interrupt event is ignored.
DETACH operation
Use the DETACH instruction to detach either a particular event or all events from a particular OB.
If an EVENT is specified, then only this one event is detached from the specified OB_NR; any other
events currently attached to this OB_NR will remain attached. If no EVENT is specified, then all
events currently attached to OB_NR will be detached.
Condition codes
2%FDOOZLWKRXWSKDVHVKLIW
581
W W W W
2%
+LJKHUSULRULW\
W W W W
2%
ORZSULRULW\
If you want to start the execution of a lower priority OB on a fixed time cycle, then phase shift
time should be greater then the processing time of higher priority OBs.
2%FDOOZLWKSKDVHVKLIW
581
W W W W
2%
+LJKHUSULRULW\
W W W W
2%
ORZSULRULW\
3KDVHVKLIW
If an error occurs, RET_VAL displays the appropriate error code and the parameter STATUS = 0.
WARNING
Risk of attacker accessing your networks through Network Time Protocol (NTP)
synchronization
If an attacker can access your networks through Network Time Protocol (NTP) synchronization,
the attacker can possibly disrupt control of your process by shifting the CPU system time.
Disruptions to process control can possibly cause death, severe injury, or property damage.
The NTP client feature of the S7‑1200 CPU is disabled by default, and, when enabled, only
allows configured IP addresses to act as an NTP server. The CPU disables this feature by default,
and you must configure this feature to allow remotely-controlled CPU system time corrections.
The S7‑1200 CPU supports "time of day" interrupts and clock instructions that depend upon
accurate CPU system time. If you configure NTP and accept time synchronization from a server,
you must ensure that the server is a trusted source. Failure to do so can cause a security breach
that allows an unknown user to take limited control of your process by shifting the CPU system
time.
For security information and recommendations, please see "Operational Guidelines for
Industrial Security" (https://www.industry.siemens.com/topics/global/en/industrial-security/
Documents/operational_guidelines_industrial_security_en.pdf) on the Siemens Service and
Support site.
Table 9-107 SET_TINTL (Set date and time of day interrupt with DTL data type)
Your program can use SET_TINTL to set a date and time of day interrupt event that will execute
the assigned interrupt OB. The start date and time is set by parameter SDT and the time period
for recurring interrupts (for example, daily or weekly) is set by parameter PERIOD. If you set the
repetition period to monthly, then you must set the start date to a day from 1 to 28. The days 29
to 31 may not be used because they do not occur in February. If you want an interrupt event at
the end of each month, then use end of month for parameter PERIOD.
The DTL data weekday value in parameter SDT is ignored. Set a CPU's current date and time using
the "Set time of day" function in the "Online & diagnostics" view of an online CPU. You must set
the month, day of month, and year. STEP 7 calculates the interrupt period based on the CPU date
and time clock.
Note
The first hour of the day does not exist when changing from summer to winter (daylight saving
time). Use a start time within the second hour or use an additional time delay interrupt within
the first hour.
ret_val := QRY_DINT( QRY_DINT queries the status of the time delay inter‐
ob_nr:=_int_in_, rupt specified by the OB_NR parameter.
status=>_word_out_)
;
Operation
When EN=1, the SRT_DINT instruction starts the internal time delay timer (DTIME). When the
time delay elapses, the CPU generates a program interrupt that triggers the execution of the
associated time delay interrupt OB. You can cancel an in-process time delay interrupt before the
specified time delay occurs by executing the CAN_DINT instruction. The total number of active
time delay interrupt events must not exceed four.
Note
The SRT_DINT starts the time delay timer on every scan when EN=1. Assert EN=1 as a one-shot
rather than just setting EN=1 to begin your time delay.
1
(1
WPV
'7,0(
Condition codes
RET_VAL Description
(W#16#...)
0000 No error occurred
8090 Incorrect parameter OB_NR
8091 Incorrect parameter DTIME
80A0 Time delay interrupt has not started.
EN_AIRT(); EN_AIRT enables the processing of interrupt events that you previously disabled with
the DIS_AIRT instruction. Each DIS_AIRT execution must be cancelled by an EN_AIRT
execution.
The EN_AIRT executions must occur within the same OB, or any FC or FB called from
the same OB, before interrupts are enabled again for this OB.
The DIS_AIRT executions are counted by the operating system. Each of these remains in effect
until it is cancelled again specifically by an EN_AIRT instruction, or until the current OB has been
completely processed. For example: if you disabled interrupts five times with five DIS_AIRT
executions, you must cancel these with five EN_AIRT executions before interrupts become
enabled again.
After the interrupt events are enabled again, the interrupts that occurred while DIS_AIRT was in
effect are processed, or the interrupts are processed as soon as the current OB has been executed.
Parameter RET_VAL indicates the number of times that interrupt processing was disabled, which
is the number of queued DIS_AIRT executions. Interrupt processing is only enabled again when
parameter RET_VAL = 0.
9.6 Alarms
Parameters
The following table shows the parameters of the "Gen_UsrMsg" instruction:
For additional information on valid data types, refer to "Data types (Page 100)".
Parameter AssocValues
Use the system data type AssocValues to define which associated values will be sent. A
maximum of eight associated values are possible. Enter the data type "AssocValues" as a data
block to create the structure.
You select associated values by entering the numbers of the associated values for the
parameters Value[x]. Note the following:
• The Gen_UsrMsg instruction treats the values for TextID and TextListID as associated values
to be sent. As a result, "1" and "2" are pre-assigned as numbers for addressing associated
values. Do not use the numbers "1" or "2" to address associated values.
• Address the associated value at parameter Value [1] as number "3", at parameter Value [2] as
number "4", and so forth.
Parameter RET_VAL
The following table defines output values for the RET_VAL parameter. See also Common error
codes for the Extended instructions (Page 503).
• Get_Name instruction (Page 409): Reads the name of a PROFINET IO device, PROFIBUS slave,
or AS-i slave.
• GetStationInfo instruction (Page 415): Reads the IP or MAC address of a PROFINET IO device
in the local IO system or a PROFINET IO device located in a lower-level IO system (connected
using CP/CM modules).
• DeviceStates instruction (Page 423): Retrieves the operational states for a distributed I/O
device within an I/O subsystem.
• ModuleStates instruction (Page 427): Retrieves the operational states for the modules in a
distributed I/O device.
• GET_DIAG instruction (Page 432): Reads the diagnostic information from a specified device.
Note
You can only use the GetStationInfo instruction with PROFINET IO devices. You cannot use the
instruction with PROFIBUS DP slaves.
Description
Parameter
The following table shows the parameters of the "RD_SINFO" instruction:
You will find more detailed information on valid data types in "Data types (Page 100)".
Organization blocks (OB) System data types (SDT) System data type numbers
Any SI_classic* 592*
SI_none 593
ProgramCycleOB SI_ProgramCycle 594
TimeOfDayOB SI_TimeOfDay 595
TimeDelayOB SI_Delay 596
CyclicOB SI_Cyclic 597
ProcessEventOB SI_HWInterrupt 598
ProfileEventOB SI_Submodule 601
StatusEventOB
UpdateEventOB
SynchronousCycleOB SI_SynchCycle 602
IOredundancyErrorOB SI_IORedundancyError 604
CPUredundancyErrorOB SI_CPURedundancyError 605
TimeErrorOB SI_TimeError 606
DiagnosticErrorOB SI_DiagnosticInterrupt 607
PullPlugEventOB SI_PlugPullModule 608
PeripheralAccessErrorOB SI_AccessError 609
RackStationFailureOB SI_StationFailure 610
ServoOB SI_Servo 611
IpoOB SI_Ipo 612
StartupOB SI_Startup 613
ProgrammingErrorOB SI_ProgIOAccessError 614
IOaccessErrorOB
*The SI_classic SDT is not applicable for the S7-1200. The S7-1200 CPU returns a RET_VAL of #16#8081 if the TOP_SI parameter
is of type SI_classic.
*The SI_classic SDT is not applicable for the S7-1200. The S7-1200 CPU returns a RET_VAL of #16#8083 if
the START_UP_SI parameter is of type SI_classic.
Structures
The following tables define the structure elements of the individual structures:
Note
If this was created with the block property "Standard", the structure elements specified for the
SI_classic structure are identical in content to the temporary tags of an OB.
Note, however, that temporary tags of the individual OBs can have different names and
different data types. Also note that the call interface of each OB includes additional information
regarding the date and the time of the OB request.
Bits 4 to 7 of the EV_CLASS structure element contain the event class. The following values are
possible here:
• 1: Start events from standard OBs
• 2: Start events from synchronous error OBs
• 3: Start events from asynchronous error OBs
The PRIORITY structure element supplies the priority class belonging to the current OB.
Apart from these two elements, NUM is also relevant. NUM contains the number of the current
OB or the startup OB that was started last.
RET_VAL parameter
The following table shows the meaning of the values of the RET_VAL parameter:
Error Explanation
code*
(W#16#...)
8081 Start information of the current OB does not correspond to the specified system data type
8083 Start information of the last startup OB started does not correspond to the specified system data type
* You can display the error code as either integer or hexadecimal values in the program editor.
Example
A time error interrupt OB (OB 80) is the OB that was called last and that has not yet been
completely processed. Startup OB (OB 100) is the startup OB that was started last. The
instruction call to read the startup information is as follows, where RD_SINFO_DB is the data
block that contains tags of the SDTs for types of OBs:
The following table shows the assignment between the structure elements of the TOP_SI
parameter of the "RD_SINFO" instruction and the associated local tags of OB 80.
The following table shows the assignment between the structure elements of the START_UP_SI
parameter of the "RD_SINFO" instruction and the associated local tags of OB 100.
Identification and maintenance (I&M) data can help you to check the system configuration,
detect hardware changes, or view maintenance data. Module identification data (I data) is read
only. Module maintenance data (M data) depends on system information, such as the
installation date. M data are created during maintenance planning and written to the module:
• If the data type used at the parameter DATA is a string, then the current length of the string
is set according to the length of the I&M data.
• If the data type used at the parameter DATA is an array of Byte or Char, then the I&M data are
copied in as a sequence of bytes.
• If the data type used at the parameter DATA is a structure, then the I&M data are copied in as
a sequence of bytes.
• If the given array of byte/char at DATA is longer than the requested I&M data, then the byte
value 16#00 is appended.
• Other data types are not supported and error 8093 is returned.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "Get_Name_DB" is the name of the instance DB.
You select the IO device by using the hardware identifier of the distributed IO system (at the
LADDR parameter) and the device number of the PROFINET IO device or the PROFIBUS address
of the PROFIBUS slave (at the STATION_NR parameter).
Once the instruction has been executed, the program writes the name of the IO device to the
area addressed with the DATA parameter.
The name that is read depends on the type of IO device:
• DP slave or IO device: Name of the head module
• I-slave or I-device: Name of the interface module
• HMI panel: Name of the interface
• PC station: Name of the interface module
• GSD devices: Displays the name of the Device Access Point (DAP) (name of the interface or
head module)
The instruction writes the length of the name at the LEN parameter. If the name is longer than
the area specified at the DATA parameter, the program writes only that section which
corresponds to the maximum length of the addressed area.
The maximum length for a name is 128 characters.
Note
Name of the CPU readout (Version 1.1)
If you assign a "0" at each of the parameters LADDR and STATION_NR, the instruction writes the
name of the CPU.
Parameters
The following table shows the parameters of the Get_Name instruction:
STATUS parameter
Example
The following example shows how you can read the station name of an ET 200SP PROFINET IO
device:
1. Configuring the ET 200SP:
– Create the ET 200SP with the station name "Conveyor_1" in the network view and assign
it to the same PROFINET IO system as the CPU.
– Assign the CPU as the IO controller for the ET 200SP.
– Use the default device number "1" located in the Properties under "Ethernet addresses".
– Connect a tag with the data type STRING of a data block at the DATA parameter.
Note
When using the dropdown to make your selections for configuring the tag to the DATA
parameter, select the DB (in the example, "Datablock") and the tag (in the example,
"String[ ]"). In order to read the entire String data type, you must delete the brackets so
that the final result is: "Datablock".String
– Define PLC tags (memory area, flags) for the output parameters of the instruction.
– The program writes "10", the number of characters in the station name, to the LEN
parameter.
Note
You can only use the GetStationInfo instruction with PROFINET IO devices. You cannot use the
instruction with PROFIBUS DP slaves.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "GetStationInfo_SFB_DB" is the name of the instance DB.
You address the IO device using the hardware identifier of the station at the LADDR parameter.
You can find the hardware ID at the following location:
PLC tags > Show all tags > System constants tab. Search for the "IODevice" in the Name column
and for "Hw_Device" in the Data type column.
Use the MODE parameter to select the information to be read.
At the DATA parameter, assign the data area to which the instruction writes the read address
data. For storing the IP address, use the "IF_CONF_v4" structure. For storing the MAC address,
use the "IF_CONF_MAC" structure.
Enable reading of the address data using the REQ control parameter. This requires the IO device
to be accessible.
The instruction displays the execution status of the read job using the BUSY, DONE, and ERROR
output parameters and the STATUS output parameter.
Note
Address the IO device using only the hardware identifier of the station
The station, the IO device, and PROFINET interface have their own hardware identifier. Use only
the hardware identifier of the station for the GetStationInfo instruction.
If a PROFINET interface is addressed using the LADDR parameter, for example, the address data
is not read and the CPU generates a "8092" error code.
To read the address data of an integrated PROFINET interface or a CM/CP module in the central
configuration, use the "RDREC" instruction.
Parameters
The following table shows the parameters of the GetStationInfo instruction:
DATA parameter
• Use the "IF_CONF_v4" structure at the DATA parameter to store the address parameter
according to IPv4:
• Use the "IF_CONF_MAC" structure at parameter DATA for storing the MAC address:
STATUS parameter
Example
In the example below, you use the GetStationInfo instruction to read the IP address data of an
IO device and write the information to a data block. The IP address data includes the IP address,
subnet mask, and (if used) the address data of the router.
The IO controller executes the GetStationInfo instruction, and the instruction reads the
IP address information of a lower-level IO device (in this example, an ET200SP):
1. Configuring the ET 200SP:
– Create the ET 200SP with the station name "Conveyor_1" in the network view, and assign
it to the same PROFINET IO system as the CPU.
– Assign the CPU as the IO controller for the ET 200SP.
– Create five tags and a structure with the IF_CONF_v4 data type in a global data block for
storing the IP address data. Assign any name to the structure. (In the example, the
structure name is "IP_Address".)
– Define PLC tags from your global DB for the output parameters of the instruction.
You can use the DeviceStates instruction to return the states of all distributed I/O slave devices
connected to a specified distributed I/O Master.
After execution, the STATE parameter contains the error state of each I/O device as a bit list (for
the assigned LADDR and MODE).
PROFIBUS example
The PROFIBUS example consists of the following:
• 16 PROFIBUS devices named "DPSlave_10" through "DPSlave_25"
• The 16 PROFIBUS devices use PROFIBUS addresses 10 through 25, respectively.
• Each slave device is configured with multiple I/O modules.
• The first four bytes of the returned STATE parameter information is displayed.
The following four tables show a binary breakdown of the four bytes of data that are being
analyzed:
Table 9-159 Example 1: No errors: A value of 0x01FC_FF03 is returned for MODE 1 (Device configuration
active).
The devices are configured in addresses 10 (Bit 10) through 25 (Bit 25).
No devices are configured in addresses 1 through 9.
MODE 4 (Device exists) data matches MODE 1 (Device configuration active), so the configured devices
match the existing devices.
Table 9-160 Example 2: A module has been pulled from PROFIBUS slave device "DPSlave_12". A value of
0x0110_0000 is returned for MODE 2 (Device defective).
Table 9-161 Example 2 (continued): A module has been pulled from PROFIBUS slave device
"DPSlave_12". A value of 0x01FC_FF03 is returned for MODE 4 (Device exists).
Even though device 12 (Bit 12) has an error as shown in MODE 2 (Device defective) above, the device is still
functioning on the network which causes MODE 4 (Device exists) to show the device as an "existing device".
Table 9-162 Example 3: PROFIBUS slave device "DPSlave_12" is disconnected (cable disconnected or
power loss) from the PROFIBUS network. "DPSlave_12" is still detected as a defective device
as well as an error in the device. The difference is that "DPSlave_12" is no longer detected as
a device that exists. A value of 0x01EC_FF03 is returned for MODE 4 (Device exists).
Device 12 (Bit 12) is marked as not existing. With this exception, devices 10 through 25 still report as
existing.
PROFINET example
The PROFINET example consists of the following:
• 16 PROFINET slave devices named "et200s_1" through "et200s_16"
• The 16 PROFINET devices use PROFINET device numbers 1 through 16, respectively.
• Each slave device is configured with multiple I/O modules.
• The first four bytes of the returned STATE parameter information is displayed.
The following four tables show a binary breakdown of the four bytes of data that are being
analyzed:
Table 9-163 Example 1: No errors: A value of 0xFFFF_0100 is returned for MODE 1 (Device configuration
active).
Table 9-164 Example 2: A module has been pulled from PROFINET slave device "et200s_1". A value of
0x0300_0000 is returned for MODE 2 (Device defective).
Device 1 (Bit 1) is marked as defective. Since the device still exists, MODE 4 (Device exists) shows the same
data as when operating normally.
MODE 5 (Problem in device) returns the same information as MODE 2 (Device defective).
Table 9-165 Example 2 (continued): A module has been pulled from PROFIBUS slave device "et200s_1".
A value of 0xFFFF_0100 is returned for MODE 4 (Device exists).
Even though device 1 (Bit 1) has an error as shown in MODE 2 (Device defective) above, the device is still
functioning on the network which causes MODE 4 (Device exists) to show the device as an "existing device".
Table 9-166 Example 3: PROFINET slave device "et200s_1" is disconnected (cable disconnected or power
loss) from the PROFINET network. A value of 0xFDFF_0100 is returned for MODE 4 (Device
exists).
Device 1 (Bit 1) does not exist. Devices 2 (Bit 2) through 16 (Bit 16) do exist.
You can use the ModuleStates instruction to return the status of all of the modules in a PROFIBUS
or PROFINET station.
PROFIBUS example
The PROFIBUS example consists of the following:
• 16 PROFIBUS devices named "DPSlave_10" through "DPSlave_25"
• The 16 PROFIBUS devices use PROFIBUS addresses 10 through 25, respectively.
• Each slave device is configured with multiple I/O modules.
• The example uses the LADDR parameter of PROFIBUS slave "DPSlave_12" which contains a
head module, a power module, and two I/O modules.
• The first four bytes of the returned STATE parameter information is displayed.
The following four tables show a binary breakdown of the four bytes of data that are being
analyzed:
Table 9-170 Example 1: No errors: A value of 0x1F00_0000 is returned for MODE 1 (Module
configuration active).
Slots 1 (Bit 1) through 4 (Bit 4) contain modules. Slots 5 (Bit 5) and beyond do not contain modules.
MODE 4 (Module exists) data matches MODE 1 (Module configuration active), so the configured modules
match the existing modules.
Table 9-171 Example 2: A module has been pulled from PROFIBUS slave device "DPSlave_12". A value of
0x0900_0000 is returned for MODE 2 (Module defective).
Only module 3 (Bit 3) is marked as defective. All other modules are functional.
Table 9-172 Example 2 (continued): A module has been pulled from PROFIBUS slave device
"DPSlave_12". A value of 0x1700_0000 is returned for MODE 4 (Module exists).
Module 3 (Bit 3) is shown as missing. Modules 1, 2, and 4 (Bits 1, 2, and 4) are shown as existing.
Table 9-173 Example 3: PROFIBUS slave device "DPSlave_12" is disconnected (cable disconnected or
power loss) from the PROFIBUS network. A value of 0x1F00_0000 is returned for MODE 2
(Module defective).
The modules in slots 1 through 4 (Bits 1 through 4) are all marked as defective since the device is missing.
MODE 5 (Problem in module) shows the same information as MODE 2 (Module defective).
PROFINET example
The PROFINET example consists of the following:
• 16 PROFINET slave devices named "et200s_1" through "et200s_16"
• The 16 PROFINET devices use PROFINET device numbers 1 through 16, respectively.
• Each slave device is configured with multiple I/O modules.
• The example uses PROFINET slave "et200s_1" which contains a head module, a power
module, and 18 I/O modules.
• The first four bytes of the returned STATE parameter information is displayed.
The following four tables show a binary breakdown of the four bytes of data that are being
analyzed:
Table 9-174 Example 1: No errors: A value of 0xFFFF_1F00 is returned for MODE 1 (Module
configuration active).
Slots 1 (Bit 1) through 20 (Bit 20) contain modules. Slot 21 (Bit 21) and beyond do not contain modules.
MODE 4 (Module exists) data matches MODE 1 (Module configuration active), so the configured modules
match the existing modules.
Table 9-175 Example 2: A module has been pulled from PROFINET slave device "et200s_1". A value of
0x0180_0000 is returned for MODE 2 (Module defective).
Only module 15 (Bit 15) is marked as defective. All other modules are functional.
Table 9-176 Example 2 (continued): A module has been pulled from PROFIBUS slave device "et200s_1".
A value of 0xFF7F_1F00 is returned for MODE 4 (Module exists).
Module 15 (Bit 15) is shown as missing. Modules 1 through 14 (Bits 1 through 14) and 16 through 20 (Bits
16 through 20) are shown as existing.
Table 9-177 Example 3: PROFINET slave device "et200s_1" is disconnected (cable disconnected or power
loss) from the PROFINET network. A value of 0xFFFF_1F00 is returned for MODE 2 (Module
defective).
The modules in slots 1 through 20 (Bits 1 through 20) are all marked as defective since the device is missing.
MODE 5 (Problem in module) shows the same information as MODE 2 (Module defective).
Description
You can use the "GET_DIAG" instruction to read out the diagnostic information of a hardware
device. The hardware device is selected with the LADDR parameter. With the MODE parameter,
you select which diagnostic information to read.
Parameters
The following table shows the parameters of the "GET_DIAG" instruction:
MODE parameter
Depending on the value at the MODE parameter, different diagnostics data is output at the DIAG,
CNT_DIAG and DETAILS output parameters:
DIS structure
With the MODE parameter = 1, the diagnostics information is output in accordance with the DIS
structure. The following table shows the meaning of the individual parameter values:
DNN structure
With the MODE parameter = 2, the diagnostics information details are output in accordance with
the DNN structure. The following table shows the meaning of the individual parameter values:
RET_VAL parameter
(W#16#...)
0 No error
8080 Value in the MODE parameter is not supported.
8081 Type in the DIAG parameter is not supported with the selected mode (parameter MODE).
8082 Type in the DETAILS parameter is not supported with the selected mode (parameter MODE).
8090 LADDR does not exist.
8091 The selected channel in the CHANNEL parameter does not exist.
80C1 Insufficient resources for parallel execution
Example
The following ladder logic network and DB show how to use the three modes with the three
structures:
• DIS
• DNN
1 2
① DNN
② DIS
Note
In the DB, you must manually type in the data type to access each of the three structures; there
is no dropdown list selection. Type in the data types exactly as shown below:
• DNN
• DIS
Parameters
The following table shows the parameters of the "GetSMCinfo" instruction:
You can find additional information on valid data types under "AUTOHOTSPOT".
Note
Determining the I&M 0 data
The I&M 0 data of the memory card cannot be determined with the GetSMCinfo instruction. For
this use the “Get_IM_Data“ instruction.
Parameter status
* The error codes in the program editor are displayed as integer or hexadecimal values. For information on switching the display
formats, refer to "See also".
Create an FB. In the status area of the FB, create a local tag"#done" with the Bool data type.
Interconnect the parameters of the "GetSMCinfo" instruction as follows.
The "GetSMCinfo" instruction is executed only when the input parameter REQ ("execute")
returns the signal state "TRUE". The mode to be used for reading out the SIMATIC Memory Card
is stored in the input parameter MODE ("mode"). In the example below, the memory size of the
SIMATIC memory card is read according to the "mode" value being set to "0" and displayed in KB
at parameter INFO ("getInfo"). The success status of GetSMCinfo is displayed at the output
parameter DONE ("#done") and stored in the tag "done".
Output parameters STATUS ("status") and ERROR ("error") indicate that the processing in the
example was completed without error.
Note
With a PROFIBUS IO system, after a download or power cycle, the CPU will go to RUN mode unless
the hardware compatibility is set to allow acceptable substitute modules (Page 143) and one or
more modules is missing or is not an acceptable substitute for the configured module.
As shown in the following table, the CPU supports diagnostics that can be configured for the
components of the distributed I/O system. Each of these errors generates a log entry in the
diagnostic buffer.
Type of error Diagnostic information for Entry in the diagnostic buf‐ CPU operating mode
the station? fer?
Diagnostic error Yes Yes Stays in RUN mode
Rack or station failure Yes Yes Stays in RUN mode
I/O access error 1
No Yes Stays in RUN mode
Peripheral access error 2
No Yes Stays in RUN mode
Pull / plug event Yes Yes Stays in RUN mode
1
I/O access error example cause: A module that has been removed.
2
Peripheral access error example cause: Acyclic communication to a submodule that is not communicating.
Use the GET_DIAG instruction (Page 432) for each station to obtain the diagnostic information.
This will allow you to programmatically handle the errors encountered on the device and if
desired take the CPU to STOP mode. This method requires you to specify the hardware device
from which to read the status information.
The GET_DIAG instruction uses the "L address" (LADDR) of the station to obtain the health of the
entire station. This L Address can be found within the Network Configuration view and by
selecting the entire station rack (entire gray area), the L Address is shown in the Properties Tab
of the station. You can find the LADDR for each individual module either in the properties for the
module (in the device configuration) or in the default tag table for the CPU.
9.8 Pulse
1
When you insert the instruction, STEP 7 displays the "Call Options" dialog for creating the associated DB.
2
In the SCL example, "CTRL_PWM_DB" is the name of the instance DB.
The CTRL_PWM instruction stores the parameter information in the DB. The data block
parameters are not separately changed by the user, but are controlled by the CTRL_PWM
instruction.
Specify the enabled pulse generator to use, by using its tag name for the PWM parameter.
When the EN input is TRUE, the PWM_CTRL instruction starts or stops the identified PWM based
on the value at the ENABLE input. Pulse width is specified by the value in the associated Q word
output address.
Because the CPU processes the request when the CTRL_PWM instruction is executed, parameter
BUSY will always report FALSE. If an error is detected, then ENO is set to FALSE, and parameter
STATUS contains a condition code.
The pulse width will be set to the initial value configured in device configuration when the CPU
first enters RUN mode. You write values to the Q-word location specified in device configuration
("Output addresses" / "Start address:") as needed to change the pulse width. You use an
instruction such as a move, convert, math, or PID box to write the desired pulse width to the
appropriate Q word. You must use the valid range for the Q-word value (percent, thousandths,
ten-thousandths, or S7 analog format).
Note
Digital I/O points assigned to PWM and PTO cannot be forced
The digital I/O points used by the pulse-width modulation (PWM) and pulse-train output (PTO)
devices are assigned during device configuration. When digital I/O point addresses are assigned
to these devices, the values of the assigned I/O point addresses cannot be modified by the Watch
table force function.
STATUS Description
0 No error
80A1 PWM identifier does not address a valid PWM.
The CTRL_PTO instruction stores the parameter information in the DB. The data block
parameters are not separately changed by the user, but are controlled by the CTRL_PTO
instruction.
Specify the enabled pulse generator to use, by using its tag name or hardware identifier for the
PTO parameter.
When the EN input is TRUE, the CTRL_PTO instruction starts or stops the identified PTO. When the
EN input is FALSE, the CTRL_PTO instruction does not execute and the PTO maintains its current
state.
When you set the REQ input to TRUE, the FREQUENCY value takes effect. If REQ is FALSE, the
PTO's output frequency cannot be changed, and the PTO continues to output pulses.
&75/B3725(4
&75/B372)5(48(1&<
)UHTXHQF\
DW+DUGZDUHRXWSXW
1RFKDQJHLQRXWSXWIUHTXHQF\ZKLOH5(4
Since the CTRL_PTO instruction only starts the PTO, the CTRL_PTO instruction finishes
immediately. As a result, the BUSY output never turns on. The DONE output comes on as long
as no error occurs. If an error is detected, the ERROR parameter is set to TRUE, and the STATUS
parameter contains a condition code.
When the user enables the CTRL_PTO instruction with a given frequency, the S7-1200 outputs
a pulse train at that given frequency. The user can change the desired frequency at any time.
When the frequency is changed, the S7-1200 finishes the current pulse prior to changing
frequency to the new desired frequency. For example, if the desired frequency is 1 Hz (which
takes 1000ms to complete) and the user changes the frequency to 10 Hz after 500ms, the
frequency changes at the end of the 1000ms time period.
3 2
+] +]
PV PV
1
2QH
3XOVH
2QH
3XOVH
The pulse generator hardware object has the following restriction: Only one instruction can use
the pulse generator as PTO, and the hardware configuration editor manages the use of the pulse
generator. Other instructions that try to access that PTO return an error: "0x8090" (Pulse
generator with the specified hardware ID is in use).
Note
Digital I/O points assigned to PWM and PTO cannot be forced
The digital I/O points used by the pulse width modulation (PWM) and pulse train output (PTO)
devices are assigned during device configuration. When digital I/O point addresses are assigned
to these devices, the values of the assigned I/O point addresses cannot be modified by the Watch
table force function.
Note
Pulse-train outputs cannot be used by other instructions in the user program.
When you configure the outputs of the CPU or signal board as pulse generators (for use with the
PWM or motion control PTO instructions), the corresponding outputs addresses are removed
from the Q memory and cannot be used for other purposes in your user program. If your user
program writes a value to an output used as a pulse generator, the CPU does not write that value
to the physical output.
Note
PTO direction outputs can be freed for use elsewhere in your program.
Each PTO requires the assignment of two outputs: one as a pulse output and one as a direction
output. You can use just the pulse output and not the direction output. You can then free the
direction output for other purposes in your user program.
You can also write a comment about this specific pulse generator in the "Comment:" edit box.
Table 9-193 CPU output: Maximum frequency (PTO) and minimum cycle time (PWM)
CPU CPU output channel PTO maximum fre‐ PWM minimum cycle
quency time
1211C Qa.0 to Qa.3 100 kHz 10 µs
1212C Qa.0 to Qa.3 100 kHz 10 µs
Qa.4, Qa.5 20 kHz 50 µs
1214C and 1215C Qa.0 to Qa.3 100kHz 10 µs
Qa.4 to Qb.1 20 kHz 50 µs
1217C DQa.0 to DQa.3 1 MHz 1 µs
(.0+, .0- to .3+, .3-)
DQa.4 to DQb.1 100 kHz 10 µs
Table 9-194 SB signal board output: Maximum frequency (PTO) and minimum cycle time (PWM)
SB signal board SB output channel PTO maximum fre‐ PWM minimum cycle
quency time
SB 1222, 200 kHz DQe.0 to DQe.3 200kHz 5 µs
SB 1223, 200 kHz DQe.0, DQe.1 200kHz 5 µs
SB 1223 DQe.0, DQe.1 20 kHz 50 µs
Note
The minimum cycle time of each of the CPU and Signal Board outputs is given in the tables
above. However, the TIA Portal does not alert you when you configure a PWM pulse generator
with a cycle time that falls below the minimum cycle time of the hardware. Problems can result
with your application, so always ensure that the cycle time lies within the hardware limits.
Note
When you set the Pulse duration of a PWM signal, the actual Pulse duration time (time that the
pulse is high) must be greater than or equal to 1 millisecond if the Time base is "Milliseconds".
If the Time base is "Microseconds", the actual Pulse duration time must be greater than or equal
to 1 microsecond. The output turns off if the Pulse duration time is less than 1 "Time base".
For example, a Cycle time of 10 microseconds and a Pulse duration of 5 hundredths produces a
Pulse duration time of 0.5 microseconds. Because this is less than 1 microsecond, the PWM
signal is off.
Parameter assignment
The Parameter assignment section allows the user to configure the parameters of the output
pulse. The following options are available, depending on whether PWM or PTO is selected:
• Signal type: Configure the pulse output as PWM or PTO. For PTO selections, refer to "Phasing"
for further information:
– PWM
– PTO (pulse A and direction B)
– PTO (pulse up A and pulse down B)
– PTO (A/B phase-shifted)
– PTO (A/B phase-shifted - fourfold)
• Time base (only applies to PWM): Select which units of time to use:
– Milliseconds
– Microseconds
• Pulse duration format (only applies to PWM): Assign the resolution of the pulse duration
(width):
– Hundredths (0 to 100)
– Thousandths (0 to 1000)
– Ten-thousandths (0 to 10000)
– S7 analog format (0 to 27648)
• Cycle time (only applies to PWM): Assign the time duration it takes to complete one pulse
(pulse high time plus pulse low time equals cycle time). You can change the cycle time at
runtime by selecting the check box "Allow runtime modification of the cycle time". Refer to
the "I/O addresses" section below for further information. Range is 1 to 16,777,215 units of
time.
• Initial pulse duration (only applies to PWM): Assign the pulse duration of the first pulse. You
can change this value at runtime using the Q word address configured in I/O addresses. Range
is based upon the Pulse duration format.
• Allow runtime modification of the cycle time (only applies to PWM): Selecting this option
allows your program to modify the cycle time of the PWM signal while the program is
running. Refer to the "I/O addresses" section below for further information.
Note
When setting the pulse duration of a PWM signal, be sure to consider the switching delay of the
output channel as specified in Appendix A. The actual pulse duration measured at the output
may be greater than the selected pulse duration. The increase of the pulse duration is more
pronounced for small pulse duration and higher frequencies. Be sure to verify that the pulse
duration measured at the output matches your requirements.
Hardware outputs
In the hardware outputs section, select the output channel from the dropdown menu.
Depending on the configuration, there may be one or two outputs to select. If you do assign an
output channel to a pulse generator, the output channel cannot be used by another pulse
generator, HSC, or the process image register.
Note
Pulse generator outputs cannot be used by other instructions in the user program
When you configure the outputs of the CPU or signal board as pulse generators (for use with the
PWM, PTO, or motion control instructions), the corresponding outputs addresses are removed
from the Q memory and cannot be used for other purposes in your program. If your program
writes a value to an output used as a pulse generator, the CPU does not write that value to the
physical output.
I/O addresses
The PWM has two bytes of Q memory designated for "Pulse duration". While the PWM is running,
you can modify the value in the assigned Q memory and change the Pulse duration.
In the I/O Address section, enter the Q word address where you want to store the Pulse duration
value.
The default addresses for the PWM Pulse duration values are as follows:
• PWM1: QW1000
• PWM2: QW1002
• PWM3: QW1004
• PWM4: QW1006
For the PWM, the value at this location controls the duration of the pulse and is initialized to the
"Initial pulse duration:" value (assigned above) each time the CPU transitions from STOP to RUN
mode. You change this Q-word value during runtime to cause a change in the pulse duration.
The range of this value is dependent on the Pulse duration format configured under Parameter
assignment.
You can also allocate an additional four bytes of Q memory for the "Cycle time" of the PWM
signal. Refer to "Operation of the pulse outputs" (Page 447) for a diagram of the PWM signal.
When you select the "Allow runtime modification of the cycle time" check box, the first two bytes
hold the Pulse duration value and the last four bytes hold the Cycle time value.
While the PWM is running, you can modify the value of the double word at the end of the Q
memory that is allocated to that PWM. This changes the Cycle time of the PWM signal. For
example, you enable this option so that the CPU allocates six bytes for PWM1, and you decide to
use QB1008 to QB1013. Once you download the program and start the PWM, you can modify
the Pulse duration using QW1008 and the Cycle time using QD1010.
Each time the CPU transitions from STOP to RUN mode, the CPU initializes the Cycle time value
in Q memory to the "Cycle time" value assigned above in the "Parameter assignment" section.
The units and range of values for the Cycle time value in Q memory are the same as the
configuration in the "Parameter assignment" section.
When you select the "Allow runtime modification of the cycle time" check box, the TIA Portal
automatically selects a new address for the output address. The new output address cannot be
the same as the default address for that pulse generator. The TIA Portal uses the next available
block of six consecutive bytes. If the search does not find an available block of Q memory before
it reaches the end of Q memory, the search starts over at address "0" of Q memory and continues
searching for an available block.
A pulse generator configured for PTO does not use the Q-word address.
9.9.1 Recipes
3. Upload the modified CSV file from PC back to the CPU. However, the old CSV file in CPU load
memory (with the same name) must be deleted or renamed before the CPU Web server
allows the upload operation.
4. After the modified CSV file is uploaded to the CPU, then you can use the RecipeImport
instruction to transfer the new start values from the modified CSV file (in CPU load memory)
to the recipe DB (in CPU load memory).
Example recipes
The table below shows how to prepare recipe information for use in a recipe DB. The example
recipe DB stores five records, three of which are used. The fourth and fifth records are free for
later expansions. Each table row represents one record that stores the recipe name, component
data types, and component values.
product‐ water barley wheat hops yeast wa‐ mashTmp mash‐ QTest
name terTmp Time
Pils 10 9 3 280 39 40 30 100 0
Lager 10 9 3 150 33 50 30 120 0
BlackBeer 10 9 3 410 47 60 30 90 1
Not_used 0 0 0 0 0 0 0 0 0
Not_used 0 0 0 0 0 0 0 0 0
Note
Rules for recipe data blocks
• The recipe DB must contain a single dimension array of either a PLC data type or a struct. The
recipe example shows how to create a recipe DB with a PLC data type.
• In the example, the data type of the component ingredients are all the UINT data type. The
component data types may also be a mix of any data type except for structs. In a recipe DB
array element, a struct in a PLC data type or a struct in a struct is not allowed.
Recipe_DB.csv
index,productname,water,barley,wheat,hops,yeast,waterTmp,
mashTmp,mashTime,QTest
1,”Pils”,10,9,3,280,39,40,30,100,0
2,”Lager”,10,9,3,150,33,50,30,120,0
3,”BlackBeer”,10,9,3,410,47,60,30,90,1
4 ”Not_used”,0,0,0,0,0,0,0,0,0
5 ”Not_used”,0,0,0,0,0,0,0,0,0
Note
Commas in the name field of the PLC data type element
Do not place commas in the name field of the PLC data type element(s) used in a recipe. If you
place commas in the name field, Excel inserts extra columns in the displayed .csv file. These extra
columns can introduce errors when you edit the recipe record file start values.
A recipe DB must be created before a recipe export is possible. The name of a recipe data block
is used as the file name of the new CSV file. If a CSV file with an identical name already exists, then
it is overwritten during the export operation.
You can use the File Browser page (Page 845) of the CPU's built-in Web server to access the recipe
CSV file. The file is put in the recipe folder in the root directory of CPU load memory.
A recipe DB that contains a structure which is consistent with the CSV file data structure must
exist, before a recipe import operation is possible.
CSV file rules:
• The CSV file must be located in the root directory "Recipes" folder of internal load memory
or external load memory, if an optional external "program" memory card is installed.
• The name of the CSV file must match the name of the data block at the RECIPE_DB parameter.
• The first line (header) of the CSV file contains the name of the recipe components. The first
line is ignored during import. The names of the recipe components in the CSV file and the
data block are not reconciled during the import process.
• In each case the first value in each line of the CSV file is the index number of the recipe. The
individual recipes are imported in the order of the index. For this, the index in the CSV file has
to be in ascending order and may contain no gaps (if this is not the case, the error message
80B0 is output at the STATUS parameter).
• The CSV file may not contain more recipe data records than provided for in the recipe data
block. The maximum number of data records is indicated by the array limits in the data block.
Instance DBs
The instance DBs used by instructions RecipeExport ("RecipeExport_DB") and RecipeImport
("RecipeImport_DB") are created automatically when you place the instructions in your program.
The instance DBs are used to control instruction execution and are not referenced in the program
logic.
Network 2 Capture the STATUS output from RecipeExport execution, because it is only valid for
one scan.
Network 3 A rising edge on REQ starts the import process. The existing recipe DB is loaded with
all recipe data read from the corresponding CSV file that is located in the CPU memory recipes
folder.
Network 4 Capture the STATUS output from RecipeImport execution, because it is only valid for
one scan.
Network 5 READ_DBL copies the start values from one recipe "Recipe_DB". Products[1] (in CPU
load memory) to the Active_Recipe DB current values (in CPU work memory). After READ_DBL
execution, your program logic can access the recipe component values by addressing locations
in the Active_Recipe DB. For example, the symbolic addresses ( "Active_Recipe".productname)
and ("Active_Recipe.water) provide your program logic with the current recipe name and
quantity of water.
Network 6 During run time, An HMI device could modify a component value stored in the
Active_Recipe DB. Improved recipe data can be stored by executing WRIT_DBL. In the example,
all Recipe_DB start values for the single recipe "Recipe_DB". Products[1] are overwritten by the
current values from the "Active_Recipe" DB.
Your control program can use the Data log instructions to store run-time data values in persistent
log files. The CPU stores data log files in flash memory (CPU or memory card) in standard CSV
(Comma Separated Value) format. The CPU organizes the data records as a circular log file of a
pre-determined size.
You use the Data log instructions in your program to create, open, write a record to, and close
the log files. You decide which program values to log by creating a data buffer that defines a
single log record. The CPU uses your data buffer as temporary storage for a new log record. Your
control program moves new current values into the buffer during runtime. When the program
has updated all of the current data values, it can then execute the DataLogWrite instruction to
transfer data from the buffer to a data log record.
You can open, edit, save, rename, and delete data log files from the File Browser page of the Web
Server. You must have read privileges to view the file browser and you must have modify
privileges to edit, delete, or rename data log files.
In order to write a Data log record you must first load the temporary DATA record with new
process values and then execute the DataLogWrite instruction that saves new record values in
the Datalog file.
The CPU creates a data log file with a pre-determined fixed sized based on the RECORDS and DATA
parameters and organizes the data records as a circular log file. The DataLogCreate instruction
allocates persistent CPU memory for the entire data log when the instruction returns DONE =
TRUE. The required memory in the CPU is greater than the size of the file due to file system
management and related values. The persistent memory for the data log remains allocated until
the CPU deallocates the memory in one of the following ways:
• The user program calls the DataLogDelete instruction
• A Web server user deletes the data log from the Web server
• A SIMATIC Automation Tool user deletes the data log from the SIMATIC Automation Tool
Deleting the data log file by other means, such as using a card reader, does not deallocate the
CPU persistent memory for the data log.
The DataLogWrite instruction appends new records to the data log file until it stores the
maximum number of records that is specified by the RECORDS parameter. The next record
written will overwrite the oldest record. Another DataLogWrite operation will overwrite the next
oldest data record and so on.
Memory resource usage:
• The data logs consume only load memory.
• The size of all data logs combined is limited by the available resources of load memory. Only
eight data logs can be open at one time. You can manage your data logs from the File Browser
(Page 845) standard Web page. See the description of this standard Web page for guidelines
on how many data logs to maintain at a time.
• The maximum possible number for the RECORDS parameter is the limit for an UDint number
(4,294,967,295). The actual limit for the RECORD parameter depends on the size of a single
record, the size of other data logs, and the available resources of load memory. In addition,
Excel limits the number of rows allowed in an Excel sheet.
Note
Data log creation execution must be complete before starting a data log write operation
• DataLogCreate and DataLogNewFile log file creation operations extend over many program
scan cycles. The actual time required for the log file creation depends on the record structure
and number of records. Your program logic must monitor and catch the DONE bit's transition
to the TRUE state that signals the completion of a log file creation. If the user program
executes a DataLogWrite instruction before a data log creation operation is complete, then
the write operation will fail to write a new data log record as expected.
• In certain situations when a very fast program scan is running, data log creation can take an
extended time. If the long creation time is too slow, you should ensure that the checkbox for
the Enable minimum cycle time for cyclic OBs is active, and the minimum cycle time is set to
one ms or greater. Refer to Configuring the cycle time and communication load (Page 86) for
more information.
Note
The DataLogNewFile instruction copies an existing data log's record structure
If you want to prevent overwriting any data records, then you can use the DataLogNewFile
instruction to create a new data log based on the current data log, after the current data log has
stored the maximum number of records. New data records are stored in the new data log file.
The old data log file and record data remain stored in flash memory.
You can provide either the NAME or an ID (ID parameter as an input) of a pre-existing data log.
If you provide both parameters and a valid ID does correspond to the NAME data log, then the
ID is used, and the NAME ignored.
The NAME must be the name of a data log created by the DataLogCreate instruction. If only the
NAME is provided and the NAME specifies a valid data log, then the corresponding ID will be
returned (ID parameter as an output).
Note
General usage of data log files
• Data log files are automatically opened after the DataLogCreate and DataLogNewFile
operations.
• Data log files are automatically closed after a PLC run to stop transition or a PLC power cycle.
• A Data log file must be open before a new DataLogWrite operation is possible.
• A maximum of eight data log files may be open at one time. More than eight data log files may
exist, but some of them must be closed so no more than eight are open.
2
In the SCL example, "DataLogWrite_DB" is the name of the instance DB.
The DATA parameter of a DataLogCreate instruction defines the memory address and data
structure of the record buffer. The control program must load the record buffer with current
runtime process values and then execute the DataLogWrite instruction to move new record data
from the buffer to the data log.
The ID parameter identifies a data log and data record configuration. The DataLogCreate
instruction generates the ID number.
If there are empty records in the circular data log file, then the DataLogWrite instruction writes
the next available empty record. If all records are full, then the DataLogWrite instruction
overwrites the oldest record.
NOTICE
Data log creation operations must be complete, before starting a data log write operation
DataLogCreate and DataLogNewFile log file creation operations extend over many program
scan cycles. The actual time required for the log file creation depends on the record structure
and number of records. Your program logic must monitor and catch the DONE bit's transition
to the TRUE state that signals the completion of a log file creation. If a DataLogWrite instruction
executes before a data log creation operation is complete, then the write operation does not
write a new data log record.
Note
Effect of data logs on internal CPU memory
Each data log write consumes at a minimum 2 KB of memory. If your program writes small
amounts of data frequently, it is consuming at least 2 KB of memory on each write. A better
implementation would be to accumulate the small data items in a data block (DB), and to write
the data block to the data log at less frequent intervals.
If your program writes many data log entries at a high frequency, consider using a replaceable
SD memory card.
NOTICE
Potential for data log data loss during a CPU power failure
If there is a power failure during an incomplete DataLogWrite operation, then the data record
being transferred to the data log could be lost.
Description
Requirement
Before you can delete data records, the data log must be open. Use the DataLogOpen
(Page 468) instruction to open a data log.
Parameters
The following table shows the parameters of the "DataLogClear" instruction:
You can find additional information on valid data types under "Data types (Page 100)".
Parameter STATUS
Parameters
The following table shows the parameters of the "DataLogDelete" instruction:
You can find additional information on valid data types under "Data types (Page 100)".
Parameter RET_VAL
You can execute the DataLogNewFile instruction when a data log becomes full or is deemed
completed and you do not want to lose any data that is stored in the data log. A new empty data
log file can be created based on the structure of the full Data log file. The header record will be
duplicated from the original data log with the original data log properties (DATA record buffer,
data format, and timestamp settings). The original Data log file is implicitly closed and the new
Data log file is implicitly opened.
DataLogWrite parameter trigger: Your program must monitor the ERROR and STATUS parameters
of each DataLogWrite operation. When the final record is written and a data log is full, the
DataLogWrite ERROR bit = 1 and the DataLogWrite STATUS word = 1. These ERROR and STATUS
values are valid for one scan only, so your monitoring logic must use ERROR = 1 as a time gate
to capture the STATUS value and then test for STATUS = 1 (the data log is full).
DataLogNewFile operation: When your program logic gets the data log is full signal, this state is
used to activate a DataLogNewFile operation. You must execute DataLogNewFile with the ID of
an existing (usually full) and open data log, but a new unique NAME parameter. After the
DataLogNewFile operation is done, a new data log ID value is returned (as an output parameter)
that corresponds to the new data log name. The new data log file is implicitly opened and is ready
to store new records. New DataLogWrite operations that are directed to the new data log file,
must use the ID value returned by the DataLogNewFile operation.
NOTICE
Data log creation operations must be complete, before starting a data log write operation
DataLogCreate and DataLogNewFile log file creation operations extend over many program
scan cycles. The actual time required for the log file creation depends on the record structure
and number of records. Your program logic must monitor and catch the DONE bit's transition
to the TRUE state that signals the completion of a log file creation. If a DataLogWrite instruction
is executed before a data log creation operation is complete, then the write operation will fail
to write a new data log record as expected.
Note
Data log management
Keep no more than 1000 data logs in a file system. Exceeding this number can prevent the Web
server from having enough CPU resources to display the data logs.
If you find that the File Browser Web page is not able to display the data logs, then you must place
the CPU in STOP mode in order to display and delete data logs.
Manage your data logs to ensure that you only keep the number that you need to maintain, and
do not exceed 1000 data logs.
Make a copy of the data log files and put the copies on a local drive of your PC. Then, you can use
Excel to open a local copy of a *.csv file and not the original file that is stored on the memory card.
NOTICE
You can copy, but do not modify or delete data log files on a S7-1200 memory card using
a PC card reader
The standard Web server File Browser page is the recommended tool for viewing, downloading
(copying), and deleting data log files.
Direct browsing of the memory card file system by the Windows Explorer has the risk that you
can accidentally delete/modify data log or other system files which can corrupt a file or make
the memory card unusable.
NOTICE
Effect of data logs on memory cards
To ensure the overall performance and robustness of your system, limit the data log rate to no
faster than every 200 ms.
Data area CPU 1211C CPU 1212C CPU 1214C CPU 1215C, Data storage
CPU 1217C
Internal load memory 1 MB 2 MB 4 MB 4 MB User program and
flash memory program data, con‐
External load memory 4 MB, 12 MB, 24 MB, 256 MB, 2 GB, or 32 GB depending on the SD card figuration data, Data
Optional "Program card" size logs, user-defined
flash memory Web pages, and PLC
system data
Header
Data log header bytes = header character bytes + 2 bytes
Header character bytes
• No data header and no timestamps = 7 bytes
• No data header and timestamps (has a timestamp header) = 21 bytes
• Data headers and no timestamps = number of character bytes in all column head text
including separator commas
• Data headers and timestamps (has a timestamp header) = number of character bytes in all
column head text including separator commas +21 bytes
Data
Data log data bytes = ((data bytes in one record + time stamp bytes + 12 bytes) * number of
records)
Data bytes in one data record
The DataLogCreate DATA parameter points to a structure that assigns the number of data fields
and the data type of each data field for one data log record.
Multiply the number of occurrences for a given data type by the number of bytes required.
Repeat the process for each data type in a record and sum all the data bytes to get the total of
all data elements in one record.
Size of individual data elements
Log data is stored as character bytes in the CSV (comma separated values) file format. The
following table shows the number of bytes that are required to store each data element.
Data type Number of bytes (includes data plus one comma byte)
Bool 2
Byte 5
Word 7
DWord 12
Char 4
String Example 1: MyString String[10]
The maximum string size is assigned as 10 characters.
Text characters + automatic padding with blank characters = 10 bytes
Opening and closing double quote + comma characters = 3 bytes
10 + 3 = 13 total bytes
Example 2: Mystring2 String
If no size is assigned with square brackets, then 254 bytes is allocated by default.
Text characters + automatic padding with blank characters = 254 bytes
Opening and closing double quote + comma characters = 3 bytes
254 + 3 = 257 total bytes
USInt 5
UInt 7
UDInt 12
SInt 5
Int 7
DInt 12
Real 16
LReal 25
Time 15
DTL 24
Number of records in a data log file
The RECORDS parameter of the DataLogCreate instruction sets the maximum number of records
in a data log file.
Time stamp bytes in one data record
• No time stamp = 0 bytes
• Time stamp = 20 bytes
Note
General usage of Data log files
• Data log files are automatically opened after the DataLogCreate and DataLogNew File
operations.
• Data log files are automatically closed after a PLC run to stop transition or a PLC power cycle.
• A Data log file must be open before a DataLogWrite operation is possible.
• A maximum of eight data log files may be open at one time. More than eight data log files may
exist, but some of them must be closed so no more than eight are open.
Network 1 REQ rising edge starts the data log creation process.
Network 2 Capture the DONE output from DataLogCreate because it is only valid for one scan.
Network 4 A positive edge signal triggers when to store new process values in the MyData
structure.
Network 5 The EN input state is based upon when the DataLogCreate operation is complete. A
create operation extends over many scan cycles and must be complete before executing a write
operation. The positive edge signal on the REQ input is the event that triggers an enabled write
operation.
Network 6 Close the data log once the last record has been written. After executing the
DataLogWrite operation that writes the last record, the log file full status is signaled when
DataLogWrite STATUS output = 1.
Network 7 A positive signal edge DataLogOpen REQ input simulates the user pushing a button
on an HMI that opens a data log file. If you open a Data log file that has all records filled with
process data, then the next DataLogWrite operation will overwrite the oldest record. You may
want to preserve the old Data log and instead create a new data log, as shown in network 7.
Network 8 The ID parameter is an IN/OUT type. First, you supply the ID value of the existing Data
log whose structure you want to copy. After the DataLogNewFile operation is complete, a new
and unique ID value for the new Data log is written back to the ID reference location. The
required DONE bit = TRUE capture is not shown, refer to networks 1, 2, and 4 for an example of
DONE bit logic.
Data log files created by the example program viewed with the S7-1200 CPU Web server
① The "Delete" option is not available if you are not logged in with modify privileges.
② The "Rename" option is not available if you are not logged in with modify privileges.
Note
Data logs no longer use an //END marker to mark the end of a data log file that is not full. Prior
to V4.1 of the S7-1200 CPU, data logs that were not full included an //END marker.
Functional description
The "CREATE_DB" instruction works asynchronously. Processing takes place across several calls.
You start the job by calling "CREATE_DB" with REQ = 1.
The output parameters RET_VAL and BUSY indicate the status of the job.
See also: DELETE_DB (Delete data block) (Page 496)
Parameters
The following table shows the parameters of the "CREATE_DB" instruction:
You can find additional information on valid data types under "Data types (Page 100)".
Parameter RET_VAL
Typically, a DB is stored in both load memory (flash) and work memory (RAM). The start values
(initial values) are always stored in load memory, and the current values are always stored in
work memory. READ_DBL can be used to copy a set of start values from load memory to the
current values of a DB in work memory that is referenced by your program. You can use
WRIT_DBL to update the start values stored in internal load memory or memory card from
current values in work memory.
Note
Effect of WRIT_DBL and READ_DBL instruction on flash memory
The WRIT_DBL instruction performs write operations in flash memory (internal load memory or
memory card). To avoid reducing the lifetime of the flash memory, use the WRIT_DBL instruction
for infrequent updates such as recording changes to a production process. For similar reasons,
avoid frequent calls to READ_DBL for read operations.
You must create the data blocks for READ_DBL and WRIT_DBL prior to calling these instructions
in the STEP 7 program. If you created the source DB as a "standard" type then the destination DB
must also be the "standard" type. If you created the source data block as an "optimized" type then
the destination data block must also be the "optimized" type.
If the DBs are standard, then you can specify either a tag name or a P# value. The P# value allows
you to specify and copy any number of elements of the specified size (Byte, Word, or DWord).
Thus, you can copy part or all of a DB. If the DBs are optimized, you can only specify a tag name;
you cannot use the P# operator. If you specify a tag name for either standard or optimized DBs
(or for other work-memory types), then the instruction copies the data that this tag name
references. This could be a user-defined type, an array, or a basic element. You can only use type
Struct with these instructions if the DB is standard, not optimized. You must use a user-defined
type (UDT) if it is a structure in optimized memory. Only a user-defined type ensures that the
"data types" are exactly the same for both the source and destination structures.
Note
Using a structure (data type Struct) in an "optimized" DB
When using a Struct data type with "optimized" DBs, you must first create a user-defined data
type (UDT) for the Struct. You then configure both the source and destination DBs with the UDT.
The UDT ensures that the data types within the Struct remain consistent for both DBs.
For "standard" DBs, you use the Struct without creating a UDT.
READ_DBL and WRIT_DBL execute asynchronously to the cyclic program scan. The processing
extends over multiple READ_DBL and WRIT_DBL calls. You start the DB transfer job by calling with
REQ = 1 and then monitor the BUSY and RET_VAL outputs to determine when the data transfer
is complete and correct.
Note
Effect of WRIT_DBL and READ_DBL instruction on communication load
When the WRIT_DBL or READ_DBL instruction is continually active, it can consume
communication resources to the point that STEP 7 loses communication with the CPU. For this
reason, use a positive edge input (Page 202) for the REQ parameter rather than a normally open
or closed input (Page 197) that would remain on (signal level high) for multiple scans.
To ensure data consistency, do not modify the destination area during the processing of
READ_DBL or the source area during the processing of WRIT_DBL (that is, as long as the BUSY
parameter is TRUE).
SRCBLK and DSTBLK parameter restrictions:
• A data block must have been previously created before it can be referenced.
• The length of a VARIANT pointer of type BOOL must be divisible by 8.
• The length of a VARIANT pointer of type STRING must be the same in the source and
destination pointers.
RET_VAL Description
(W#16#...)
0000 No error
0081 Warning: that the source area is smaller than the destination area. The source data is copied completely with
the extra bytes in the destination area unchanged.
7000 Call with REQ = 0: BUSY = 0
7001 First call with REQ = 1 (working): BUSY = 1
7002 Nth call (working): BUSY = 1
8051 Data block type error
8081 The source area is larger than the destination area. The destination area is completely filled and the re‐
maining bytes of the source are ignored.
8251 Source data block type error
82B1 Missing source data block
82C0 The source DB is being edited by another statement or a communication function.
8551 Destination data block type error
85B1 Missing destination data block
85C0 The destination DB is being edited by another statement or a communication function.
80C3 More than 50 READ_DBL or 50 WRIT_DBL statements are currently queued for execution.
Parameters
The following table shows the parameters of the "ATTR_DB" instruction:
You can find additional information on valid data types under "Data types (Page 100)".
Parameter RET_VAL
Functional description
The "DELETE_DB" instruction works asynchronously, that is, its execution extends over multiple
calls. You start the interrupt transfer by calling the instruction with REQ = 1.
Output parameter BUSY and bytes 2 and 3 of output parameter RET_VAL show the status of the
job.
The deletion of the data block is complete when output parameter BUSY has the value FALSE.
Parameters
The following table shows the parameters of the "DELETE_DB" instruction:
You can find additional information on valid data types under "Data types (Page 100)".
Parameter RET_VAL
The GEO2LOG instruction determines the hardware identifier based upon slot information that
you define using the GEOADDR system data type:
Depending on the type of hardware you define at the parameter HWTYPE, the following
information is evaluated from the other GEOADDR parameters:
• With HWTYPE = 1 (PROFINET IO system):
– Only IOSYSTEM is evaluated. The other parameters of GEOADDR are not taken into
consideration.
– The hardware identifier of the PROFINET IO system is output.
• With HWTYPE = 2 (PROFINET IO device):
– IOSYSTEM and STATION are evaluated. The other parameters of GEOADDR are not taken
into consideration.
– The hardware identifier of the PROFINET IO device is output.
For further information on valid data types, refer to "Overview of the valid data types" in the STEP
7 online help.
RET_VAL* Explanation
(W#16#...)
0 No error occurred.
8091 Invalid value for in GEOADDR for HWTYPE.
8094 Invalid value for in GEOADDR for IOSYSTEM.
8095 Invalid value for in GEOADDR for STATION.
8096 Invalid value for in GEOADDR for SLOT.
8097 Invalid value for in GEOADDR for SUBSLOT.
* The error codes can be displayed as integer or hexadecimal values in the program editor.
The LOG2GEO instruction determines the geographic address of a logical address based upon
the hardware identifier:
• Use the LADDR parameter to select the logical address based upon the hardware identifier.
• The GEOADDR contains the geographic address of the logical address given at the LADDR
input.
Note
In the cases where the HW type does not support a component, a subslot number for a module
0 is returned.
An error is provided if the LADDR input does not address a HW object.
For further information on valid data types, refer to "Overview of the valid data types" in the STEP
7 online help.
RET_VAL Description
(W#16#...)
0000 No error
8090 The address specified at the LADDR parameter is invalid.
* The error codes can be displayed as integer or hexadecimal values in the program editor.
The IO2MOD instruction determines the hardware identifier of the module from an IO address
(I, Q, PI, PQ) of a (sub)module.
Enter the IO address at the ADDR parameter. If a series of IO addresses is used at this parameter,
only the first address is evaluated to determine the hardware identifier. If the first address is
correctly specified, the length for the address specification at the ADDR is of no significance. If an
address area is used that encompasses several modules or non-used addresses, the hardware
identifier of the first module can also be determined.
If no IO address of a (sub)module is specified at the ADDR parameter, the error code "8090" is
output at the RET_VAL parameter.
Note
Input of IO address in SCL
You cannot program using the IO access ID "%QWx:P" in SCL. In this case, use the symbolic tag
name or the absolute address in the process image.
For further information on valid data types, refer to "Overview of the valid data types" in the STEP
7 online help.
RET_VAL* Explanation
(W#16#...)
0 No error occurred.
8090 IO address specified at ADDR parameter is not used by any hardware component.
* The error codes can be displayed as integer or hexadecimal values in the program editor.
The RD_ADDR instruction determines the length and the start address of the inputs or outputs
based on the hardware identifier of a submodule:
• Use the LADDR parameter to select the input or output module based upon the hardware
identifier.
• The following output parameters are used depending on whether it is an input module or
output module:
– In the case of an input module, the determined values are output at the PIADDR and
PICOUNT parameters.
– In the case of an output module, the determined values are output at the PQADDR and
PQCOUNT parameters.
• The PIADDR and PQADDR parameters each contain the start address of the I/O addresses of
the module.
• The PICOUNT and PQCOUNT parameters each contain the number of bytes of the inputs or
outputs (1 byte for 8 inputs/outputs, 2 bytes for 16 inputs/outputs).
For further information on valid data types, refer to "Overview of the valid data types" in the STEP
7 online help.
RET_VAL Description
(W#16#...)
0000 No error
8090 Hardware identifier of the module at the LADDR parameter is invalid.
* The error codes can be displayed as integer or hexadecimal values in the program editor.
Geographical address
The system data type GEOADDR contains the geographical address of a module (or the slot
information).
• Geographical address for PROFINET IO:
For PROFINET IO, the geographical address is composed of the ID of the PROFINET IO system,
the device number, the slot number, and the submodule (if a sub-module is used).
• Geographical address for PROFIBUS DP:
For PROFIBUS DP, the geographical address consists of the ID of the DP master system, the
station number, and the slot number.
The slot information of the modules can be found in the hardware configuration of each module.
Enable reading from the file using the REQ control parameter. The output parameters Done,
Busy, Error and Status indicate the status of the job.
The following rules apply for the file name and path specification:
• The file name must not be longer than 55 characters.
• The following characters are permitted for the folder and file name: "0" to "9", "a" to "z", "A"
to "Z", "-", "_"
• The file name must not contain more than one dot ("."); the dot separates the name from the
file extension. The file name must contain at least one character. A file extension is not
necessary.
• The path name must not start with "/", "\" or ".".
• The path name must not contain any ".."
• The path name must not contain a subfolder under the UserFiles folder.
Examples of valid paths and file names: "UserFiles/Lift16_DataBase.txt", "UserFiles/
2017-04-13_ErrorLog.bin"
You can read up to 16 MB (16,777,216 bytes) by executing "FileReadC"; the data is read segment
by segment. The segment size is device-specific; an S7-1500-CPU, for example, uses 32 KB
(32,768 byte) blocks. If the number of data items to be read is greater than the segment size, you
will need to call the instruction multiple times in your program. For consistency reasons, you
should therefore not access the data read until after you call the instruction for the last time.
The parameters "Offset" and "Length" specify the length of the items of data to be read. The
resource occupied is released again once the read process is complete.
The "FileReadC" instruction works asynchronously. Processing takes place across several calls.
You start processing with a rising edge at the parameter "REQ".
The parameters "Busy" and "Done" indicate the status of the job.
If an error occurs during execution, this is signaled by the parameters "Error" and "Status".
See also
New features (Page 35)
Enable writing to the file using the "REQ" control parameter. The output parameters "Done",
"Busy", "Error" and "Status" indicate the status of the job.
The following rules apply for the file name and path specification:
• The file name must not be longer than 55 characters.
• The following characters are permitted for the folder and file name: "0" to "9", "a" to "z", "A"
to "Z", "-", "_"
• The file name must not contain more than one dot ("."); the dot separates the name from the
file extension. The file name must contain at least one character. A file extension is not
necessary.
• The path name must not start with "/", "\" or ".".
• The path name must not contain any ".."
• The path name must not contain a subfolder under the UserFiles folder.
Examples of valid paths and file names: "UserFiles/Lift16_DataBase.txt", "UserFiles/
2017-04-13_ErrorLog.bin"
You can write up to 16 MB (16,777,216 bytes) by executing "FileWriteC"; the data is written
segment by segment. The segment size is device-specific; an S7-1200-CPU, for example, uses
8 KB (8192 byte) blocks. If the number of data items to be written is greater than the segment
size, you will need to call the instruction multiple times in your program. For consistency
reasons, you should therefore not access the data written until after you call the instruction for
the last time. If the available file is too short, it is extended to the required size.
The parameters "Offset" and "Length" specify the location in the file to which the data is to be
written. The resource occupied is released again once the write process is complete.
The "FileWriteC" instruction only starts the write operation if the following condition is fulfilled:
"Offset" + "Length" <= 16 MB.
The "FileWriteC" instruction works asynchronously. Processing takes place across several calls.
You start processing with a rising edge at the parameter "REQ".
The parameters "Busy" and "Done" indicate the status of the job.
If an error occurs during execution, this is signaled by the parameters "Error" and "Status".
See also
New features (Page 35)
The file must not be open. Wildcards in the "Name" parameter are not supported, meaning that
names such as "UserFiles/*.txt" and "UserFiles/?.txt" are not permissible.
The "FileDelete" instruction is only permitted in the "Recipes" and "UserFiles" folders. Folders
within these folders are possible, e.g. "UserFiles/Test/file1.txt".
Note
Deleting data logs
Deleting a file in the "DataLog" folder with the "FileDelete" instruction is not permissible. You
must use the "DataLogDelete" instruction to delete data logs.
"FileDelete" is an asynchronous instruction. Processing can extend over multiple calls. You start
processing with a rising edge at the parameter "REQ".
The parameters "Busy" and "Done" indicate the status of the job.
If an error occurs during execution, this is signaled by the parameters "Error" and "Status".
See also
New features (Page 35)
Note
The CTRL_HSC_EXT instruction replaces the legacy CTRL_HSC instruction for projects targeting
V4.2 CPUs and later. All of the functionality of the CTRL_HSC instruction, plus several additional
features, is available with the CTRL_HSC_EXT instruction. The legacy CTRL_HSC instruction is
only available for compatibility with older S7-1200 projects and should not be used in new
projects.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "CTRL_HSC_1_DB" is the name of the instance DB.
10.1.1.2 Example
To use the CTRL_HSC_EXT instruction, follow the steps below:
1. Place the CTRL_HSC_EXT instruction in the ladder network, which also creates the following
instance data block: "CTRL_HSC_EXT_DB":
2. Attach the HSC’s hardware identifier, found in the HSC’s properties, to the "HSC" pin of the
ladder instruction. You can also select one of the six "Hw_Hsc" objects from the dropdown
menu of this input pin. The default tag name for HSC1 is "Local~HSC_1":
3. Create a global data block named "Data_block_1" (You can also use an existing global data
block.):
– Within "Data_block_1", locate an empty row and add a variable named "MyHSC".
– In the "Data type" column, add one of the following System Data Types (SDT). Select the
SDT that corresponds to the HSC’s configured type of counting. More HSC SDT information
can be found later in this section. The dropdown list does not contain these types so
ensure that you enter the SDT name exactly as shown: HSC_Count, HSC_Period, or
HSC_Frequency
– After you enter the data type, you can expand the "MyHSC" variable to see all the fields
contained in the data structure. Here, you can find the data type of each of the fields and
change the default starting values:
4. Assign the variable "'Data_block_1'. MyHSC" to the CTRL input pin of the CTRL_HSC_EXT
instruction:
– Select "Data_Block_1".
– Select "MyHSC".
– Delete the period (".") following: "'Data_Block_1'.MyHSC". Then, either click outside the
box or press the ESC key once and then press the Enter key.
Note
After deleting the period (".") following: "'Data_Block_1'.MyHSC", do not press only the Enter
key. This action places the period (".") back into the box.
After you configure the HSC in the PLC, you can execute the CTRL_HSC_EXT instruction. If an
error occurs, ENO is set to "0" and the STATUS output indicates the condition code.
See also
CTRL_HSC_EXT Instruction System Data Types (SDT) (Page 516)
The following System Data Types (SDTs) are only used with the CTRL_HSC_EXT instruction’s CTRL
pin. To use them, create a user data block and add an object with the data type of the SDT that
corresponds to the HSC’s configured mode (type of counting). STEP 7 does not show these data
types in the dropdown menu. Type the name of the SDT exactly as shown.
Inputs of the HSC’s SDT are denoted by the prefix "En" or "New". Inputs prefixed with "En" either
enables an HSC function or updates the corresponding parameter. The prefix "New" identifies the
update value. In order for the new value to take effect, the corresponding "En" bit must be true,
and the "New" value must be valid. When the CTRL_HSC_EXT instruction is executed, the
program applies input changes and updates the outputs with the appropriate SDT reference
attached.
SDT: HSC_Count
The "HSC_Count" data type corresponds to an HSC configured for "Count" mode. The Count
mode provides the following capabilities:
• Access the current pulse count
• Latch the current pulse count on an input event
• Reset the current pulse count to the starting value on an input event
• Access status bits, indicating certain HSC events have occurred
• Disable the HSC using a software or hardware input
• Change the counting direction using a software or hardware input
• Change the current pulse count
• Change the starting value (used when CPU transitions to RUN state or when Sync function is
triggered)
• Changing two independent reference (or preset) values used for comparison
• Change the upper and lower counting limits
• Change how the HSC operates when the pulse count reaches those limits
• Generate a hardware interrupt event when the current pulse count reaches a reference
(preset) value
• Generate a hardware interrupt event when the Synchronization (reset) input activates
• Generate a hardware interrupt event when the counting direction changes based upon an
external input
• Generate a single output pulse on a specified counting event
When an event occurs and the CTRL_HSC_EXT instruction executes, the instruction sets a status
bit. On the following CTRL_HSC_EXT instruction execution, the instruction clears the status bit,
unless the event occurs again before the instruction executes.
SDT: HSC_Period
The "HSC_Period" data type corresponds to an HSC configured for "Period" mode. The
CTRL_HSC_EXT instruction provides program access to the number of input pulses over a
specified measurement interval. This instruction allows for the time period between input pulses
to be calculated with a fine nanosecond resolution.
ElapsedTime returns the time, in nanoseconds, between the last counting events of sequential
measurement intervals. If no counting events occurred during a measurement interval,
ElapsedTime returns the cumulative time since the last counting event. ElapsedTime has a range
from "0" to 4,294,967,280 nanoseconds (0x0000 0000 to 0xFFFF FFF0). The return value
4,294,967,295 (0xFFFF FFFF) indicates that period overflow has occurred. Overflow indicates
that the time between pulse edges is greater than 4.295 seconds and the period cannot be
calculated using this instruction. The values from 0xFFFF FFF1 to 0xFFFF FFFE are reserved.
EdgeCount returns the number of counting events received during the measurement interval.
The period can only be calculated when the value of EdgeCount is greater than zero. If
ElapsedTime is either "0" (no input pulses received) or 0xFFFF FFFF (Period overflow), then
EdgeCount is not valid.
When EdgeCount is valid, use the following formula to calculate the period in nanoseconds:
Period = ElapsedTime/EdgeCount
The calculated time period value is an average of the time periods of all of the pulses that occur
during the measurement interval. If the period of an incoming pulse is greater than the
measurement interval (10, 100, or 1000 ms), then the period calculation requires multiple
measurement intervals.
The following examples show how the instruction makes period measurements:
6)%&DOOV
(W WW
(W(ODSVHG7LPH (W (W (W WW (F
(F(GJH&RXQW (F (F (F
+:&DSWXUHRI7LPH W W
6)%&DOOV
(W WW
(W (W (W PV (F
(W(ODSVHG7LPH
(F(GJH&RXQW (F (F (F
5XOHV
,I(W WKHSHULRGLVLQYDOLG
(OVH3HULRG (W(F
SDT: HSC_Frequency
The "HSC_Frequency" data type corresponds to an HSC configured for "Frequency" mode. The
instruction CTRL_HSC_EXT provides program access to the frequency of input pulses, measured
over a specified time period.
Using the CTRL_HSC_EXT instruction in Frequency mode provides the following capabilities:
The CTRL_HSC_EXT instruction measures the Frequency using the same measurement
technique as Period mode to find the ElapsedTime and EdgeCount. The instruction calculates the
6\QFLQSXW
&RXQWHUYDOXH
6WDUWYDOXH
+6&B&RXQW(Q6\QF 7UXH
)DOVH
,QWHUQDOJDWH $FWLYH
,QDFWLYH
Note
The configured input filters delay the control signal of the digital input.
This input function is only available to be used when the HSC is configured for Count mode.
Refer to Input functions (Page 533) for information on how to configure the Synchronization
function.
The term "open" is defined to be the active state of the gate. Similarly, the term "closed" is defined to be the
inactive state of the gate.
You control the software gate with the "HSC_Count.EnHSC" enable bit in the SDT attached to the
CTRL_HSC_EXT instruction. To open the software gate, set the "HSC_Count.EnHSC" bit true; to
close the software gate, set the "HSC_Count.EnHSC" bit false. Execute the CTRL_HSC_EXT
instruction to update the software gate’s state.
The hardware gate is optional, and you can enable or disable it in the HSC properties section. To
control a counting process with only the hardware gate, the software gate must remain open.
If you do not configure a hardware gate, the hardware gate is considered to be always open and
the internal gate state is the same as the software gate state.
The figure below shows an example of the hardware gate opening and closing with a digital
input. The digital input is configured for an active high level:
&RXQWHUYDOXH
&RXQWSXOVHV
,QWHUQDOJDWH
$FWLYH
,QDFWLYH
Note
The configured input filters delay the control signal of the digital input.
The hardware gate function is only available to be used when the HSC is configured for Count
mode. In Period and Frequency modes, the internal gate state is the same as the software gate
state.
In Period mode, the software gate is controlled by "HSC_Period.EnHSC".
In Frequency mode, the software gate is controlled by "HSC_Frequency.EnHSC".
Refer to Input functions (Page 533) for information on how to configure the Gate function.
&DSWXUHLQSXW
&RXQWHUYDOXH
+6&B&RXQW&DSWXUHG&RXQW
+6&B&RXQW(Q&DSWXUH 7UXH
)DOVH
,QWHUQDOJDWH:
$FWLYH
,QDFWLYH
Note
The configured input filters delay the control signal of the digital input.
This input function can only be used when the HSC is configured for Count mode.
Refer to Input functions (Page 533) for information on how to configure the Capture function.
&RPSDUHRXWSXW
&RXQWHUYDOXH
5HIHUHQFHYDOXH
,QWHUQDOJDWH
$FWLYH
,QDFWLYH
Note
This output function can only be used when the HSC is configured for Count mode.
Refer to Output function (Page 533) for information on how to configure the Compare function.
10.1.2.5 Applications
A typical application uses the HSC to monitor feedback from an incremental shaft encoder. The
shaft encoder provides a specified number of counts per revolution that you can use as the clock
generator input to the HSC. There is also a reset pulse that occurs once per revolution that you
can use as the sync input to the HSC.
To start, the user program should load the initial reference value into the HSC and set the outputs
to their initial states. The outputs remain in this state for the time period that the current count
is less than the reference value. The HSC provides an interrupt when the current count is equal
to the reference value, when the sync event (reset) occurs, and also when there is a direction
change.
As each counter value equals the reference value, an interrupt event occurs. Within the interrupt
OB, the user program should load the next reference value into the HSC and set the outputs to
their next state.
When the sync input is triggered, the current count value is set to the start value, and an
interrupt event occurs. Within this interrupt OB, the user program should load the initial
reference value into the HSC and set the outputs to their initial state. At this point the HSC has
returned to its initial state and the cycle repeats with the HSC continuing to count.
Since the interrupts occur at a much slower rate than the counting rate of the HSC, you can
implement precise control of high-speed operations with relatively minor impact to the scan
cycle of the CPU. The method of interrupt attachment allows each load of a new preset to be
performed in a separate interrupt routine for easy state control. Alternatively, you can process
all interrupt events in a single interrupt routine.
The Gate function, triggered either by the user program or an external input signal, can disable
counting of the encoder pulses. You can ignore any movement of the shaft by deactivating the
gate. This means that while the encoder continues to send pulses to the HSC, the count value is
held at the last value before the gate goes inactive. When the gate goes active, counting resumes
from the last value before the gate went inactive.
When enabled, the Capture function causes the current count to be captured on the occurrence
of an external input. A process (for example, a calibration routine) can use this function to
determine how many pulses occur between events.
When enabled, the Compare output function generates a single, configurable pulse that occurs
every time the current count reaches one of the reference values or overflows (exceeds the
counting limits). You can use this pulse as a signal to start another process whenever a certain
HSC event occurs.
The counting direction is controlled by either the user program or an external input signal.
To obtain the speed of the rotating shaft, you can configure the HSC for Frequency mode. This
function provides a signed integer value in units of Hz. Because the reset signal occurs once per
revolution, measuring the frequency of the reset signal provides a quick indication of the shaft’s
speed, in revolutions per second.
If you desire a floating point value of the frequency, configure the HSC for Period mode. You can
use the ElapsedTime and EdgeCount values returned in Period mode to calculate the frequency.
must be a unique name. Names of enabled HSCs become tags with the Data type "HW_Hsc" in
the "System constant" tag table and are available for use as the "HSC" parameter of the
CTRL_HSC_EXT instructions. Refer to "Configuring the operation of the CPU (Page 143)" for
further information:
After enabling the HSC, STEP 7 sets single phase counting as the default configuration. Once you
set the digital input filter for the HSC clock generator input, the program can be downloaded to
the PLC, and the CPU is ready to count. To change the HSC’s configuration, proceed to the next
section, "Type of Counting".
The following table provides an overview of what inputs and outputs are available for each
configuration:
Single phase
Single-phase (not available with motion control) counts pulses:
• User program (internal direction control):
– 1 is up
– -1 is down
• Hardware input (external direction control):
– High level is up.
– Low level is down.
&XUUHQWYDOXHORDGHGWRUHIHUHQFHYDOXHORDGHGWRFRXQWLQJGLUHFWLRQVHWWRXS
&RXQWHUELWVHWWRHQDEOHG
59 &9LQWHUUXSWJHQHUDWHG
59 &9LQWHUUXSWJHQHUDWHGDQG
'LUHFWLRQFKDQJHGLQWHUUXSWJHQHUDWHG
&ORFN
'LUHFWLRQ
FRQWURO
XS
&RXQWHU
FXUHQW
YDOXH
Two phase
Two phase counts:
• Up on the clock up input
• Down on the clock down input
&XUUHQWYDOXHORDGHGWRUHIHUHQFHYDOXHORDGHGWRFRXQWLQJGLUHFWLRQVHWWRXS
&RXQWHUELWVHWWRHQDEOHG
59 &9LQWHUUXSWJHQHUDWHG
59 &9LQWHUUXSWJHQHUDWHGDQG
'LUHFWLRQFKDQJHGLQWHUUXSWJHQHUDWHG
&RXQWXS
FORFN
&RXQWGRZQ
FORFN
&RXQWHU
FXUUHQW
YDOXH
A/B counter
A/B phase quadrature counts:
• Up on the rising edge of the clock A input when the clock B input is low
• Down on the falling edge of the clock A input when the clock B input is low
&XUUHQWYDOXHORDGHGWRSUHVHWORDGHGWRLQLWLDOGLUHFWLRQVHWWRXS
&RXQWHUHQDEOHELWVHWWRHQDEOHG
3KDVH$
FORFN
3KDVH%
FORFN
&RXQWHU
FXUUHQW
YDOXH
&XUUHQWYDOXHORDGHGWRSUHVHWORDGHGWRLQLWLDOFRXQWLQJGLUHFWLRQVHWWRXS
&RXQWHUHQDEOHELWVHWWRHQDEOHG
59 &9LQWHUUXSWHQDEOHG
3KDVH$
FORFN
3KDVH%
FORFN
&RXQWHUFXUUHQW
YDOXH
The values above and the behavior of the counter when it reaches a limit are only available in
Count mode. You can adjust the values and the behavior with the CTRL_HSC_EXT instruction
using the HSC_Count SDT.
Synchronization input
The Sync (synchronization) input sets the current count value to the starting (or initial counter)
value. You typically use the Sync input to reset the counter to "0". You can trigger the Sync when
the input pin is in one of the following states:
• High
• Low
• Goes from low to high
• Goes from high to low
• Goes from high to low or from low to high
Capture input
The Capture input sets the captured count value to the count value saved at the moment you
triggered the Capture input. You can trigger the capture when the input pin is in one of the
following states:
• Goes from low to high
• Goes from high to low
• Goes from high to low or from low to high
Gate input
The Gate input stops HSC counting. You can trigger the Gate when the input pin is in one of the
following states:
• High
• Low
The compare output function is the only output for the HSC and is only available in Count mode.
Compare output
You can configure the Compare output to generate a single pulse on the occurrence of one of the
following events:
• Counter equals reference value (count direction is up)
• Counter equals reference value (count direction is down)
• Counter equals reference value (count direction is up or down)
• Counter equals reference value 2 (count direction is up)
• Counter equals reference value 2 (count direction is down)
• Counter equals reference value 2 (count direction is up or down)
• Positive overflow
• Negative overflow
You can configure the output pulse with a cycle time ranging from 1 to 500 ms; the default cycle
time is 10 ms. You can set the pulse width, or duty cycle, anywhere from 1 to 100%; the default
pulse width is 50%.
If multiple compare output events occur within the specified cycle time, the output pulses from
those events are lost due to the fact that the current pulse has not completed its cycle yet. Once
the pulse has finished (the configured cycle time has passed), the pulse generator is available to
produce a new pulse.
Note
CPU and SB input channels (V4 or later firmware) have configurable input filter times
Earlier firmware versions had fixed HSC input channels and fixed filter times that you could not
change.
With V4 or later versions, you can assign input channels and filter times. The default input filter
setting is 6.4 ms, which limits the maximum counting rate to 78 Hz. You can change the filter
settings to count higher or lower frequencies depending on the design of your system.
WARNING
Risks with changes to filter time setting for digital input channels
If the filter time for a digital input channel is changed from a previous setting, a new "0" level
input value might need to be presented for up to a 20.0 ms accumulated duration before the
filter becomes fully responsive to new inputs. During this time, short "0" pulse events of
duration less than 20.0 ms may not be detected or counted.
The changing of filter times can result in unexpected machine or process operation, which can
cause death or serious injury to personnel, and/or damage to equipment.
To ensure that a new filter time goes immediately into effect, power cycle the CPU.
Use the following table and ensure that the CPU and SB input channels that you connect can
support the maximum pulse rates in your process signals:
CPU CPU Input channel Operating phase: Single Operating phase: A/B
phase or Two phase counter or A/B Counter
fourfold
1211C Ia.0 to Ia.5 100 kHz 80 kHz
1212C Ia.0 to Ia.5 100 kHz 80 kHz
Ia.6, Ia.7 30 kHz 20 kHz
1214C and 1215C Ia.0 to Ia.5 100kHz 80kHz
Ia.6 to Ib.5 30 kHz 20 kHz
1217C Ia.0 to Ia.5 100 kHz 80 kHz
Ia.6 to Ib.1 30 kHz 20 kHz
Ib.2 to Ib.5 1 MHz 1 MHz
(.2+, .2- to .5+, .5-)
SB signal board SB input channel Operating phase: Single Operating phase: A/B
phase or Two phase counter or A/B Counter
fourfold
SB 1221, 200 kHz Ie.0 to Ie.3 200kHz 160 kHz
SB 1223, 200 kHz Ie.0, Ie.1 200kHz 160 kHz
SB 1223 Ie.0, Ie.1 30 kHz 20 kHz
When assigning an input point to an HSC function, you can assign the same input point to
multiple HSC functions. For example, assigning I0.3 to the Sync input of HSC1 and the Sync input
of HSC2 to synchronize the count of both HSCs at the same time is a valid configuration;
however, it generates a compiler warning.
When possible, avoid assigning multiple input functions of the same HSC to the same input
point. For example, assigning I0.3 to the Sync input and the Gate input of HSC 1 to synchronize
the count and disable counting at the same time is also a valid configuration. You can make this
configuration, but it could produce unintended results.
WARNING
Risks with assigning multiple functions to a single digital input channel
Assigning multiple input functions of the same HSC to a common input point may produce
unpredictable results. When a trigger occurs on a point with multiple functions assigned to that
trigger, the order in which the functions are executed by the PLC cannot be known. This is
known as a race condition and is often an undesirable situation.
This race condition can result in unexpected machine or process operation, which can cause
death or serious injury to personnel, and/or damage to equipment.
To avoid a race condition, do not assign more than two input functions, of the same HSC, to the
same input pin. If an HSC has two input functions assigned to the same pin, set the triggers such
that they could never occur at the same time. Remember that a falling edge occurs at the same
instance that a low level begins and that a rising edge occurs at the same instance that a high
level begins.
Note
You assign the digital input and output points used by high-speed counter (HSC) devices during
CPU device configuration. When you assign input and output points to HSC devices, you cannot
modify the values of these points using the force function in a watch table. The HSC has full
control of these input and output points.
High-speed counter (HSC) Current value data type Default current value address
HSC1 DInt ID 1000
HSC2 DInt ID 1004
HSC3 DInt ID 1008
HSC4 DInt ID 1012
HSC5 DInt ID 1016
HSC6 DInt ID 1020
If an error occurs, ENO is set to "0" and the STATUS output indicates a condition code:
counting down. Frequency is returned in units of Hertz (for example, 123.4 Hz is returned as
123).
S7-1200 CPU
The S7-1200 CPU combines the functionality of a programmable logic controller with motion
control functionality for operation of drives. The motion control functionality takes over the
control and monitoring of the drives.
Signal board
You add further inputs and outputs to the CPU with the signal boards. You can use the digital
outputs as pulse generator outputs for controlling drives as required. In CPUs with relay outputs,
the pulse signal cannot be output on the onboard outputs because the relays do not support the
necessary switching frequencies. To be able to work with the Pulse Train Output (PTO) on these
CPUs, you must use a signal board with digital outputs.
You can use the analog outputs for controlling connected analog drives as required.
PROFINET
Use the PROFINET interface to establish the online connection between the CPU S7-1200 and
the programming device. In addition to the online functions of the CPU, additional
commissioning and diagnostic functions are available for motion control.
PROFINET continues to support the PROFIdrive profile for connecting PROFIdrive capable drives
and encoders.
• MC_MoveAbsolute (Page 545) starts motion to an absolute position. The job ends when the
target position is reached.
• MC_MoveRelative (Page 546) starts a positioning motion relative to the start position.
• MC_MoveVelocity (Page 546) causes the axis to travel with the specified speed.
• MC_MoveJog (Page 547) executes jog mode for testing and startup purposes.
• MC_CommandTable (Page 547) runs axis commands as a movement sequence.
• MC_ChangeDynamic (Page 549) changes Dynamics settings for the axis.
• MC_WriteParam (Page 548) writes a select number of parameters to change the
functionality of the axis from the user program.
• MC_ReadParam (Page 548) reads a select number of parameters that indicate the current
position, velocity, and so forth of the axis defined in the Axis input.
Note
Instructions in motion control V1.0 to V3.0 actively control the output of the instruction. When
an error occurs within the block, the Enable out (ENO) output is turned to the OFF state. An error
is indicated by the ERROR, ErrorID, and ErrorInfo outputs on the block. Using the ENO ouput, it
is possible to evaluate the status of the instruction and execute subsequent instructions after it
in a serial manner.
With instructions in motion control V4.0 and V5.0, the ENO output stays true as long as the
instruction executes regardless of its error state. This could cause a program that used V3.0 or
earlier motion control that depends on the ENO status to function incorrectly. To remedy this
situation, use the DONE and ERROR outputs to evaluate the status of the instruction rather than
the ENO output when using motion control V4.0 or later.
Note
If the axis is switched off due to an error, it will be enabled again automatically after the error has
been eliminated and acknowledged. This requires that the Enable input parameter has retained
the value TRUE during this process.
ReferenceMarkPosition=>_real_out_
);
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "MC_Home_DB" is the name of the instance DB.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "MC_Halt_DB" is the name of the instance DB.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "MC_MoveAbsolute_DB" is the name of the instance DB.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "MC_MoveRelative_DB " is the name of the instance DB.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "MC_WriteParam_DB" is the name of the instance DB.
1
STEP 7 automatically creates the DB when you insert the instruction.
2
In the SCL example, "MC_ReadParam_DB " is the name of the instance DB.
• Data adaptation
• Axis control using the TM Pulse module
• Configuring the TO_CommandTable_PTO
• Operation of motion control for S7-1200
• CPU outputs used for motion control
• Hardware and software limit switches for motion control
• Homing
• Jerk limit
• Monitoring active commands
• Monitoring MC instructions with a "Done" output parameter
• Monitoring the MC_Velocity
• Monitoring the MC_MoveJog
• ErrorIDs and ErrorInfos for motion control
See also
SIMATIC STEP 7 S7-1200 Motion Control V6.0 in TIA Portal V15 (https://
support.industry.siemens.com/cs/us/en/view/109773400)
SetpointLimit_H=>_bool_out_,
SetpointLimit_L=>_bool_out_,
InputWarning_H=>_bool_out_,
InputWarning_L=>_bool_out_,
State=>_int_out_,
Error=>_bool_out_,
ErrorBits=>_dword_out_);
1
STEP 7 automatically creates the technology object and instance DB when you insert the instruction. The instance DB contains
the parameters of the technology object.
2
In the SCL example, "PID_Compact_1" is the name of the instance DB.
SetpointLimit_H=>_bool_out_,
SetpointLimit_L=>_bool_out_,
InputWarning_H=>_bool_out_,
InputWarning_L=>_bool_out_,
State=>_int_out_,
Error=>_bool_out_,
ErrorBits=>_dword_out_);
1
STEP 7 automatically creates the technology object and instance DB when you insert the instruction. The instance DB contains
the parameters of the technology object.
2
In the SCL example, "PID_Temp_1" is the name of the instance DB.
• Using PID_Compact:
– Process value limits
– ErrorBit parameters
– Warning parameters
• Using PID_3Step:
– ErrorBit parameters
– Warning parameters
• Using PID_Temp:
– ErrorBit parameters
– Warning parameters
• Configuring the PID_Compact, PID_3Step, and PID_Temp controllers
• Commissioning the PID_Compact, PID_3Step, and PID_Temp controllers
PROFINET
PROFINET is used for exchanging data through the user program with other communications
partners through Ethernet:
• In the S7-1200, PROFINET supports 16 IO devices with a maximum of 256 submodules, and
PROFIBUS allows 3 independent PROFIBUS DP Masters, supporting 32 slaves per DP master,
with a maximum of 512 modules per DP master.
• S7 communication
• User Datagram Protocol (UDP) protocol
• ISO on TCP (RFC 1006)
• Transport Control Protocol (TCP)
PROFINET IO controller
As an IO controller using PROFINET IO, the CPU communicates with up to 16 PN devices on the
local PN network or through a PN/PN coupler (link). Refer to PROFIBUS and PROFINET
International, PI (www.us.profinet.com) for more information.
PROFIBUS
PROFIBUS is used for exchanging data through the user program with other communications
partners through the PROFIBUS network:
• With CM 1242-5, the CPU operates as a PROFIBUS DP slave.
• With CM 1243-5, the CPU operates as a PROFIBUS DP master class1.
• PROFIBUS DP Slaves, PROFIBUS DP Masters, and AS-i (the 3 left-side communication
modules) and PROFINET are separate communications networks that do not limit each other.
AS-i
The S7-1200 CM 1243-2 AS-i Master allows the attachment of an AS-i network to an S7-1200
CPU.
CPU-to-CPU S7 communication
You can create a communication connection to a partner station and use the GET and PUT
instructions to communicate with S7 CPUs.
TeleService communication
In TeleService via GPRS, an engineering station on which STEP 7 is installed communicates via
the GSM network and the Internet with a SIMATIC S7-1200 station with a CP 1242-7. The
connection runs via a telecontrol server that serves as an intermediary and is connected to the
Internet.
IO‑Link
The S7‑1200 SM 1278 4xIO‑Link Master enables IO‑Link devices to connect to an S7-1200 CPU.
WARNING
Avoiding security risks from physical network attacks
If an attacker can physically access your networks, the attacker can possibly read and write data.
Some forms of communication (I/O exchange through PROFIBUS, PROFINET, AS-i, or other I/O
bus, GET/PUT, T-Block, and communication modules (CM)) have no security features. You must
protect these forms of communication by limiting physical access. If an attacker can physically
access your networks using these forms of communication, the attacker can possibly read and
write data.
If you fail to protect these forms of communication, death or severe personal injury can result.
For security information and recommendations, see the "Operational Guidelines for Industrial
Security" (https://www.industry.siemens.com/topics/global/en/industrial-security/Documents/
operational_guidelines_industrial_security_en.pdf) on the Siemens Service and Support site.
See also
Secure vs. legacy communication (Page 556)
The following table illustrates supported communication for a S7‑1200 CPU with V4.5 firmware:
Additional information
You can find additional details about the implementation of secure communication in the
TIA Portal Information System. In particular, additional information about certificates is in the
following TIA Portal Information System topics:
• Confidentiality through encryption
• Managing certificates with STEP 7
• Examples for the management of certificates
• Authenticity and integrity through signatures
See also
Protection of confidential PLC configuration data (Page 150)
Enabling secure PG/PC and HMI communication and creating certificates (Page 155)
Replacing a CPU that has protection of confidential configuration data (Page 1379)
Table 11-2 Port ranges that could be used by open user communication (OUC) and other protocols. Exact communication
parameters are defined by the user as a part of the S7-1200 user program
Table 11-3 Protocols used by S7-1200 in the Data Link and Network Layer (Layer 2, 3) of the OSI model.
Available connections
The CPU supports the following number of maximum simultaneous, asynchronous
communication connections for PROFINET and PROFIBUS. The maximum number of connection
resources allocated to each category are fixed; you cannot change these values. However, you
can configure the "Free available connections" to increase the number of any category as
required by your application.
Some connection types have a fixed number of reserved resources (sometimes called
guaranteed). This means that the CPU is guaranteed to support up to the number of reserved
resources for the connection type. For example, at least 12 HMI connections can be made to the
CPU simultaneously. Additional connections beyond the number of reserved resources can be
made for a connection type, but those connections resources must come from the "dynamic"
resources pool.
The dynamic resources (sometimes called Free) are a collection of resources that can be used for
any connection type. These resources are used by connections that do not have any reserved
resources (such as OPC UA) or by connections that have used up all of their reserved resources.
As of V17, V4.5 CPUs have 34 dynamic resources.
Note
The total number of S7-1200 communication connections does not increase when you add CM/
CP modules.
Note
OPC UA connections
OPC UA connections consume resources from the dynamic resources. Ensure that you have
enough available connections for your application.
Based upon the allocated connection resources, the following number of connections per device
are available:
Note
Web server connections: The CPU provides connections for multiple web browsers. The number
of browsers that the CPU can simultaneously support depends upon how many connections a
given web browser requests/utilizes and the number of dynamic connection resources available
in the CPU.
Note
The Open User Communications, S7 connection, HMI, programming device, OPC UA, and Web
server communication connections may utilize multiple connection resources based upon the
features currently being used.
11.5 PROFINET
The CPU can communicate with other CPUs, with programming devices, with HMI devices, and
with non-Siemens devices using standard TCP communications protocols.
Ethernet switching
The CPU 1211C, 1212C, and 1214C have a single Ethernet port and do not include a integrated
Ethernet Switch. A direct connection between a programming device or HMI and a CPU does not
require an Ethernet switch. However, a network with more than two CPUs or HMI devices
requires an Ethernet switch.
1
① CPU 1215C
② CSM1277 Ether‐
net switch
The CPU 1215C and the CPU 1217C have a built-in 2-port Ethernet switch. You can have a
network with a CPU 1215C and two other S7-1200 CPUs. You can also use the rack-mounted
CSM1277 4-port Ethernet switch for connecting multiple CPUs and HMI devices.
Action Result
Select "Network view" to display the
devices to be connected.
Communication partners execute the instructions to set up and establish the communication
connection. You use parameters to specify the active and passive communication end point
partners. After the connection is set up and established, it is automatically maintained and
monitored by the CPU.
If the connection is terminated (for example, due to a line break), the active partner attempts to
re-establish the configured connection. You do not have to execute the communication
instruction again.
Connection paths
After inserting a TSEND_C, TRCV_C or TCON instruction into the user program, the inspector
window displays the properties of the connection whenever you have selected any part of the
instruction. Specify the communication parameters in the "Configuration" tab of the "Properties"
for the communication instruction.
Table 11-5 Configuring the connection path (using the properties of the instruction)
Note
When you configure the connection properties for one CPU, STEP 7 allows you either to select a
specific connection DB in the partner CPU (if one exists), or to create the connection DB for the
partner CPU. The partner CPU must already have been created for the project and cannot be an
"unspecified" CPU.
You must still insert a TSEND_C, TRCV_C or TCON instruction into the user program of the partner
CPU. When you insert the instruction, select the connection DB that was created by the
configuration.
Table 11-6 Configuring the connection path for S7 communication (Device configuration)
Parameter Definition
Address Assigned IP addresses
General End point Name assigned to the partner (receiving) CPU
Interface Name assigned to the interfaces
Subnet Name assigned to the subnets
Interface type S7 communication only: Type of interface
Connection type Type of Ethernet protocol
Connection ID ID number
Connection data Local and Partner CPU data storage location
Establish active connec‐ Radio button to select Local or Partner CPU as the active connection
tion
Parameter Definition
Address de‐ End point S7 communication only: Name assigned to the partner (receiving) CPU
tails Rack/slot S7 communication only: Rack and slot location
Connection resource S7 communication only: Component of the TSAP used when configuring an S7
connection with an S7-300 or S7-400 CPU
Port (decimal): TCP and UPD: Partner CPU port in decimal format
TSAP 1 and Subnet ID: ISO on TCP (RFC 1006) and S7 communication: Local and partner CPU TSAPs in
ASCII and hexadecimal formats
1
When configuring a connection with an S7-1200 CPU for ISO-on-TCP, use only ASCII characters in the TSAP extension for the
passive communication partners.
Port Numbers
With TCP and UDP protocols, the connection parameter configuration of the Local (active)
connection CPU must specify the remote IP address and port number of the Partner (passive)
connection CPU.
In the "Address Details" section of the Connection Parameters dialog, you define the ports to be
used. The port of a connection in the CPU is entered in the "Local Port" field. The port assigned
for the connection in your partner CPU is entered under the "Partner Port" field.
combined with the device IP address in a logical AND operation, defines the boundaries of an IP
subnet.
Note
In a World Wide Web scenario, where your programming devices, network devices, and IP
routers communicate with the world, you must assign unique IP addresses to avoid conflict with
other network users. Contact your company IT department personnel, who are familiar with
your plant networks, for assignment of your IP addresses.
WARNING
Unauthorized access to the CPU through the Web server
Users with CPU full access or full access (incl. fail-safe) privileges have privileges to read and
write PLC variables. Regardless of the access level for the CPU, Web server users can have
privileges to read and write PLC variables. Unauthorized access to the CPU or changing PLC
variables to invalid values could disrupt process operation and could result in death, severe
personal injury and/or property damage.
Authorized users can perform operating mode changes, writes to PLC data, and firmware
updates. Siemens recommends that you observe the following security practices:
• Password protect CPU access levels (Page 152) and Web server user IDs (Page 808) with
strong passwords.
• Strong passwords are at least twelve characters, are not trivial or easy to guess, and include
at least three of the following:
– Uppercase letters
– Lowercase letters
– Digits
– Special characters
• A trivial password is one that is easy to guess. It is usually based on a characteristic of the
user, such as a pet’s name, family name, or the company where the user works. For
example: Siemens1$, June2015, or Qwerty1234.
• Best practices for generating strong but easy-to-remember passwords include the use of
meaningless short sentences and mixing several random words. For example:
PC;House#R3d
• Enable access to the Web server only with the HTTPS protocol.
• Do not extend the default minimum privileges of the Web server "Everybody" user.
• Perform error-checking and range-checking on your variables in your program logic
because Web page users can change PLC variables to invalid values.
• Use a secure Virtual Private Network (VPN) to connect to the S7-1200 PLC Web server from
a location outside your protected network.
Note
A secondary network adapter card is useful when you do not want your CPU on your company
LAN. During initial testing or commissioning tests, this arrangement is particularly useful.
Assigning or checking the IP address of your programming device using "My Network Places" (on
your desktop)
To assign or check your programming device's IP address, follow these steps:
1. Open the Control Panel from the Start menu.
2. Open the "Network and Sharing Center" and elect "Local Area Connection" for the network
adapter connected to your CPU
3. Click "Properties" on the "Local Area Connection Status" dialog.
4. In the "Local Area Connection Properties" dialog, select "Internet Protocol Version 4 (TCP/
IPv4)" for the "This connection uses the following items:" field.
5. Click the "Properties" button.
6. Select "Obtain an IP address automatically" or to enter a static IP address select "Use the
following IP address".
7. If you selected "Use the following IP address", set the IP address and subnet mask:
– Set the IP address to use the same Network ID and same subnet as the CPU. For example,
if the CPU IP address is 192.168.0.1, you could set the IP address to 192.168.0.200.
– Select a subnet mask of 255.255.255.0.
– Leave the default gateway blank.
You can now connect to the CPU.
Note
The Network Interface Card and the CPU must be on the same subnet to allow STEP 7 to find and
communicate with the CPU.
Consult your IT personnel to help you set up a network configuration to allow you to connect to
the S7-1200 CPU.
① PROFINET port
IP address: Each device must also have an Internet Protocol (IP) address. This address allows the
device to deliver data on a more complex, routed network.
Each IP address is divided into four 8-bit segments and is expressed in a dotted, decimal format
(for example, 211.154.184.16). The first part of the IP address is used for the Network ID (What
network are you on?), and the second part of the address is for the Host ID (unique for each
device on the network). An IP address of 192.168.x.y is a standard designation recognized as
part of a private network that is not routed on the Internet.
Subnet mask: A subnet is a logical grouping of connected network devices. Nodes on a subnet
tend to be located in close physical proximity to each other on a Local Area Network (LAN). A
mask (known as the subnet mask or network mask) defines the boundaries of an IP subnet.
A subnet mask of 255.255.255.0 is generally suitable for a small local network. This means that
all IP addresses on this network should have the same first 3 octets, and the various devices on
this network are identified by the last octet (8-bit field). An example of this is to assign a subnet
mask of 255.255.255.0 and an IP addresses of 192.168.2.0 through 192.168.2.255 to the
devices on a small local network.
The only connection between different subnets is via a router. If subnets are used, an IP router
must be employed.
IP router: Routers are the link between LANs. Using a router, a computer in a LAN can send
messages to any other networks, which might have other LANs behind them. If the destination
of the data is not within the LAN, the router forwards the data to another network or group of
networks where it can be delivered to its destination.
Routers rely on IP addresses to deliver and receive data packets.
IP addresses properties: In
the Properties window, se‐
lect the "Ethernet address‐
es" configuration entry.
STEP 7 displays the Ethernet
address configuration dia‐
log, which associates the
software project with the IP
address of the CPU that will
receive that project.
Parameter Description
Subnet Name of the Subnet to which the device is connected. Click the "Add new subnet" button to create a new
subnet. "Not connected" is the default. Two connection types are possible:
• The "Not connected" default provides a local connection.
• A subnet is required when your network has two or more devices.
IP protocol IP address Assigned IP address for the CPU
Subnet mask Assigned subnet mask
Use IP router Click the checkbox to indicate the use of an IP router
Router address Assigned IP address for the router, if applicable
Note
All IP addresses are configured when you download the project. If the CPU does not have a pre-
configured IP address, you must associate the project with the MAC address of the target device.
If your CPU is connected to a router on a network, you must also enter the IP address of the router.
The "Set IP address using a different method" radio button allows you to change the IP address
online or by using the "T_CONFIG (Page 675)" instruction after the program is downloaded.
This IP address assignment method is for the CPU only.
WARNING
Downloading a hardware configuration with "Set IP address using different method"
After downloading a hardware configuration with the "Set IP address using a different method"
option enabled, it is not possible to transition the CPU operating mode from RUN to STOP or
from STOP to RUN.
User equipment continues to run under these conditions and can result in unexpected machine
or process operations, which could cause death, severe personal injury, or property damage if
proper precautions are not taken.
Ensure that your CPU IP address(es) are set before using the CPU in an actual automation
environment. This can be done by using your STEP 7 programming package, the SIMATIC
Automation Tool, or an attached HMI device in conjunction with the T_CONFIG instruction.
WARNING
Condition in which PROFINET network might stop
When changing the IP address of a CPU online or from the user program, it is possible to create
a condition in which the PROFINET network might stop.
If the IP address of a CPU is changed to an IP address outside the subnet, the PROFINET network
will lose communication, and all data exchange will stop. User equipment may be configured
to keep running under these conditions. Loss of PROFINET communication may result in
unexpected machine or process operations, causing death, severe personal injury, or property
damage if proper precautions are not taken.
If an IP address must be changed manually, ensure that the new IP address lies within the
subnet.
Using the "Extended download to device" dialog to test for connected network devices
The S7-1200 CPU "Download to device" function and its "Extended download to device" dialog
can show all accessible network devices and whether or not unique IP addresses have been
assigned to all devices. To display all accessible and available devices with their assigned MAC or
IP addresses, check the "Show all accessible devices" checkbox.
If the required network device is not in this list, communications to that device have been
interrupted for some reason. The device and network must be investigated for hardware and/or
configuration errors.
Note
Each CPU is loaded at the factory with a permanent, unique MAC address. You cannot change
the MAC address of a CPU.
The MAC address is printed on the front, lower-left corner of the CPU. Note that you have to lift
the lower door to see the MAC address information.
X1P1
PROFINET LAN
MAC ADDRESS
① MAC address
Initially, the CPU has no IP address, only a factory-installed MAC address. PROFINET
communications requires that all devices be assigned a unique IP address.
WARNING
Risk of attacker accessing your networks through Network Time Protocol (NTP)
synchronization
If an attacker can access your networks through Network Time Protocol (NTP) synchronization,
the attacker can possibly disrupt control of your process by shifting the CPU system time.
Disruptions to process control can possibly cause death, severe injury, or property damage.
The S7‑1200 CPU disables the NTP client feature by default. When you enable the NTP feature,
then only the IP addresses that you configure can act as NTP servers. You must configure the
NTP feature to allow CPU system time corrections from remote servers.
The S7‑1200 CPU supports "time of day" interrupts and clock instructions that depend upon
accurate CPU system time. If you configure NTP and accept time synchronization from a server,
you must ensure that the server is a trusted source. Failure to do so can cause a security breach
that allows an unknown user to take disrupt control of your process by shifting the CPU system
time.
For security information and recommendations, please see our "Operational Guidelines for
Industrial Security" (https://www.industry.siemens.com/topics/global/en/industrial-security/
Documents/operational_guidelines_industrial_security_en.pdf) on the Siemens Service and
Support site.
The Network Time Protocol (NTP) is widely used to synchronize the clocks of computer systems
to Internet time servers. In NTP mode, the CPU sends time-of-day queries at regular intervals (in
the client mode) to the NTP server in the subnet (LAN). Based on the replies from the server, the
most reliable and most accurate time is calculated and the time of day on the station is
synchronized.
The advantage of this mode is that it allows the time to be synchronized across subnets.
You configure the IP addresses of up to four NTP servers. The update interval defines the interval
between the time queries (in seconds). The value of the interval ranges between 10 seconds and
one day.
In NTP mode, the servers generally transfer UTC (Universal Time Coordinated), which
corresponds to GMT (Greenwich Mean Time).
In the Properties window of the CPU's device configuration, select the "Time synchronization"
configuration entry. STEP 7 displays the Time synchronization configuration dialog:
Note
The CPU receives all the IP addresses when you download the project.
Parameter Definition
Enable time synchronization via NTP Select the checkbox to enable time synchronization via NTP
server server.
Server 1 Assigned IP Address for network time server 1
Server 2 Assigned IP Address for network time server 2
Server 3 Assigned IP Address for network time server 3
Server 4 Assigned IP Address for network time server 4
Time synchronization update interval Interval value (sec)
CPU synchronizes the modules of the de‐ Select the checkbox to synchronize the CP clock with the CPU
vice. clock.
11.5.8.1 Protocols
The integrated PROFINET port of the CPU supports multiple communications standards over an
Ethernet network:
• Transport Control Protocol (TCP)
• ISO on TCP (RFC 1006)
• User Datagram Protocol (UDP)
Protocol Usage examples Entering data in the re‐ Communication in‐ Addressing type
ceive area structions
TCP CPU-to-CPU communi‐ Ad hoc mode Only TRCV_C and TRCV Assigns port numbers to
cation Data reception with speci‐ TSEND_C, TRCV_C, the Local (active) and
Transport of frames fied length TCON, TDISCON, TSEND, Partner (passive) devices
and TRCV
ISO on TCP CPU-to-CPU communi‐ Ad hoc mode Only TRCV_C and TRCV Assigns TSAPs to the Lo‐
cation Protocol-controlled TSEND_C, TRCV_C, cal (active) and Partner
Message fragmenta‐ TCON, TDISCON, TSEND, (passive) devices
tion and re-assembly and TRCV
UDP CPU-to-CPU communi‐ User Datagram Protocol TUSEND and TURCV Assigns port numbers to
cation the Local (active) and
User program commu‐ Partner (passive) devices,
nications but is not a dedicated
connection
Protocol Usage examples Entering data in the re‐ Communication in‐ Addressing type
ceive area structions
S7 communication CPU-to-CPU communi‐ Data transmission and re‐ GET and PUT Assigns TSAPs to the Lo‐
cation ception with specified cal (active) and Partner
Read/write data length (passive) devices
from/to a CPU
PROFINET IO CPU-to-PROFINET IO Data transmission and re‐ Built-in Built-in
device communica‐ ception with specified
tion length
Transport Control Protocol (TCP) is a standard protocol described by RFC 793: Transmission
Control Protocol. The primary purpose of TCP is to provide reliable, secure connection service
between pairs of processes. This protocol has the following features:
• An efficient communications protocol since it is closely tied to the hardware
• Suitable for medium-sized to large data amounts (up to 8192 bytes)
• Provides considerably more facilities for applications, notably error recovery, flow control,
and reliability
• A connection-oriented protocol
• Can be used very flexibly with third-party systems which exclusively support TCP
• Routing-capable
• Only static data lengths are applicable.
• Messages are acknowledged.
• Applications are addressed using port numbers.
• Most of the user application protocols, such as TELNET and FTP, use TCP.
• Programming effort is required for data management due to the SEND / RECEIVE
programming interface.
International Standards Organization (ISO) on Transport Control Protocol (TCP) (RFC 1006) (ISO
on TCP) is a mechanism that enables ISO applications to be ported to the TCP/IP network. This
protocol has the following features:
• An efficient communications protocol closely tied to the hardware
• Suitable for medium-sized to large data amounts (up to 8192 bytes)
• In contrast to TCP, the messages feature an end-of-data identification and are message-
oriented.
• Routing-capable; can be used in WAN
• Dynamic data lengths are possible.
• Programming effort is required for data management due to the SEND / RECEIVE
programming interface.
Using Transport Service Access Points (TSAPs), TCP protocol allows multiple connections to a
single IP address (up to 64K connections). With RFC 1006, TSAPs uniquely identify these
communication end point connections to an IP address.
Note
If you store the data in an "optimized" DB (symbolic only), you can receive data only in arrays of
Byte, Char, USInt, and SInt data types.
To configure the TRCV_C or TRCV instruction for ad hoc mode, set the ADHOC instruction input
parameter.
If you do not call the TRCV_C or TRCV instruction in ad hoc mode frequently, you could receive
more than one packet in one call. For example: If you were to receive five 100-byte packets with
one call, TCP would deliver these five packets as one 500-byte packet, while ISO-on-TCP would
restructure the packets into five 100-byte packets.
The following example shows the communication between two CPUs that utilize two separate
connections for sending and receiving the data.
• The TSEND_C instruction in CPU_1 links to the TRCV_C in CPU_2 over the first connection
("connection ID 1" on both CPU_1 and CPU_2).
• The TRCV_C instruction in CPU_1 links to the TSEND_C in CPU_2 over the second connection
("connection ID 2" on both CPU_1 and CPU_2).
The following example shows the communication between two CPUs that utilize 1 connection
for both sending and receiving the data.
• Each CPU uses a TCON instruction to configure the connection between the two CPUs.
• The TSEND instruction in CPU_1 links to the TRCV instruction in CPU_2 by using the
connection ID ("connection ID 1") that was configured by the TCON instruction in CPU_1. The
TRCV instruction in CPU_2 links to the TSEND instruction in CPU_1 by using the connection
ID ("connection ID 1") that was configured by the TCON instruction in CPU_2.
• The TSEND instruction in CPU_2 links to the TRCV instruction in CPU_1 by using the
connection ID ("connection ID 1") that was configured by the TCON instruction in CPU_2. The
TRCV instruction in CPU_1 links to the TSEND instruction in CPU_2 by using the connection
ID ("connection ID 1") that was configured by the TCON instruction in CPU_1.
75&9 76(1'
As shown in the following example, you can also use individual TSEND and TRCV instruction to
communication over a connection created by a TSEND_C or TRCV_C instruction. The TSEND and
TRCV instructions do not themselves create a new connection, so you must use the DB and
connection ID that was created by a TSEND_C, TRCV_C or TCON instruction.
76(1' 75&9
TCON_Param
TCON_IP_V4
Table 11-12 Structure of the connection description (TCON_IP_V4): For use with TCP
TCON_IP_V4_SEC
Table 11-13 Structure of the connection description (TCON_IP_V4_SEC): For use with TCP
The CONNECT connection parameter of the instance DBs for the TCON, TSEND_C, and TRCV_C
instructions contains a reference to the data block used.
Note
You can make non-secure TCP or UDP connections over IPv4.
You can also use SDT TCON_IP_V4_SEC for a non-secure TCP or UDP connection over IPv4.
TCON_IP_RFC
Table 11-14 Structure of the connection description (TCON_IP_RFC): For use with ISO on TCP
TCON_QDN
TCON_QDN_SEC
To use the highest version of TLS, configure the CPU version in STEP 7 to be the actual firmware
version of your CPU. The open user communication partner can then use the highest supported
TLS version for maximum security.
Table 11-17 TLS version support based on CPU and STEP 7 project firmware version
When you draw a line between devices, a connection is configured to compile and download to
the device. This connection configuration allows the S7-1200 firmware to establish a connection
with the partner when the CPU goes to RUN. There is no need to run a TCON instruction
instruction with a configured connection. Also, there is no need for a T_DISCON instruction for a
configured connection.
To draw a line for these connections, both network interfaces for the CPU (or CP) should be on
the same subnet. The TIA portal does not limit you from drawing a connection to devices on
different networks. However, the TIA Portal will generate an error when compiling or
downloading to the device.
You can now draw an OUC connection between the S7-1200 or S7-1500 CPUs, download the
configuation, and automatically establish the connection between the CPUs (if the connection
was physically possible).
When you draw an OUC connection in the TIA Portal, a "Local ID" and "Partner ID" is assigned in
the valid range for an OUC connection ID. You can change the value assigned in the connections
table or in the Local ID. The value entered in each ID must be within the range defined by the
TBlock instructions (See TSEND).
Note
Assigned range for the connection ID
The assigned range for the connection ID is in the same range as allocated for an S7 connection.
If an S7 Connection ID is supplied to a TSEND, it would result in an error from the instruction. The
error will be 16#80A1 as there will be no OUC connection established.
In the "Special connection properties" menu, the "active connection establishment" field defines
the device which sends connection messages out upon downloading of the configuration to the
CPUs. If the "active connection establishment" checkbox is not checked, the downloaded device
waits for connection messages from its partner. TIA portal automatically updates the partner
when the "Active connection establishment" checkbox is clicked. Only one side of the
connection can be set as active.
Note
UDP connections
For UDP connections, the "active connection establishment" is not present.
The "address details" property menu shows configuration of the addresses that will be used for
the communication of the connection for TCP and Iso-on-TCP types. When using TUSEND and
TURCV on a UDP connection, the address for communication is overridden by a parameter on the
instructions. Additionally, for Iso-on-TCP connection types, the TSAPs can be modified in the
"address details" property menu as shown in the 2nd screen below.
As of version V4.1 or later of the S7-1200 CPU, together with STEP 7 V13 SP1 or later, the CPU
extends the capability of the TSEND_C and TRCV_C instructions to use connection parameters
with structures according to TCON_IP_V4 and TCON_IP_RFC.
As of version V4.3 or later of the S7-1200 CPU, together with STEP 7 V15.1 or later, the CPU
extends the capability of the TSEND_C and TRCV_C instructions to use connection parameters
with structures according to TCON_IP_V4, TCON_IP_V4_SEC, and TCON_IP_RFC.
As of version V4.4 or later of the S7-1200 CPU, together with STEP 7 V16 or later, the CPU extends
the capability of the TSEND_C and TRCV_C instructions to use connection parameters with
structures according to TCON_IP_V4, TCON_IP_V4_SEC, TCON_IP_RFC, TCON_QDN, and
TCON_QDN_SEC.
For this reason, the S7-1200 supports two sets of TSEND_C and TRCV_C instructions:
• Legacy TSEND_C and TRCV_C instructions (Page 610): These TSEND_C and TRCV_C
instructions existed prior to version V4.1 of the S7-1200 and only work with connection
parameters with structures according to TCON_Param.
• TSEND_C and TRCV_C instructions (Page 599): These TSEND_C and TRCV_C instructions
provide all of the functionality of the legacy instructions, plus the ability to use connection
parameters with structures according to TCON_IP_V4, TCON_IP_V4_SEC, TCON_IP_RFC,
TCON_QDN, and TCON_QDN_SEC.
Click the icon on the instruction tree task card to enable the headers and columns of
the instruction tree.
When you use the instruction tree to place a TSEND_C or TRCV_C instruction in your program,
a new FB or FC instance, depending on the TSEND_C or TRCV_C instruction selected, is created
in the project tree. You can see new FB or FC instance in the project tree under PLC_x > Program
blocks > System blocks > Program resources.
To verify the version of a TSEND_C or TRCV_C instruction in a program, you must inspect project
tree properties and not the properties of a box displayed in the program editor. Select a project
tree TSEND_C or TRCV_C FB or FC instance, right-click, select "Properties", and select the
"Information" page to see the TSEND_C or TRCV_C instruction version number.
Note
Initializing the communication parameters
After you insert the TSEND_C or TRCV_C instruction, use the "Properties" of the instruction
(Page 565) to configure the communication parameters (Page 586). As you enter the
parameters for the communication partners in the inspector window, STEP 7 enters the
corresponding data in the DB for the instruction.
If you want to use a multi-instance DB, you must manually configure the DB on both CPUs.
Table 11-19 TSEND_C and TRCV_C data types for the parameters
Note
The TSEND_C instruction requires a low-to-high transition at the REQ input parameter to start a
send job. The BUSY parameter is then set to 1 during processing. Completion of the send job is
indicated by either the DONE or ERROR parameters being set to 1 for one scan. During this time,
any low-to-high transition at the REQ input parameter is ignored.
Note
The default setting of the LEN parameter (LEN = 0) uses the DATA parameter to determine the
length of the data being transmitted. It is recommended that the data transmitted by the
TSEND_C instruction be the same size as the DATA parameter of the TRCV_C instruction.
If using the default setting of the LEN parameter and it is necessary to send the data in segments
smaller than the DATA parameter size, the following applies. If the size of the data transmitted
from TSEND_C does not equal the TRCV_C DATA parameter size, TRCV_C remains in a busy status
(status code: 7006) until the overall size of the data transmitted from TSEND_C equals the
TRCV_C DATA parameter size.
The TRCV_C DATA parameter buffer does not display the new data received until the data size
equals the DATA parameter buffer size.
TSEND_C operations
The TSEND_C instruction is executed asynchronously and implements the following functions in
sequence:
1. Setting up and establishing a communications connection:
TSEND_C sets up a communication connection and establishes this connection if a rising
edge is detected at the REQ parameter and no communication connection is in place yet.
Once the connection has been set up and established, it is automatically maintained and
monitored by the CPU. The connection description specified at the CONNECT parameter is
used to set up the communications connection. The following connection types can be used:
– TCON_Param structure for the TCP, ISO-on-TCP, and UDP protocols
– WIth V4.1 or later, TCP/UDP: Connection description using the structure TCON_IP_V4 at
the parameter CONNECT
– WIth V4.1 or later, ISO-on-TCP: Connection description using the structure TCON_IP_RFC
at the parameter CONNECT
– WIth V4.3 or later, TCP: Connection description using the structure TCON_IP_V4_SEC at
the parameter CONNECT
– With V4.4 or later, TCP: Connection description using the structures TCON_QDN and
TCON_QDN_SEC at the parameter CONNECT
An existing connection is terminated and the connection which has been set up is removed
when the CPU goes into STOP mode. To set up and establish the connection again, you must
execute TSEND_C again. For information on the number of possible communication
connections, please refer to the technical specifications for your CPU.
2. Sending data via an existing communications connection:
The send job is executed when a rising edge is detected at the REQ parameter. As described
above, the communications connection is established first. You specify the send area with
the DATA parameter. This includes the address and the length of the data to be sent. Do not
use a data area with the data type BOOL or Array of BOOL at the DATA parameter. With the
LEN parameter, you specify the maximum number of bytes sent with a send job. If using a
symbolic name at the DATA parameter, the LEN parameter should have the value "0".
The data to be sent must not be edited until the send job is completed.
3. Terminating the communications connection:
The communications connection is terminated after the data has been sent if the CONT
parameter had the value "0" at the time of the rising edge at the REQ parameter. Otherwise,
the communications connection will be maintained.
If the send job executes successfully, the DONE parameter is set to "1". The communications
connection may be terminated before this (see the above description of the dependency on the
CONT parameter). Signal state "1" at the DONE parameter is not confirmation that the data sent
has already been read by the communications partner.
TSEND_C is reset when the COM_RST parameter is set to "1". Data loss may occur if data is being
transferred at this point.
TRCV_C operations
The TRCV_C instruction is executed asynchronously and implements the following functions in
sequence:
1. Setting up and establishing a communications connection:
TRCV_C sets up a communication connection and establishes this connection if the EN_R
parameter = "1" and there is no communication connection. Once the connection has been
set up and established, it is automatically maintained and monitored by the CPU.
The connection description specified at the CONNECT parameter is used to set up the
communications connection. The following connection types can be used:
– TCON_Param structure for the TCP, ISO-on-TCP, and UDP protocols
– With V4.1 and later, TCP / UDP: Connection description via the structure TCON_IP_V4 at
the parameter CONNECT
– With V4.1 and later, ISO-on-TCP: Connection description via the structure TCON_IP_RFC at
the parameter CONNECT
– WIth V4.3 and later, TCP: Connection description using the structure TCON_IP_V4_SEC at
the parameter CONNECT
– With V4.4 or later, TCP: Connection description using the structures TCON_QDN and
TCON_QDN_SEC.
An existing connection is terminated and the connection which has been set up is removed
when the CPU goes into STOP mode. To set up and establish the connection again, you must
execute TRCV_C again with EN_R = "1".
If EN_R is set to "0" before the communications connection has been established, the
connection will be established and remain in place even if CONT = "0". However, no data will
be received (DONE will remain "0").
For information on the number of possible communication connections, please refer to the
technical specifications for your CPU.
2. Receiving data via an existing communications connection:
Receipt of data is enabled when the EN_R parameter is set to the value "1". As described
above, the communications connection is established first. The received data is entered in a
receive area. You specify the length of the receive area either with the LEN parameter (if LEN
<> 0) or with the length information of the DATA parameter (if LEN = 0), depending on the
protocol variant being used. If you use purely symbolic values at the DATA parameter, the LEN
parameter must have the value "0".
If EN_R is set to "0" before data is received for the first time, the communication connection
will remain in place even if CONT = 0. However, no data will be received (DONE will remain
"0").
3. Terminating the communications connection:
The communications connection is terminated after data has been received if the CONT
parameter had the value "0" when connection established was started. Otherwise, the
communications connection will be maintained.
If the receive job executes successfully, the DONE parameter is set to "1". The communications
connection may be terminated before this (see the above description of the dependency on the
CONT parameter).
TRCV_C is reset when the COM_RST parameter is set. If data is being received when it executes
again, this can lead to a loss of data. The following scenarios are possible depending on the CONT
parameter:
• CONT = "0":
An existing communications connection is established.
• CONT = "1" and a communications connection was established:
An existing communications connection is reset and established again.
• CONT = "1" and no communications connection was established:
No communications connection is established.
The COM_RST parameter is reset following evaluation by the instruction TRCV_".
TRCV_C handles the same receive modes as the TRCV instruction. The following table shows how
data is entered in the receive area:
Protocol variant Availability of data in the re‐ Connection_type parameter of LEN RCVD_LEN
ceive area the connection description parameter parameter
TCP The data is immediately available. B#16#11 Selected with 1 to 1472
(Ad hoc mode) the TRCV_C in‐
struction AD‐
HOC input
TCP (data receipt The data is available as soon as B#16#11 1 to 8192 Identical to the
with specified the data length specified at the value at the
length) LEN parameter has been fully re‐ LEN parameter
ceived.
ISO on TCP (proto‐ The data is available as soon as B#16#12 1 to 8192 Identical to the
col-controlled data the data length specified at the value at the
transfer) LEN parameter has been fully re‐ LEN parameter
ceived.
Note
Ad hoc mode
The "ad hoc mode" is only available with the TCP protocol variant. To configure the TRCV_C
instruction for ad hoc mode, set the ADHOC instruction input parameter. The length of the
receive area is defined by the pointer at the DATA parameter. The data length actually received
is output at the RCVD_LEN parameter. A maximum of 1460 bytes can be received.
Note
Importing of S7-300/400 STEP 7 projects containing "ad hoc mode" into the S7-1200
In S7-300/400 STEP 7 projects, "ad hoc mode" is selected by assigning "0" to the LEN parameter.
In the S7-1200, you configure the TRCV_C instruction for ad hoc mode by setting the ADHOC
instruction input parameter..
If you import an S7-300/400 STEP 7 project containing "ad hoc mode" into the S7-1200, you
must change the LEN parameter to "65535".
Note
TCP (data receipt with specified length)
You use the value of the LEN parameter to specify the length for the data receipt. The data
specified at the DATA parameter is available in the receive area as soon as the length specified at
the LEN parameter has been completely received.
Note
ISO on TCP (protocol-controlled data transfer)
With the ISO on TCP protocol variant, data is transferred protocol-controlled. The receive area is
defined by the LEN and DATA parameters.
Note
Due to the asynchronous processing of TSEND_C, you must keep the data in the sender area
consistent until the DONE parameter or the ERROR parameter assumes the value TRUE.
For TSEND_C, a TRUE state at the parameter DONE means that the data was sent successfully.
It does not mean that the connection partner CPU actually read the receive buffer.
Due to the asynchronous processing of TRCV_C, the data in the receiver area are only consistent
when parameter DONE = 1.
Table 11-20 TSEND_C and TRCV_C instructions BUSY, DONE, and ERROR parameters
You can check the status of the execution with the BUSY, DONE, ERROR, and STATUS parameters.
The BUSY parameter indicates the processing status. With the DONE parameter, you can check
whether or not a send job executed successfully. The ERROR parameter is set when errors
occurred during execution of TSEND_C or TRCV_C. The error information is output at the STATUS
parameter.
Table 11-21 TSEND_C and TRCV_C condition codes for ERROR and STATUS
Note
Error messages of the instructions TCON, TSEND, TRCV, and TDISCON
Internally, the TSEND_C instruction uses the TCON, TSEND, and TDISCON instructions; and the
TRCV_C instruction uses the TCON, TRCV, and TDISCON instructions. Refer to "TCON, TDISCON,
TSEND, AND TRCV (Page 619)" for more information on error messages of these instructions.
See also
Connection IDs for the Open user communication instructions (Page 584)
Prior to the release of STEP 7 V13 SP1 and the S7-1200 V4.1 CPUs, the TSEND_C and TRCV_C
instructions could only work with connection parameters with structures according to
"TCON_Param". The general concepts apply to both sets of instructions. Refer to the individual
legacy TSEND_C and TRCV_C instructions for programming information.
Click the icon on the instruction tree task card to enable the headers and columns of
the instruction tree.
When you use the instruction tree to place a TSEND_C or TRCV_C instruction in your program,
a new FB or FC instance, depending on the TSEND_C or TRCV_C instruction selected, is created
in the project tree. You can see new FB or FC instance in the project tree under PLC_x > Program
blocks > System blocks > Program resources.
To verify the version of a TSEND_C or TRCV_C instruction in a program, you must inspect project
tree properties and not the properties of a box displayed in the program editor. Select a project
tree TSEND_C or TRCV_C FB or FC instance, right-click, select "Properties", and select the
"Information" page to see the TSEND_C or TRCV_C instruction version number.
Legacy TSEND_C and TRCV_C (Send and receive data using Ethernet)
The legacy TSEND_C instruction combines the functions of the legacy TCON, TDISCON and
TSEND instructions. The TRCV_C instruction combines the functions of the TCON, TDISCON, and
TRCV instructions. (Refer to "Legacy TCON, TDISCON, TSEND, and TRCV (TCP communication)
instructions (Page 635)" for more information on these instructions.)
The minimum size of data that you can transmit (TSEND_C) or receive (TRCV_C) is one byte; the
maximum size is 8192 bytes. TSEND_C does not support the transmission of data from Boolean
locations, and TRCV_C will not receive data into Boolean locations. For information on
transferring data with these instructions, see the section on data consistency (Page 177).
Note
Initializing the communication parameters
After you insert the TSEND_C or TRCV_C instruction, use the "Properties" of the instruction
(Page 565) to configure the communication parameters (Page 586). As you enter the
parameters for the communication partners in the inspector window, STEP 7 enters the
corresponding data in the DB for the instruction.
If you want to use a multi-instance DB, you must manually configure the DB on both CPUs.
Table 11-23 TSEND_C and TRCV_C data types for the parameters
Note
The TSEND_C instruction requires a low-to-high transition at the REQ input parameter to start a
send job. The BUSY parameter is then set to 1 during processing. Completion of the send job is
indicated by either the DONE or ERROR parameters being set to 1 for one scan. During this time,
any low-to-high transition at the REQ input parameter is ignored.
Note
The default setting of the LEN parameter (LEN = 0) uses the DATA parameter to determine the
length of the data being transmitted. It is recommended that the data transmitted by the
TSEND_C instruction be the same size as the DATA parameter of the TRCV_C instruction.
If using the default setting of the LEN parameter and it is necessary to send the data in segments
smaller than the DATA parameter size, the following applies. If the size of the data transmitted
from TSEND_C does not equal the TRCV_C DATA parameter size, TRCV_C remains in a busy status
(status code: 7006) until the overall size of the data transmitted from TSEND_C equals the
TRCV_C DATA parameter size.
The TRCV_C DATA parameter buffer does not display the new data received until the data size
equals the DATA parameter buffer size.
TSEND_C operations
The following functions describe the operation of the TSEND_C instruction:
• To establish a connection, execute TSEND_C with CONT = 1.
• After successful establishing of the connection, TSEND_C sets the DONE parameter for one
cycle.
• To terminate the communication connection, execute TSEND_C with CONT = 0. The
connection will be aborted immediately. This also affects the receiving station. The
connection will be closed there and data inside the receive buffer could be lost.
• To send data over an established connection, execute TSEND_C with a rising edge on REQ.
After a successful send operation, TSEND_C sets the DONE parameter for one cycle.
• To establish a connection and send data, execute TSEND_C with CONT =1 and REQ = 1. After
a successful send operation, TSEND_C sets the DONE parameter for one cycle.
TRCV_C operations
The following functions describe the operation of the TRCV_C instruction:
• To establish a connection, execute TRCV_C with parameter CONT = 1.
• To receive data, execute TRCV_C with parameter EN_R = 1. TRCV_C receives the data
continuously when parameters EN_R = 1 and CONT = 1.
• To terminate the connection, execute TRCV_C with parameter CONT = 0. The connection will
be aborted immediately, and data could be lost.
TRCV_C handles the same receive modes as the TRCV instruction. The following table shows how
data is entered in the receive area:
Protocol var‐ Entering the data Parameter Value of the LEN parameter Value of the RCVD_LEN pa‐
iant in the receive area "connec‐ rameter (bytes)
tion_type"
TCP Ad hoc mode B#16#11 65535 1 to 1472
TCP Data reception with B#16#11 0 (recommended) or 1 to 1 to 8192
specified length 8192, except 65535
ISO on TCP Ad hoc mode B#16#12 65535 1 to 1472
ISO on TCP Protocol-controlled B#16#12 0 (recommended) or 1 to 1 to 8192
8192, except 65535
Note
Ad hoc mode
The "ad hoc mode" exists with the TCP and ISO on TCP protocol variants. You set "ad hoc mode"
by assigning "65535" to the LEN parameter. The receive area is identical to the area formed by
DATA. The length of the received data will be output to the parameter RCVD_LEN.
If you store the data in an "optimized" DB (symbolic only), you can receive data only in arrays of
Byte, Char, USInt, and SInt data types.
Note
Importing of S7-300/400 STEP 7 projects containing "ad hoc mode" into the S7-1200
In S7-300/400 STEP 7 projects, "ad hoc mode" is selected by assigning "0" to the LEN parameter.
In the S7-1200, you set "ad hoc mode" by assigning "65535" to the LEN parameter.
If you import an S7-300/400 STEP 7 project containing "ad hoc mode" into the S7-1200, you
must change the LEN parameter to "65535".
Note
Must keep the data in the sender area consistent until the DONE parameter or the ERROR
parameter assumes the value TRUE
Due to the asynchronous processing of TSEND_C, you must keep the data in the sender area
consistent until the DONE parameter or the ERROR parameter assumes the value TRUE.
For TSEND_C, a TRUE state at the parameter DONE means that the data was sent successfully.
It does not mean that the connection partner CPU actually read the receive buffer.
Due to the asynchronous processing of TRCV_C, the data in the receiver area are only consistent
when parameter DONE = 1.
Table 11-25 TSEND_C and TRCV_C instructions BUSY, DONE, and ERROR parameters
Table 11-26 TSEND_C and TRCV_C condition codes for ERROR and STATUS
As of version V4.1 or later of the S7-1200 CPU, together with STEP 7 V13 SP1 or later, the
S7-1200 CPU extends the capability of the TCON instruction to use connection parameters with
structures according to TCON_IP_V4 and TCON_IP_RFC. The S7-1200 CPU also extends the
capability of the TSEND and TRCV instructions to use connection parameters with structures
according to TCON_IP_V4 and TCON_IP_RFC.
As of version V4.3 or later of the S7-1200 CPU, together with STEP 7 V15.1 or later, the S7-1200
CPU extends the capability of the TCON instructions to use connection parameters with
structures according to TCON_IP_V4, TCON_IP_V4_SEC, and TCON_IP_RFC.
As of version V4.4 or later of the S7-1200 CPU, together with STEP 7 V16 or later, the CPU extends
the capability of the TCON instructions to use connection parameters with structures according
to TCON_IP_V4, TCON_IP_V4_SEC, TCON_IP_RFC, TCON_QDN, and TCON_QDN_SEC.
For this reason, the S7-1200 supports two sets of TCON, TDISCON, TSEND, and TRCV
instructions:
• Legacy TCON, TDISCON, TSEND, and TRCV instructions (Page 635): These TCON, TDISCON,
TSEND, and TRCV instructions existed prior to version V4.1 of the S7-1200 and only work with
connection parameters with structures according to TCON_Param.
• TCON, TDISCON, TSEND, and TRCV instructions (Page 619): These TCON, TDISCON, TSEND,
and TRCV instructions provide all of the functionality of the legacy instructions, plus the
ability to use connection parameters with structures according to TCON_IP_V4,
TCON_IP_V4_SEC, TCON_IP_RFC, TCON_QDN, and TCON_QDN_SEC.
Selecting the version of the TCON, TDISCON, TSEND, and TRCV instructions
There are two versions of the TCON, TDISCON, TSEND, or TRCV instructions available in
STEP 7:
• Versions 2.5 and 3.1 were available in STEP 7 Basic/Professional V13 or earlier.
• Version 4.0 is available in STEP 7 Basic/Professional V13 SP1 or later.
For compatibility and ease of migration, you can choose which instruction version to insert into
your user program.
Do not use different instruction versions in the same CPU program.
Click the icon on the instruction tree task card to enable the headers and columns of
the instruction tree.
When you use the instruction tree to place a TCON, TDISCON, TSEND, or TRCV instruction in your
program, a new FB or FC instance, depending on the TCON, TDISCON, TSEND, or TRCV
instruction selected, is created in the project tree. You can see new FB or FC instance in the
project tree under PLC_x > Program blocks > System blocks > Program resources.
To verify the version of a TCON, TDISCON, TSEND, or TRCV instruction in a program, you must
inspect project tree properties and not the properties of a box displayed in the program editor.
Select a project tree TCON, TDISCON, TSEND, or TRCV FB or FC instance, right-click, select
"Properties", and select the "Information" page to see the TCON, TDISCON, TSEND, or TRCV
instruction version number.
Note
TSEND_C and TRCV_C instructions
To help simplify the programming of PROFINET/Ethernet communication, the TSEND_C
instruction and the TRCV_C instruction combine the functionality of the TCON, TDISCON. TSEND
and TRCV instructions:
• TSEND_C combines the TCON, TDISCON and TSEND instructions.
• TRCV_C combines the TCON, TDISCON and TRCV instructions.
Table 11-27 Interactions between the BUSY, DONE, and ERROR parameters
Note
Initializing the communication parameters
After you insert the TCON instruction, use the "Properties" of the instruction (Page 565) to
configure the communication parameters (Page 586). As you enter the parameters for the
communication partners in the inspector window, STEP 7 enters the corresponding data in the
instance DB for the instruction.
If you want to use a multi-instance DB, you must manually configure the DB on both CPUs.
1
STEP 7 automatically creates the DB when you insert the instruction.
Table 11-29 Data types for the parameters of TCON and TDISCON
Both communication partners execute the TCON instruction to set up and establish the
communication connection. You use parameters to specify the active and passive
communication end point partners. After the connection is set up and established, it is
automatically maintained and monitored by the CPU.
If the connection is terminated due to a line break or due to the remote communications partner,
for example, the active partner attempts to re-establish the configured connection. You do not
have to execute TCON again.
An existing connection is terminated and the set-up connection is removed when the TDISCON
instruction is executed or when the CPU has gone into STOP mode. To set up and re-establish the
connection, you must execute TCON again.
Table 11-30 ERROR and STATUS condition codes for TCON and TDISCON
Note
When using PROFINET Open User communication, if you execute a TSEND instruction without
a corresponding TRCV instruction executing on the remote device, then the TSEND instruction
may reside indefinitely in a "Busy State", waiting for the TRCV instruction to receive the data. In
this state, the TSEND instruction "Busy" output is set, and the "Status" output has a value of
"0x7002". This condition may occur if you are transferring more than 4096 bytes of data. The
issue is resolved at the next execution of the TRCV instruction.
Table 11-32 Data types for the parameters of TSEND and TRCV
Note
The TSEND instruction requires a low-to-high transition at the REQ input parameter to start a
send job. The BUSY parameter is then set to 1 during processing. Completion of the send job is
indicated by either the DONE or ERROR parameters being set to 1 for one scan. During this time,
any low-to-high transition at the REQ input parameter is ignored.
TRCV Operations
The TRCV instruction writes the received data to a receive area that is specified by the following
two variables:
• Pointer to the start of the area
• Length of the area or the value supplied at the LEN input if not 0
Note
The default setting of the LEN parameter (LEN = 0) uses the DATA parameter to determine the
length of the data being transmitted. It is recommended that the data transmitted by the
TSEND instruction be the same size as the DATA parameter of the TRCV instruction.
If using the default setting of the LEN parameter and it is necessary to send the data in
segments smaller than the DATA parameter size, the following applies. It is recommended to
keep the EN_R bit high until the corresponding TSEND transfers the appropriate amount of
data to fill the TRCV DATA parameter. If the size of the data transmitted from TSEND does not
equal the TRCV DATA parameter size, TRCV remains in a busy status (status code: 7002) while
the EN_R bit is high until the overall size of the data transmitted from TSEND equals the TRCV
DATA parameter size. If the EN_R bit of TRCV is pulsed, it needs to be pulsed the same number
of times as TSEND is executed to receive the data.
The TRCV DATA parameter buffer does not display the new data received until the data size
equals the DATA parameter buffer size.
As soon as all the job data has been received, TRCV transfers it to the receive area and sets NDR
to 1.
Protocol var‐ Entering the data Parameter Value of the LEN parameter Value of the RCVD_LEN pa‐
iant in the receive area "connec‐ rameter (bytes)
tion_type"
TCP Ad hoc mode B#16#11 Selected with the TRCV instruc‐ 1 to 1472
tion ADHOC input
TCP Data reception with B#16#11 0 (recommended) or 1 to 1 to 8192
specified length 8192, except 65535
ISO on TCP Ad hoc mode B#16#12 65535 1 to 1472
ISO on TCP protocol-controlled B#16#12 0 (recommended) or 1 to 1 to 8192
8192, except 65535
Note
Ad hoc mode
The "ad hoc mode" exists with the TCP and ISO on TCP protocol variants. To configure the TRCV
instruction for ad hoc mode, set the ADHOC instruction input parameter. The receive area is
identical to the area formed by DATA. The length of the received data will be output to the
parameter RCVD_LEN. Immediately after receiving a block of data, TRCV enters the data in the
receive area and sets NDR to 1.
If you store the data in an "optimized" DB (symbolic only), you can receive data only in arrays of
Byte, Char, USInt, and SInt data types.
Note
Importing of S7-300/400 STEP 7 projects containing "ad hoc mode" into the S7-1200
In S7-300/400 STEP 7 projects, "ad hoc mode" is selected by assigning "0" to the LEN parameter.
In the S7-1200, you configure the TRCV instruction for ad hoc mode by setting the ADHOC
instruction input parameter.
If you import an S7-300/400 STEP 7 project containing "ad hoc mode" into the S7-1200, you
must change the LEN parameter to "65535".
Table 11-34 ERROR and STATUS condition codes for TSEND and TRCV
11.5.8.12 TCONSettings
As of V4.5 and TIA Portal V17, you can use the "TCONSettings" instruction to execute the
following functions:
• Request a connection ID for a new OUC connection
• Request a connection ID for a new OUC connection and at the same time specify a property
for this connection
• Read a property of a prepared or an existing OUC connection
• Specify a property for a prepared or an existing OUC connection
You can read or specify the following connection properties with the "TCONSettings" instruction:
• How a TCP connection is terminated
See also
New features (Page 35)
connection resource for the ID and creates the corresponding diagnostic objects. The
TCONSettings instruction has prepared the connection but external communication partners do
not yet know about the connection.
You have not specified any details for the connection, neither the connection partner nor the
protocol nor the interface nor the DB with the connection description.
Note
Establishing the connection
TCONSettings does not establish a connection.
After the DONE parameter has assumed the value TRUE, the connection has been assigned the
desired property.
Relation between the protocol or the interface and the actual readable or specifiable connection
properties
Not every protocol or interface can read or specify all of the above connection properties. The
following table shows which connection properties are possible for the individual protocols or
interfaces.
• With a TCP-Finish
If you have set TCP-Finish as the way of terminating a connection and then call the instruction
"TDISCON", the connection is closed from the user's point of view after the termination of
"TDISCON" with DONE=TRUE, i.e. the connection ID is available again. In the lower layers in
the TCP/IP stack of the module, however, the resources are still assigned for some time, as are
the diagnostic objects belonging to the connection.
If you remove many connections using TCP-Finish and reserve (with "TCONSettings") or
establish (with "TCON") connections before the timer for enabling the resources expires, this
can result in a resource bottleneck.
Note
Terminating a TCP connection during transition to STOP
During the transition to STOP, a TCP connection is always terminated with a TCP-Reset.
Prior to the release of STEP 7 V13 SP1 and the S7-1200 V4.1 CPUs, the TCON, TDISCON, TSEND,
and TRCV instructions could only work with connection parameters with structures according to
"TCON_Param". The general concepts apply to both sets of instructions. Refer to the individual
legacy TCON, TDISCON, TSEND, and TRCV instructions for programming information.
Selecting the version of the TCON, TDISCON, TSEND, and TRCV instructions
There are two versions of the TCON, TDISCON, TSEND, or TRCV instructions available in
STEP 7:
• Versions 2.5 and 3.1 were available in STEP 7 Basic/Professional V13 or earlier.
• Version 4.0 is available in STEP 7 Basic/Professional V13 SP1 or later.
For compatibility and ease of migration, you can choose which instruction version to insert into
your user program.
Do not use different instruction versions in the same CPU program.
Click the icon on the instruction tree task card to enable the headers and columns of
the instruction tree.
When you use the instruction tree to place a TCON, TDISCON, TSEND, or TRCV instruction in your
program, a new FB or FC instance, depending on the TCON, TDISCON, TSEND, or TRCV
instruction selected, is created in the project tree. You can see new FB or FC instance in the
project tree under PLC_x > Program blocks > System blocks > Program resources.
To verify the version of a TCON, TDISCON, TSEND, or TRCV instruction in a program, you must
inspect project tree properties and not the properties of a box displayed in the program editor.
Select a project tree TCON, TDISCON, TSEND, or TRCV FB or FC instance, right-click, select
"Properties", and select the "Information" page to see the TCON, TDISCON, TSEND, or TRCV
instruction version number.
Note
TSEND_C and TRCV_C instructions
To help simplify the programming of PROFINET/Ethernet communication, the TSEND_C
instruction and the TRCV_C instruction combine the functionality of the TCON, TDISCON. TSEND
and TRCV instructions:
• TSEND_C combines the TCON, TDISCON and TSEND instructions.
• TRCV_C combines the TCON, TDISCON and TRCV instructions.
Table 11-37 Interactions between the BUSY, DONE, and ERROR parameters
Note
Initializing the communication parameters
After you insert the TCON instruction, use the "Properties" of the instruction (Page 565) to
configure the communication parameters (Page 586). As you enter the parameters for the
communication partners in the inspector window, STEP 7 enters the corresponding data in the
instance DB for the instruction.
If you want to use a multi-instance DB, you must manually configure the DB on both CPUs.
1
STEP 7 automatically creates the DB when you insert the instruction.
Table 11-39 Data types for the parameters of TCON and TDISCON
Both communication partners execute the TCON instruction to set up and establish the
communication connection. You use parameters to specify the active and passive
communication end point partners. After the connection is set up and established, it is
automatically maintained and monitored by the CPU.
If the connection is terminated due to a line break or due to the remote communications partner,
for example, the active partner attempts to re-establish the configured connection. You do not
have to execute TCON again.
An existing connection is terminated and the set-up connection is removed when the TDISCON
instruction is executed or when the CPU has gone into STOP mode. To set up and re-establish the
connection, you must execute TCON again.
Table 11-40 ERROR and STATUS condition codes for TCON and TDISCON
Note
When using PROFINET Open User communication, if you execute a TSEND instruction without
a corresponding TRCV instruction executing on the remote device, then the TSEND instruction
may reside indefinitely in a "Busy State", waiting for the TRCV instruction to receive the data. In
this state, the TSEND instruction "Busy" output is set, and the "Status" output has a value of
"0x7002". This condition may occur if you are transferring more than 4096 bytes of data. The
issue is resolved at the next execution of the TRCV instruction.
Table 11-42 Data types for the parameters of TSEND and TRCV
Note
The TSEND instruction requires a low-to-high transition at the REQ input parameter to start a
send job. The BUSY parameter is then set to 1 during processing. Completion of the send job is
indicated by either the DONE or ERROR parameters being set to 1 for one scan. During this time,
any low-to-high transition at the REQ input parameter is ignored.
TRCV Operations
The TRCV instruction writes the received data to a receive area that is specified by the following
two variables:
• Pointer to the start of the area
• Length of the area or the value supplied at the LEN input if not 0
Note
The default setting of the LEN parameter (LEN = 0) uses the DATA parameter to determine the
length of the data being transmitted. It is recommended that the data transmitted by the
TSEND instruction be the same size as the DATA parameter of the TRCV instruction.
If using the default setting of the LEN parameter and it is necessary to send the data in
segments smaller than the DATA parameter size, the following applies. It is recommended to
keep the EN_R bit high until the corresponding TSEND transfers the appropriate amount of
data to fill the TRCV DATA parameter. If the size of the data transmitted from TSEND does not
equal the TRCV DATA parameter size, TRCV remains in a busy status (status code: 7002) while
the EN_R bit is high until the overall size of the data transmitted from TSEND equals the TRCV
DATA parameter size. If the EN_R bit of TRCV is pulsed, it needs to be pulsed the same number
of times as TSEND is executed to receive the data.
The TRCV DATA parameter buffer does not display the new data received until the data size
equals the DATA parameter buffer size.
As soon as all the job data has been received, TRCV transfers it to the receive area and sets NDR
to 1.
Protocol var‐ Entering the data Parameter Value of the LEN parameter Value of the RCVD_LEN pa‐
iant in the receive area "connec‐ rameter (bytes)
tion_type"
TCP Ad hoc mode B#16#11 65535 1 to 1472
TCP Data reception with B#16#11 0 (recommended) or 1 to 1 to 8192
specified length 8192, except 65535
ISO on TCP Ad hoc mode B#16#12 65535 1 to 1472
ISO on TCP protocol-controlled B#16#12 0 (recommended) or 1 to 1 to 8192
8192, except 65535
Note
Ad hoc mode
The "ad hoc mode" exists with the TCP and ISO on TCP protocol variants. You set "ad hoc mode"
by assigning "65535" to the LEN parameter. The receive area is identical to the area formed by
DATA. The length of the received data will be output to the parameter RCVD_LEN. Immediately
after receiving a block of data, TRCV enters the data in the receive area and sets NDR to 1.
If you store the data in an "optimized" DB (symbolic only), you can receive data only in arrays of
Byte, Char, USInt, and SInt data types.
Note
Importing of S7-300/400 STEP 7 projects containing "ad hoc mode" into the S7-1200
In S7-300/400 STEP 7 projects, "ad hoc mode" is selected by assigning "0" to the LEN parameter.
In the S7-1200, you set "ad hoc mode" by assigning "65535" to the LEN parameter.
If you import an S7-300/400 STEP 7 project containing "ad hoc mode" into the S7-1200, you
must change the LEN parameter to "65535".
The local end points of the connection are retained. They are generated automatically:
• If a connection has been configured and loaded to the CPU.
• If a connection has been generated by the user program, for example, by calling the
instruction "TCON (Page 619)".
The "T_RESET" instruction can be executed for all connection types regardless of whether the
local interface of the CPU or the interface of a CM/CP was used for the connection. An exception
to this is connections for data transfer in ad-hoc mode with TCP, as such connections cannot be
referenced with a connection ID.
Once the instruction "T_RESET" has been called using the REQ parameter, the connection
specified with the ID parameter is terminated and, if necessary, the data send and receive buffer
cleared. Canceling the connection also cancels any data transfer in progress. There is therefore
a risk of losing data if data transfer is in progress. The CPU defined as the active connection
partner will then automatically attempt to restore the interrupted communication connection.
You therefore do not need to call the "TCON (Page 619)" instruction to re-establish the
communication connection.
The output parameters DONE, BUSY, and STATUS indicate the status of the job.
STATUS parameter
11.5.8.15 T_DIAG (Checks the status of connection and reads information) instruction
The "T_DIAG" instruction checks the status of a connection and reads further information on the
local end point of this connection:
status=>_dword_out_);
STATUS parameter
The following table shows the meaning of the values at the STATUS parameter:
TDIAG_Status Structure
The table below details the form of the TDIAG_Status structure. The value of each element is only
valid if the instruction has been executed without errors. If an error occurs, the content of the
parameters will not change:
11.5.8.16 TMAIL_C (Send an email using the Ethernet interface of the CPU) instruction
Overview
You use the TMAIL_C instruction to send an email using the Ethernet interface of the S7-1200
CPU.
The TMAIL_C instruction has two functionalities:
• Email over the CPU Interface
• Email over a CP Interface
To use the TMAIL_C instruction, you must satisfy these prerequisites:
• You have configured the hardware
• The network infrastructure allows for a communication connection to the mail server
The connection is also canceled after the instruction has successfully executed and sent the
email.
NOTICE
Changing user programs
You can change the parts of your user program that directly affect calls of TMAIL_C only under
these conditions:
• The CPU is in "STOP" mode.
• No email is being sent (REQ = 0 and BUSY = 0).
This relates, in particular, to deleting and replacing program blocks that contain TMAIL_C calls
or calls for the instance of TMAIL_C.
Ignoring this restriction can tie up connection resources. The automation system can change
to an undefined status with the TCP/IP communication functions via Industrial Ethernet.
A warm or cold restart of the CPU is required after the changes are transferred.
Data consistency
The TO_S, CC, SUBJECT, TEXT, ATTACHMENT and MAIL_ADDR_PARAM parameters are applied by
the TMAIL_C instruction while it is running, which means that they may only be changed after
the job has been completed (BUSY = 0).
SMTP authentication
Authentication refers to a procedure for verifying identity, for example, with a password query.
If you are using the S7-1200 CPU interface, the instruction TMAIL_C supports the SMTP
authentication procedure AUTH-LOGIN which is required by most mail servers. For information
about the authentication procedure of your mail server, refer to your mail server manual or the
website of your Internet service provider.
• Before you can use the AUTH-LOGIN authentication procedure, the TMAIL_C instruction
requires the user name with which it is to log on to the mail server. This user name
corresponds to the user name with which you set up a mail account on your mail server. It is
transferred via the UserName parameter to the structure at parameter MAIL_ADDR_PARAM.
If no user name is specified at the MAIL_ADDR_PARAM parameter, the AUTH-LOGIN
authentication procedure is not used. The email is then sent without authentication.
• To log on, the TMAIL_C instruction also requires the associated password. This password
corresponds to the password you specified when you set up your mail account. It is
transferred via the PassWord parameter to the structure at parameter MAIL_ADDR_PARAM.
Note
Optional parameters
The instruction sends the optional parameters CC, TEXT, and ATTACHMENT only if the
corresponding parameters contain a string of length > 0.
MAIL_ADDR_PARAM parameter
At the MAIL_ADDR_PARAM parameter, you define the connection for sending the email and save
the e-mail server address and login details.
The system data type (SDT) you use at the MAIL_ADDR_PARAM parameter depends on the
format in which the email server is to be addressed:
If you are using the interface of the S7-1200 CPU with firmware version V4.3 or earlier, you must
use the TMail_V4 SDT. In this case, you can only send the email using SMTP. The emails are
unsecured.
TMail_V6_SEC: Addressing of the e-mail server via the IP address in IPv6 format
Sending data logs, recipes, and user files using email attachments
As of TMAIL_C version V6.0 or later and S7-1200 CPU firmware version V4.4 or later, you can add
and access the TMail_FileReference SDT using the Attachment parameter of the TMAIL_C
instruction. You can then address a file path on the SIMATIC memory card (SMC). If no memory
card is present, you can still access the recipe and data log directories on the PLC's internal load
storage.
The TMail_FileReference SDT automatically uses the FileName parameter for the
AttachmentName parameter.
TMail_FileReference SDT
The TMail_FileReference SDT consists of two parameters, both of which are SIMATIC strings:
• In the DirectoryPath parameter, you can address the directory of the desired file.
• The FileName parameter denotes the name of the file and the extension (if applicable) of the
file that you wish to access in the directory, which is specified by the previous parameter.
The TMAIL_C instruction restricts you to the DataLogs, Recipes, or UserFiles directories when
addressing the DirectoryPath parameter. You can also address subdirectories within these
directories.
Beyond the above base directory restriction, the File Addressing Rules section below prescribes
the rules that you must follow to address subdirectories and file names.
The size of the file that you can send is not restricted by the TMAIL_C instruction. You should keep
this in mind when constructing your program.
DirectoryPath
When entering the desired directory into the DirectoryPath parameter of the SDT, keep the
following in mind. The root directory is inferred by the PLC’s firmware logic and is not necessary
for you to know. You can optionally enter a leading and trailing slash (/). If the user omits either
slash, the firmware will automatically add these to the path. Thus, each of the following
DirectoryPath entries are valid:
• /DataLogs/
• /DataLogs
• DataLogs/
• DataLogs
It is also possible to access a path at a greater depth than the base directory by using the
following form, '/DataLogs/dir1/' where each (/) denotes a new directory. The maximum depth
is eight, including the root directory.
In addition to the rules set forth in the File Addressing Rules section, you must be aware that the
use of relative paths is strictly prohibited. Thus, '/DataLogs/' is an illegal path name. In addition,
the use of a period in any subdirectory component to represent the current directory is
prohibited (for example, '/DataLogs/').
FileName
When utilizing the FileName parameter of the SDT, keep in mind the rules laid out in the File
Addressing Rules section. In addition to this, you must also be aware that the PLC’s operating
system limits the file name to less than 60 characters. If you attempt to address a file name
greater than or equal to 60 characters, the TMAIL_C instruction aborts its operation and
produces an error.
Aside from these exceptions, you can attach any file regardless of size or extension. The
addressed file may or may not include a file extension.
STATUS parameter
The following table shows the return values of TMAIL_C at the STATUS parameter:
* These error codes are added to the TMAIL_C instruction to assist in diagnosing improper file path
addressing.
11.5.8.17 UDP
UDP is a standard protocol described by RFC 768: User Datagram Protocol. UDP provides a
mechanism for one application to send a datagram to another; however, delivery of data is not
guaranteed. This protocol has the following features:
• A quick communications protocol
• Suitable for small-sized to medium data amounts (up to 1472 bytes)
• UDP is a simpler transport control protocol than TCP, with a thin layer that yields low
overheads
• Can be used very flexibly with many third-party systems
• Routing-capable
• Uses port numbers to direct the datagrams
• Messages are unacknowledged: The application is required to take responsibility for error
recovery and security
• Programming effort is required for data management due to the SEND / RECEIVE
programming interface
UDP supports broadcast communication. To use broadcast, you must configure the IP address
portion of the ADDR configuration. For example: A CPU with an IP address of 192.168.2.10 and
subnet mask of 255.255.255.0 would use a broadcast address of 192.168.2.255.
Refer to TCON, TDISCON, TSEND, and TRCV (Page 619) in the "TCP and ISO-on-TCP" section for
more information on the TCON and TDISCON communication instructions.
Table 11-48 TUSEND and TURCV data types for the parameters
The job status is indicated at the output parameters BUSY and STATUS. STATUS corresponds to
the RET_VAL output parameter of asynchronously functioning instructions.
The following table shows the relationships between BUSY, DONE (TUSEND), NDR (TURCV), and
ERROR. Using this table, you can determine the current status of the instruction (TUSEND or
TURCV) or when the sending (transmission) / receiving process is complete.
Table 11-49 Status of BUSY, DONE (TUSEND) / NDR (TURCV), and ERROR parameters
Table 11-50 TUSEND and TURCV condition codes for ERROR and STATUS
Operations
Both partners are passive in UDP communication. Typical parameter start values for the
"TCON_Param" data type are shown in the following figures. Port numbers (LOCAL_TSAP_ID) are
written in a 2-byte format. All ports except for 161, 34962, 34963, and 34964 are allowed.
The TUSEND instruction sends data through UDP to the remote partner specified in the
"TADDR_Param" data type. The TURCV instruction receives data through UDP. After a successful
execution of the TURCV instruction, the "TADDR_Param" data type shows the address of the
remote partner (the sender), as shown in the figures below.
11.5.8.19 T_CONFIG
The T_CONFIG instruction can change the Ethernet address, the PROFINET device name, or the
IP addresses of the NTP servers for time-of-day synchronization from within the user program.
The following features can be adjusted permanently or temporarily:
• IP address
• Subnet mask
• Router address
• Station name
• IP addresses of up to four NTP servers
Note
Located in the CPU "Properties", "Ethernet address" page, the "IP address is set directly at the
device" (Page 682) radio button allows you to change the IP address online or by using the
"T_CONFIG" instruction after the program is downloaded.
Located in the CPU "Properties", "Ethernet address" page, the "PROFINET device name is set
directly at the device" (Page 683) radio button allows you to change the PROFINET device
name online or by using the "T_CONFIG" instruction after the program is downloaded.
Located in the CPU "Properties", "Time synchronization" page, the "Enable time
synchronization via NTP server" (Page 684) box allows you to change the IP addresses of up
to four NTP servers.
Note
You cannot execute more than one T_CONFIG instruction at a time.
Note
Changes to the IP address or name of station of the CPU can be temporary or permanent.
Changes to the NTP server IP addresses can only be temporary:
• A permanent change indicates that the change is retentive, meaning that the change
persists through a power failure.
• A temporary change indicates that the change is volatile and reverts to the original value
after a power loss.
The IP configuration information is placed in the CONF_DATA data block, along with a Variant
pointer on parameter CONF_DATA referenced above. The successful execution of the T_CONFIG
instruction ends with the handover of the IP configuration data to the network interface.
The status and error messages of the instruction "T_CONFIG" are output at the parameters
STATUS and ERR_LOC:
• The cause of the error is output at the parameter STATUS.
• The location of the error that occurred is output at the parameter ERR_LOC. The following
options are available here:
– 16#0000_0000: No error or error when calling the instruction (for example, errors when
assigning parameters to the instruction or in communication with the PROFINET
interface).
– 16#0001_0000: Error with the configuration data in the parameters of the system data
type IF_CONF_HEADER.
– 16#0001_000x: Error in the configuration data in the parameters of system data type
IF_CONF_V4 or IF_CONF_NOS or IF_CONF_NTP (x specifies the position of the bad sub-
block in the T_CONFIG structure. If the T_CONFIG structure contains, for example, a sub-
block for the IP address and a sub-block for the station name, and the error is located in
the sub-block for the station name, ERR_LOC has the value 0001_0002.)
The following table shows the possible values for the parameters STATUS and ERR_LOC:
ཱ VXEILHOGBOHQJWK
ི
ཱི VXEILHOGBPRGH
① Configuration DB ④ Subfield 2
② Configuration data ⑤ Subfield n
③ Subfield 1 ⑥ Subfield-specific parameters
The configuration data of CONF_DB consists of a field that contains a header (IF_CONF_Header)
and several subfields. IF_CONF_Header provides the following elements:
• field_type_id (data type UInt): Zero
• field_id (data type UInt): Zero
• subfield_cnt (data type UInt): Number of subfields
Each subfield consists of a header (subfield_type_id, subfield_length, subfield_mode) and the
subfield-specific parameters. Each subfield must consist of an even number of bytes. The
subfield_mode can support a value of 1 or 2. Please refer to the tables below.
Note
Only one field (IF_CONF_Header) is currently allowed. Its parameters field_type_id and field_id
must have the value zero. Other fields with different values for field_type_id and field_id are
subject to future extensions.
Example: Using the T_CONFIG instruction to change IP parameters and PROFINET IO device names
In the following example, both the "addr" and "nos" (Name of station) subfields are changed. In
the CPU "Properties", "Ethernet address" page, you must select the "PROFINET device name is set
directly at the device" check box to enable you to change the PROFINET device name using the
"T_CONFIG" instruction after the program is downloaded.
Example: Using the T_CONFIG instruction to change IP addresses in the NTP servers
In the following example, in the "ntp" (Network Time Protocol (NTP) server) subfield, the
T_CONFIG instruction changes the IP addresses of up to four NTP servers.
In the CPU Properties, PROFINET interface [X1], Time synchronization page, you configure NTP
synchronization by selecting the "Enable time synchronization via NTP server" check box as
shown in the figure below. You can then change the IP addresses in the NTP servers using the
"T_CONFIG" instruction after the program is downloaded.
ID input parameter
This is a reference to the "Local ID (hex)" on the "Network view" of "Devices and networks" in STEP
7 and is the ID of the network that you want to use for this communication block. The ID must
be identical to the associated parameter ID in the local connection description.
Note
Note that DONE, NDR, and ERROR are set for one execution only.
Restricted TSAPs and port numbers for passive ISO and TCP communication
If you use the "TCON" instruction to set up and establish a passive communications connection,
the following port addresses are restricted and should not be used:
• ISO TSAP (passive):
– 01.00, 01.01, 02.00, 02.01, 03.00, 03.01
– 10.00, 10.01, 11.00, 11.01, ... BF.00, BF.01
• TCP port (passive) and UDP port (passive):
– 25, 80, 102, 5001, 34962, 34963, 34964
Consider the following when setting up communications between a CPU and a programming
device:
• Configuration/Setup: Hardware configuration is required.
• No Ethernet switch is required for one-to-one communications; an Ethernet switch is
required for more than two devices in a network.
Follow the steps below to create the hardware connection between a programming device and
a CPU:
1. Install the CPU (Page 49).
2. Plug the Ethernet cable into the PROFINET port shown below.
3. Connect the Ethernet cable to the programming device.
① PROFINET port
An optional strain relief is available to strengthen the PROFINET connection. For ordering
information, see Spare parts and other hardware (Page 1371).
Configuration/Setup:
• The PROFINET port of the CPU must be configured to connect with the HMI.
• The HMI must be setup and configured.
• The HMI configuration information is part of the CPU project and can be configured and
downloaded from within the project.
• No Ethernet switch is required for one-to-one communications; an Ethernet switch is
required for more than two devices in a network.
Note
The rack-mounted CSM1277 4-port Ethernet switch can be used to connect your CPUs and
HMI devices. The PROFINET port on the CPU does not contain an Ethernet switching device.
Supported functions:
• The HMI can read/write data to the CPU.
• Messages can be triggered, based upon information retrieved from the CPU.
• System diagnostics
Table 11-58 Required steps in configuring communications between an HMI and a CPU
Step Task
1 Establishing the hardware communications connection
A PROFINET interface establishes the physical connection between an HMI and a CPU. Since Auto-Cross-Over
functionality is built into the CPU, you can use either a standard or crossover Ethernet cable for the interface.
An Ethernet switch is not required to connect an HMI and a CPU.
Refer to "Communication with a programming device: Establishing the hardware communications connec‐
tion" (Page 687) for more information.
2 Configuring the devices
Refer to "Communication with a programming device: Configuring the devices" (Page 688) for more infor‐
mation.
3 Configuring the logical network connections between an HMI and a CPU
Refer to "HMI-to-PLC communication: Configuring the logical network connections between two devices"
(Page 690) for more information.
4 Configuring an IP address in your project
Use the same configuration process; however, you must configure IP addresses for the HMI and the CPU.
Refer to "Device configuration: Configuring an IP address for a CPU in your project" (Page 572) for more
information.
5 Testing the PROFINET network
You must download the configuration for each CPU and HMI device.
Refer to "Device configuration: Testing the PROFINET network" (Page 576) for more information.
To create a PROFINET connection, click the green (PROFINET) box on the first device, and drag
a line to the PROFINET box on the second device. Release the mouse button and your PROFINET
connection is joined.
Refer to "Device Configuration: Creating a network connection" (Page 565) for more information.
Step Task
1 Establishing the hardware communications connection
A PROFINET interface establishes the physical connection between two CPUs. Since Auto-Cross-Over func‐
tionality is built into the CPU, you can use either a standard or crossover Ethernet cable for the interface. An
Ethernet switch is not required to connect the two CPUs.
Refer to "Communication with a programming device: Establishing the hardware communications connec‐
tion" (Page 687) for more information.
2 Configuring the devices
You must configure two CPUs in your project.
Refer to "Communication with a programming device: Configuring the devices" (Page 688) for more infor‐
mation.
3 Configuring the logical network connections between two CPUs
Refer to "PLC-to-PLC communication: Configuring logical network connections between two devices"
(Page 692) for more information.
4 Configuring an IP address in your project
Use the same configuration process; however, you must configure IP addresses for two CPUs (for example,
PLC_1 and PLC_2).
Refer to "Device configuration: Configuring an IP address for a CPU in your project" (Page 572) for more
information.
Step Task
5 Configuring transmit (send) and receive parameters
You must configure TSEND_C and TRCV_C instructions in both CPUs to enable communications between them.
Refer to "Configuring communications between two CPUs: Configuring transmit (send) and receive parame‐
ters" (Page 692) for more information.
6 Testing the PROFINET network
You must download the configuration for each CPU.
Refer to "Device configuration: Testing the PROFINET network" (Page 576) for more information.
Communication blocks (for example, TSEND_C and TRCV_C) are used to establish connections
between two CPUs. Before the CPUs can engage in PROFINET communications, you must
configure parameters for transmitting (or sending) messages and receiving messages. These
parameters dictate how communications operate when messages are being transmitted to or
received from a target device.
TSEND_C instruction
The TSEND_C instruction (Page 599) creates a communications connection to a partner station.
The connection is set up, established, and automatically monitored until it is commanded to
disconnect by the instruction. The TSEND_C instruction combines the functions of the TCON,
TDISCON and TSEND instructions.
From the Device configuration in STEP 7, you can configure how a TSEND_C instruction transmits
data. To begin, you insert the instruction into the program from the "Communications" folder in
the "Instructions" task card. The TSEND_C instruction is displayed, along with the Call options
dialog where you assign a DB for storing the parameters of the instruction.
You can assign tag memory locations to the inputs and outputs, as shown in the following figure:
TRCV_C instruction
The TRCV_C instruction (Page 599) creates a communications connection to a partner station.
The connection is set up, established, and automatically monitored until it is commanded to
disconnect by the instruction. The TRCV_C instruction combines the functions of the TCON,
TDISCON, and TRCV instructions.
From the CPU configuration in STEP 7, you can configure how a TRCV_C instruction receives data.
To begin, insert the instruction into the program from the "Communications" folder in the
"Instructions" task card. The TRCV_C instruction is displayed, along with the Call options dialog
where you assign a DB for storing the parameters of the instruction.
You can assign tag memory locations to the inputs and outputs, as shown in the following figure:
Note
To add a PROFINET IO device, you can use STEP 7 Professional or Basic, V11 or greater.
For example, expand the following containers in the hardware catalog to add an ET 200SP IO
device: Distributed I/O, ET 200SP, Interface modules, and PROFINET. You can then select the
interface module from the list of ET 200SP devices (sorted by part number) and add the ET 200SP
IO device.
① PROFINET port
6,0$7,&&38
,2&RQWUROOHU
KLJKHUOHYHO
352),1(7,QGXVWULDO(WKHUQHW
,2GHYLFH
,2GHYLFH ,2GHYLFH
&HQWUDOL]HG,2
8VHUSURJUDP
LQWHOOLJSUHSURFHVVLQJ
'LVWULEXWHG
,2
Fields of application
Fields of application of the I-device:
• Distributed processing:
A complex automation task can be divided into smaller units/subprocesses. This results in
manageable processes which lead to simplified subtasks.
• Separating subprocesses:
Complicated, widely distributed and extensive processes can be subdivided into several
subprocesses with manageable interfaces by using I-devices. These subprocesses can be
stored in individual STEP 7 projects if necessary, which can later be merged to form one
master project.
• Know-how protection:
Components can only be delivered with a GSD file for the I-device interface description
instead of with a STEP 7 project. The user can protect his program since it no longer has to be
published.
Properties
Properties of the I-device:
• Unlinking STEP 7 projects:
Creators and users of an I-device can have completely separated STEP 7 automation projects.
The GSD file forms the interface between the STEP 7 projects. This allows a link to standard
IO controllers through a standardized interface.
• Real-time communication:
The I-device is provided with a deterministic PROFINET IO system through a PROFINET IO
interface.
Advantages
The I-device has the following advantages:
• Simple linking of IO controllers
• Real-time communication between IO controllers
• Relieving the IO controller by distributing the computing capacity to I-devices.
• Lower communications load by processing process data locally.
• Manageable, due to processing of subtasks in separate STEP 7 projects
6,0$7,&&38
,2FRQWUROOHU
XVHUSURJUDP
352),1(7,QGXVWULDO(WKHUQHW
6,0$7,&&38
)RUH[DPSOH )RUH[DPSOH
DV,GHYLFH
(7 (7
,2GHYLFH
,2GHYLFH ,2GHYLFH
8VHUSURJUDP
LQWHOOLJSUHSURFHVVLQJ
6,0$7,&&38
,2FRQWUROOHU
352),1(7,QGXVWULDO(WKHUQHW
)RUH[DPSOH )RUH[DPSOH
(7 (7
,2GHYLFH ,2GHYLFH
6,0$7,&&38
DV,GHYLFH
+LJKHUOHYHO,2V\VWHP ,2GHYLFH
,2FRQWUROOHU
8VHUSURJUDP
LQWHOOLJSUHSURFHVVLQJ
352),1(7,QGXVWULDO(WKHUQHW
)RUH[DPSOH )RUH[DPSOH
(7 (7
,2GHYLFH ,2GHYLFH
6,0$7,&&38
DV,GHYLFH
/RZHUOHYHO,2V\VWHP ,2GHYLFH
,2FRQWUROOHU
8VHUSURJUDP
LQWHOOLJSUHSURFHVVLQJ
RWKHUORZHUOHYHO,2V\VWHP
)RUH[DPSOH6P(&
,2&RQWUROOHU
KLJKHUOHYHO
352),1(7,QGXVWULDO(WKHUQHW
,2FRQWUROOHU
)RUH[DPSOH(7
,2GHYLFH
Unit 1 and unit 2 each consist of an I-device with centralized I/O. The I-device along with the
distributed I/O system (for example, ET 200) forms unit 3.
The user program on the I-device is responsible for preprocessing the process data. For this task,
the user program of the I-device requires default settings (for example, control data) from the
higher-level IO controller. The I-device provides the higher-level IO controller with the results (for
example, status of its subtask).
Input transfer areas behave differently upon network loss between controller and I-device
On the controller, the CPU writes zero to the input transfer areas upon network loss. On the I-
device, the input transfer areas retain their last values.
You can configure your system to avoid this condition for the general I-device case (non-shared
I-device). To do this, clear the input transfer areas for the I-device in a "Rack or Station Failure OB"
for a coming event. Follow these steps:
1. Add a "Rack or Station Failure OB" to your project. (This OB defaults to the number OB 86).
2. Add logic to the OB to write the values of the inputs for the I-device to zero when the startup
variable of LADDR indicates the value of the I-device hardware ID and the startup variable of
Event_Class indicates a "coming" event:
– You can find the I-device hardware ID in the Default tag table in the "System constants"
tab. The hardware ID is a type of "HW_Device", and the name of the tag indicates that it
is an I-device (for example, "Local~PROFINET_interface_1~IODevice").
– A value of "16#39" in the Event_Class indicates a "coming" event. If the "Event_Class"
input variable contains the value of "16#39", this indicates that the "Rack or Station Failure
OB" is now active (as opposed to being cleared).
+LJKHUOHYHO,2FRQWUROOHU
8VHUSURJUDP
,GHYLFH
,2GHYLFH
8VHUSURJUDP
,2DGGUHVVHVFHQWUDOL]HG
,2DGGUHVVHVGLVWULEXWHG ,2GHYLFH
7UDQVIHUDUHDV
④ Data exchange between the user program and the I/O of the I-device
In this way, the user program and the centralized / distributed I/O exchange input and output data.
⑤ Data exchange between the I-device and a lower-level IO device
In this way, the I-device and its IO devices exchange data. The data transfer is throughPROFINET.
Note
When you use the S7-1200 as a shared I-device and as a controller, ensure that you increase the
PROFINET I-device and PROFINET IO Update times to alleviate the communications performance
impact. The system is very stable and works well when you select 2 ms for the Update time of
a single PROFINET I-device time and you select 2 ms for the Update time of a single PROFINET IO
time.
5. Now you have the option of choosing the IO controller in the "Assigned IO controller" drop-
down list.
Once you have chosen the IO controller, the networking and the IO system between both
devices are displayed in the network view.
6. With the "Parameter assignment of PN interface by higher-level IO controller" check box, you
specify whether the interface parameters will be assigned by the I-device itself or by a higher-
level IO controller.
If you operate the I-device with a lower-level IO system, then the parameters of the I-device
PROFINET interface (for example, port parameter) cannot be assigned with the higher-level
IO controller.
7. Configure the transfer areas. The transfer areas are found in the area navigation section "I-
device communication":
– Click in the first field of the "Transfer area" column. STEP 7 assigns a default name which
you can change.
– Select the type of communication relation: you can currently only select CD or F-CD.
– Addresses are automatically preset; you can correct addresses if necessary, and determine
the length of the transfer area which is to be consistently transferred.
8. A separate entry is created in the area navigation for each transfer area. If you select one of
these entries, you can adjust the details of the transfer area, or correct them and comment
on them.
Note
If you configure an S7-1200 as an I-device, the maximum size of a transfer area is 1024 input or
output bytes. There are possible constraining factors depending on local I/O as well as address
space limitations on the controlling device.
① PROFINET
② Logical assignment
Principle
Access to the submodules of the shared device is then divided up among the individual IO
controllers. Each submodule of the shared device is assigned exclusively to one IO controller.
Boundary conditions
The following boundary conditions result because a shared device configuration is distributed
across several projects:
• The addresses of modules or submodules that are not assigned to this IO controller are
missing in the address overview of each IO controller that has access to a shared device.
• The modules or submodules that are not assigned are not taken into consideration in the
configuration limit calculation for the shared device during the consistency check. For this
reason, you must verify for yourself that the maximum number of submodules or the
maximum amount of cyclic IO data for the shared device will not be exceeded. For
information on the maximum quantities, refer to the documentation for the devices you are
using.
• Configuration errors such as the assignment of a module or submodule to several IO
controllers are not detected in STEP 7.
• CPUs that are loaded with a shared device configuration do not have any information on
whether the IO device is a shared device. Modules or submodules that are assigned to other
IO controllers and therefore other CPUs are missing in the loaded configuration. These
modules or submodules are therefore displayed neither in the CPU web server nor in the CPU
display.
Requirements
• STEP 7 V13 SP1 or higher
• IO device supports shared device functionality (for example, ET 200SP IM 155-6 PN HF V3.1).
• GSD file for configuring the IO device as a shared device is installed.
6. Double-click the IO device and insert all required modules and submodules from the
hardware catalog in the device overview table.
7. Assign the module parameters.
8. Save the project.
3. Keep the "Controller1" setting for all modules and submodules that are to remain in the
address range of the local CPU.
Select the setting "---" for all modules and submodules that are to be located in the address
range of the CPU from the "Controller2" project (Controller2). This means that an IO
controller outside the project is to have access to the module or submodule.
4. Select the interface module in the network or device view of project "Controller2".
5. Select the "Shared Device" area in the Inspector window.
A table shows which CPU has access to the respective module or submodule for all
configured modules.
6. Select the setting "---" for all modules and submodules that are to be located in the address
range of the CPU from the "Controller1" project (Controller1).
7. Finally, check whether the settings for access are "complementary" for each module or
submodule in both projects. This means that if the local CPU has access in one project, the
option "---" must be set in the other project and vice versa.
Note: The option "---" for the PROFINET interface and therefore for the ports makes the
associated parameters read-only and not changeable. Parameters of the PROFINET interface
and port parameters can only be edited in the project in which the PROFINET interface is
assigned to the local CPU. The ports can be interconnected in both projects regardless of this.
8. Check whether the same IP address parameters and device name are set for the shared device
in all projects.
Check whether the same S7 subnet ID is set in all projects for the subnet to which the shared
device is connected (subnet properties, "General" area in the Inspector window).
Note
If you make changes to the shared device: Make the same changes in each project on the shared
device. Make sure that only one IO controller has access to a module or submodule.
Note
If you configure all IO controllers that have access to the shared device in STEP 7 (TIA Portal), you
can set shorter send clocks on the IO controller than supported by the shared device (send clock
adaptation).
Note
If you configure an S7-1200 as an I-device, the maximum size of a transfer area is 1024 input or
output bytes. There are possible constraining factors depending on local I/O as well as address
space limitations on the controlling device.
I-device
You assign the following parameters for an S7-1200 CPU as an I-device:
• Centralized and distributed I/O
• Desired transfer areas
• Number of IO controllers having access to this I-device (always greater than 1 for a shared
device)
Note
You configure the I-device without a higher-level IO controller. As a result, you can only use the
local I/O addresses of the transfer area (corresponds with the "Address in the I-device") to create
the user program for editing the addresses from the transfer area. You download the I-device,
completely configured except for the connection to the higher-level IO controller, to the S7-1200
CPU.
Requirements
• STEP 7 V13 SP1 or higher
• IO device supports shared device functionality (for example, ET 200SP IM 155-6 PN HF V3.1).
• GSD file for configuring the IO device as a shared device is installed.
4. Double-click the IO device and configure all required modules and submodules.
5. Assign the module parameters. In particular, you must configure the following settings for
the CPU in the area of the PROFINET interface [X1]:
– Enable the "IO device" option in the "Operating mode" area.
– Configure the transfer areas in the "Operating mode" > "I-device configuration" area. The
"Address in IO controller" column remains empty because no IO controller is assigned.
Note: To change an input area to an output area, and vice versa, you must navigate to the
area of the corresponding transfer area.
– Select the number of IO controllers (at least two) that will access the shared I-device
during operation ("Operating mode" > "Real time settings" area, "Shared Device" area).
8. You can adapt the addresses from the Device view of the IO controller in the Device overview.
To open the device overview, double-click the I-device.
Note
If you make changes to the I-device (for example, change the number or length of the transfer
areas), export the I-device as a GSD file again. Re-install the GSD file in each project that uses the
I-device as a shared device. Make sure that only one IO controller has access to a transfer area.
Note
When you use the S7-1200 as a shared I-device and as a controller, ensure that you increase the
PROFINET I-device and PROFINET IO Update times to alleviate the communications performance
impact. The system is very stable and works well when you select 2 ms for the Update time of
a single PROFINET I-device time and you select 2 ms for the Update time of a single PROFINET IO
time.
You specify the "IO cycle" parameters in the "Properties" configuration dialog of the PROFINET I-
device or IO. Refer to "Configuring the IO cycle time" (Page 697) for further information.
Note
If you configure all IO controllers that have access to the shared I-device in STEP 7 (TIA Portal),
you can set shorter send clocks on the IO controller than supported by the shared device (send
clock adaptation).
With the S7-1200 V4.5 and TIA Portal V17, the following CPUs support MRP functionality as a
MRP Manager and a client.
• CPU 1215C
• CPU 1217C
• CPU 1215FC
As a "Client" the 1215/1217 must operate in an MRP ring by forwarding MRP packets over its
interface and reporting connection breaks to a manager in the network.
As a "Manager" the 1215/1217 must send MRP packets around the network, detect open ports
in the ring, manage blocked ports, and negotiate manager status with other potential
managers.
The S7-1200 CPU family has three models (see above) that support the MRP protocol and the
configuration parameters used to initialize MRP client and manager operation. These CPUS have
two PN ports.
With these three CPUs you can set up an MRP ring with the S7-1200 as either a client or a
manager. When acting as a manager, the CPU uses test frames to check and make sure the ring
is not interrupted. When acting as a client, it fowards these test frames instead of making the
check itself. This allows the S7-1200 to be used in both roles if needed.
Note
S7-1200 V4.4 and TIA Portal V16 and earlier
With versions V4.4 and earlier, the S7-1200 can only be set up as a client in an MRP ring setup.
Note
Reconfiguration of ring
The reconfiguration of the ring can take up to 200 ms. For this reason, the PROFINET watchdog
time for each device must be set higher than 200 ms.
Note
MRP Manager (auto) mode is default
If there is not a project, the V4.5 device will, by default, be in the MRP Manager (auto) mode.This
is important to know if you plug an out-of-the-box device into a non-ring topology and notice
test frames on your network.
S7-1200 (1214C, 1212C, and 1211C CPUs) cannot enable MRP Manager and Manager (auto)
functionality. The menu options in TIA Portal are not available for these CPUs.
The S7-1200 does not support MRPD because the S7-1200 does not have IRT capability.
Diagnostic interrupts can be toggled on and off in the media redundancy configuration window
of the TIA portal to allow the manager and clients to provide relevant MRP change reports such
as:
• A neighbor device of the ring port not supporting MRP
• A ring port being connected to a non-ring port neighbor
• A ring port connected to a different MRP Domain
• (Manager only) Interruption / return diagnostic interrupts when the MRP ring is interrupted
and when the original configuration returns
See also
New features (Page 35)
6 (763
352),1(7,QGXVWULDO(WKHUQHW
6
(7SUR
① MRP manager (Can be an S7-1500 CPU, an S7-1200 CPU 1215C, an S7-1200 CPU 1215FC, or an
S7-1200 CPU 1217C)
② Test frames
③ MRP clients
The ring ports of a device are the ports that establish the connection to the two neighboring
devices in the ring topology. The ring ports are selected and set in the configuration of the
relevant device (is also preset, if applicable).
Note
Reconfiguration of ring
The reconfiguration of the ring can take up to 200 ms. The PROFINET watchdog time for each
device must be set higher than 200 ms.
Requirements
The following requirements must be met for error-free operation with MRP:
• The ring in which you want to use MRP may only consist of devices that support this function.
• "MRP" must be activated for all devices in the ring.
• All devices must be interconnected using their ring ports.
• At least one MRP manager or Role "Manager" must be available.
• The ring must contain not more than 50 devices. Otherwise, reconfiguration times of greater
than or equal to 200 ms can occur.
• All partner ports within the rings must have identical settings.
Topology
The following schematic shows a possible topology for devices in a ring with MRP. The devices
inside the shaded oval are in the redundancy domain.
This is an example of a ring topology with MRP:
+0, 3*3&
6 (763
&3$GYDQFHG
6ZLWFK
6&$/$1&(
352),1(7,QGXVWULDO(WKHUQHW ;
6
(7SUR
The following rules apply to a ring topology with media redundancy using MRP:
• All devices in the ring belong to the same redundancy domain.
• One device in the ring has the role of a MRP manager.
• All other devices in the ring are MRP clients.
You can connect non MRP-compliant devices to the network through ports not configured as ring
ports. You can only do this with devices that have more than two ports (for example, a
SCALANCE X switch or a PC with a CP1616).
Boundary conditions
You can have the following communication possibilities:
• MRP and RT: RT operation is possible with the use of MRP.
Note
The RT communication is disrupted (station failure) if the reconfiguration time of the ring is
greater than the selected watchdog time of the IO device. You must select a watchdog time
greater than 200 ms for your IO devices. Refer to the "Watchdog time" section below for
further information.
• MRP and TCP/IP (TSEND, HTTP, ...): The TCP/IP communication with MRP is possible because
lost data packages are resent, if applicable.
Watchdog time
The PROFINET watchdog time is the time interval that an IO controller or IO device permits,
without receiving IO data. If the IO device is not supplied by the IO controller with data within
the watchdog time, the device detects the missing frames and outputs substitute values. This is
reported in the IO controller as a station failure.
You can configure the watchdog time for PROFINET IO devices. Do not enter the watchdog time
directly, but as "Accepted number of update cycles when IO data is missing". The resulting
watchdog time is automatically calculated from the number of update cycles.
To assign the watchdog time, follow these steps:
1. Select the PROFINET interface of the IO device in the Network or Device view.
2. In the properties of the interface, navigate to: Advanced options > Realtime settings > IO cycle
3. Select the required number of cycles from the drop-down list.
Procedure
To configure media redundancy, proceed as follows:
1. Establish a ring by means of appropriate port interconnections (for example, in the topology
view).
2. Select a PROFINET device for which you want to configure media redundancy.
4. Under "Media redundancy role", assign the "Manager (Auto)", "Client", or "Not device in the
ring" role to the device.
When you configure a ring in the TIA Portal Topology view, the TIA Portal automatically sets
the Media Redundancy role for you. If a device can be a Manager, the TIA Portal sets the Media
redundancy role as "Manager (Auto)". For the S7-1200, the Media Redundancy role can now
be set to either "Client" or "Manager".
Note
With V4.5 and TIA Portal V17, you can now assign the "Manager" or "Manager (Auto)" MRP
roles to the S7-1200 CPU 1215C/1215FC/1217C.
3. Navigate to the device of the required MRP domain in the inspector window.
4. For the PROFINET devices, set the "Manager (Auto)", "Client", or "Not device in the ring" role.
Note
Ring port configuration is not necessary in the S7-1200 because the S7-1200 CPU has only two
ports.
Diagnostic interrupts
If diagnostic interrupts to the MRP state are to be output in the local CPU, select the "Diagnostic
interrupts" check box. The following diagnostic interrupts can be configured:
• Wiring or port error:
The CPU generates diagnostic interrupts for the following errors in the ring ports:
– A neighbor of the ring port does not support MRP.
– A ring port is connected to a non-ring port.
– A ring port is connected to the ring port of another MRP domain.
• Interruption / return (MRP manager only):
If the ring is interrupted and the original configuration is returned, the CPU generates
diagnostic interrupts. If both of these interrupts occur within 0.2 seconds, this indicates an
interruption of the ring.
You can respond to these events in the user program by programming the appropriate response
in the diagnostic error interrupt OB (OB 82).
Note
Third-party devices as MRP manager
To assure error-free operation when a third party device is used as MRP manager in a ring, you
must assign the fixed role of "Client" to all other devices in the ring before you close the ring.
Otherwise, circulating data frames and network failure could occur.
11.5.16 S7 routing
From the STEP 7 Network view, you can create a complex communication topology by
connecting devices in different S7 subnets. You can connect classic S7-300/S7-400 CPUs and CPs
as well as the latest S7 CPUs and CPs and can include HMIs and PC stations such as an OPC server.
Once you decide which devices must communicate and establish the necessary connections
using STEP 7, the Engineering System (ES) can download the corresponding routing tables to
the various S7 routers as part of the hardware configuration. After you download the routing
tables to the various S7 routers, the ES or other communication partners can communicate with
each device even though the devices are on different S7 subnets. This is possible because the
CPUs and/or CPs, in between, act as S7 routers. The CPUs and/or CPs forward incoming
connection requests to the next S7 router until the connection request reaches the targeted
device, and the devices establish the S7 connection.
The CPU uses the write record mechanism to transfer the routing tables required by the CP
devices in the local base. The routing tables establish the route from one device to another at the
time of a connection request, which includes a remote S7 Subnet_ID. The device receiving the
connection request interrogates its routing table, finds the next station in the path to the target
S7 subnet, and forwards the connection request. Eventually, the connection request reaches the
intended target and the response traverses the route in the reverse direction.
The S7-1200 CPUs have a single PN interface and up to three CP devices connected to the local
communication bus. Therefore, you have two options for routing within the S7-1200 station:
• Routing between the CPU and a CP
• Routing from one CP to another CP
Refer to S7-1200 CPs at Siemens Industry Online Support, Product Support for further
information on all S7-1200 CPs that support the S7 routing function. The CP 1243-1 (https://
support.industry.siemens.com/cs/us/en/view/584459) is shown as an example CP module
search for S7 routing capabilities.
In order to check routing from either S7 subnet to the other S7 subnet, PLC_1 must establish a
transport connection to PLC_3, and PLC_3 must establish a connection to PLC_1. Doing so,
makes sure that routing from the PLC’s PN/IE interface to a CP module is possible as well as
routing from a CP module to the PLC’s PN/IE interface.
Disabling SNMP
Follow these steps to disable SNMP in the S7-1200 CPU:
1. Create a classic data block (DB):
5. In the classic DB block interface, create the following static tags with the values shown. You
will use these tags in your program to disable the internal SNMP implementation:
7. Using the LAD editor, in the Startup OB (OB100), in Network 1, insert a Label (Jump label) (in
the example below, the Label is named "Check") and a WRREC (Write Record) instruction with
the inputs and outputs shown:
8. Insert the following loop and check code with the Jump to Label (JMP) output. This code
ensures that the call completes and that you disable SNMP before leaving the Startup OB:
11.5.18 Diagnostics
Refer to "Organization blocks (OBs)" (Page 72) for information on how to use organization
blocks (OBs) for diagnostics with these communication networks.
11.6 PROFIBUS
A PROFIBUS system uses a bus master to poll slave devices distributed in a multi-drop fashion on
an RS485 serial bus. A PROFIBUS slave is any peripheral device (I/O transducer, valve, motor
drive, or other measuring device) that processes information and sends its output to the master.
The slave forms a passive station on the network since it does not have bus access rights, and can
only acknowledge received messages, or send response messages to the master upon request.
All PROFIBUS slaves have the same priority, and all network communication originates from the
master.
A PROFIBUS master forms an "active station" on the network. PROFIBUS DP defines two classes
of masters. A class 1 master (normally a central programmable controller (PLC) or a PC running
special software) handles the normal communication or exchange of data with the slaves
assigned to it. A class 2 master (usually a configuration device, such as a laptop or programming
console used for commissioning, maintenance, or diagnostics purposes) is a special device
primarily used for commissioning slaves and for diagnostic purposes.
The S7-1200 is connected to a PROFIBUS network as a DP slave with the CM 1242-5
communication module. The CM 1242-5 (DP slave) module can be the communications partner
of DP V0/V1 masters. If you want to configure the module in a third-party system, there is a GSD
file available for the CM 1242‑5 (DP slave) on the CD that ships with the module and on Siemens
Automation Customer Support (https://support.industry.siemens.com/cs/ww/en/ps/
6GK7242-5DX30-0XE0) pages on the Internet.
In the figure below, the S7-1200 is a DP slave to an S7-300 controller:
If a CM 1242-5 and a CM 1243-5 are installed together, an S7-1200 can perform as both a slave
of a higher-level DP master system and a master of a lower-level DP slave system, simultaneously:
As of V3.0, you can configure a maximum of three PROFIBUS CMs per station, in which there can
be any combination of DP master or DP slave CMs. DP masters in a V3.0 or greater CPU firmware
implementation can each control a maximum of 32 slaves.
The configuration data of the PROFIBUS CMs is stored on the local CPU. This allows simple
replacement of these communications modules when necessary.
To use PROFIBUS with S7-1200 V4.0 or later CPUs, you must upgrade the PROFIBUS Master CM
firmware to at least V1.3.
Note
Always update the PROFIBUS CM firmware to the latest version available (https://
support.automation.siemens.com/WW/view/en/42131407). You can perform a firmware
update by any of these methods:
• Using the online and diagnostic tools of STEP 7 (Page 1144)
• Using a SIMATIC memory card (Page 123)
• Using the Web server "Module Information" standard Web page (Page 826)
• Using the SIMATIC Automation Tool (https://support.industry.siemens.com/cs/ww/en/view/
98161300)
Further information
You can find detailed information on the PROFIBUS CMs in the manuals for the devices. You can
find these on the Internet in the pages of Siemens Industrial Automation Customer Support
under the following entry IDs:
• CM 1242‑5 (https://support.industry.siemens.com/cs/ww/en/ps/15667)
• CM 1243‑5 (https://support.industry.siemens.com/cs/ww/en/ps/15669)
Table 11-62 Adding a PROFIBUS CM 1243-5 (DP master) module to the device configuration
Use the hardware catalog to add DP slaves as well. For example, to add an ET 200SP DP slave, in
the Hardware Catalog, expand the following containers:
• Distributed I/O
• ET 200SP
• Interface modules
• PROFIBUS
Next, select "6ES7 155-6BU00-0CN0" (IM155-6 DP HF) from the list of part numbers, and add the
ET 200SP DP slave as shown in the figure below.
Refer to "Device Configuration: Creating a network connection" (Page 565) for more information.
Table 11-64 Configuring the CM 1243-5 (DP master) module and ET 200SP DP slave PROFIBUS interfaces
① PROFIBUS port
Parameter Description
Subnet Name of the Subnet to which the device is connected. Click the "Add new subnet" button to create a new
subnet. "Not connected" is the default. Two connection types are possible:
• The "Not connected" default provides a local connection.
• A subnet is required when your network has two or more devices.
Parameters Address Assigned PROFIBUS address for the device
Highest address The highest PROFIBUS address is based on the active stations on the PROFIBUS
(for example, DP master). Passive DP slaves independently have PROFIBUS
addresses from 1 to 125 even if the highest PROFIBUS address is set to 15, for
example. The highest PROFIBUS address is relevant for token forwarding (for‐
warding of the send rights), and the token is only forwarded to active stations.
Specifying the highest PROFIBUS address optimizes the bus.
Transmission rate Transmission rate of the configured PROFIBUS network: The PROFIBUS trans‐
mission rates range from 9.6 Kbits/sec to 12 Mbits/sec. The transmission rate
setting depends on the properties of the PROFIBUS nodes being used. The
transmission rate should not be greater than the rate supported by the slowest
node.
The transmission rate is normally set for the master on the PROFIBUS network,
with all DP slaves automatically using that same transmission rate (auto-baud).
11.7 AS-i
The S7-1200 AS-i master CM 1243-2 allows the attachment of an AS-i network to an S7-1200
CPU.
The actuator/sensor interface, or AS-i, is a single master network connection system for the
lowest level in automation systems. The CM 1243-2 serves as the AS-i master for the network.
Using a single AS-i cable, sensors and actuators (AS-i slave devices) can be connected to the CPU
through the CM 1243-2. The CM 1243-2 handles all AS-i network coordination and relays data
and status information from the actuators and sensors to the CPU through the I/O addresses
assigned to the CM 1243-2. You can access binary or analog values depending on the slave type.
The AS-i slaves are the input and output channels of the AS-i system and are only active when
called by the CM 1243-2.
In the figure below, the S7-1200 is an AS-i master controlling AS-i I/O module digital/analog slave
devices.
To use AS-i with S7-1200 V4.0 CPUs, you must upgrade the AS-i Master CM firmware to V1.1.
You can make this upgrade using the webserver or a SIMATIC memory card.
Note
For V4.0 S7-1200 CPUs, if using the web server or a SIMATIC memory card to upgrade from V1.0
to V1.1 AS-i firmware, you must update the AS-i firmware in the AS-i Master CM 1243-2
according to the following procedure:
1. Download the firmware upgrade to the AS-i Master CM 1243-2.
2. When the download is complete, power cycle the S7-1200 CPU to complete the firmware
upgrade process in the AS-i Master CM 1243-2.
3. Repeat steps 1 and 2 for each additional AS-i Master CM 1243-2. The S7-1200 PLC allows a
maximum of three AS-i Master CM 1243-2.
Note
It is recommended that you always update the AS-i CM firmware to the latest version available
(https://support.automation.siemens.com/WW/view/en/43416171)at the Siemens Service and
Support web site.
The AS-i master CM 1243-2 is integrated into the S7-1200 automation system as a
communication module.
You can find detailed information on the AS-i master CM 1243-2 in the "AS-i master CM 1243-2
and AS-i data decoupling unit DCM 1271 for SIMATIC S7-1200" Manual (https://
support.industry.siemens.com/cs/ww/en/ps/15750/man).
Table 11-66 Adding an AS-i master CM1243-2 module to the device configuration
Use the hardware catalog to add AS-i slaves as well. For example, to add an "I/O module,
compact, digital, input" slave, in the Hardware Catalog, expand the following containers:
• Field devices
• AS-Interface slaves
Next, select "3RG9 001-0AA00" (AS-i SM-U, 4DI) from the list of part numbers, and add the "I/
O module, compact, digital, input" slave as shown in the figure below.
Property Description
General Name of the AS‑i master CM 1243‑2
Operating parameters Parameters for the response of the AS-i master
I/O addresses Address area for the slave I/O addresses
AS‑i interface (X1) Assigned AS-i network
Note
"Diagnostic interrupt for faults in the AS‑i configuration" and "Automatic address programming"
are always active and are therefore shown in gray.
1
① AS-i port
2 3
① AS-i slave address 1; Device: AS-i SM-U, 4DI; article number: 3RG9 001-0AA00
② AS-i slave address 2A; Device: AS-i 8WD44, 3DO, A/B; article number: 8WD4 428-0BD
③ AS-i slave address 3; Device: AS-i SM-U, 2DI/2DO; article number: 3RG9 001-0AC00
Parameter Description
Network Name of the network to which the device is connected
Address(es) Assigned AS-i address for the slave device in range of 1(A or B) to 31(A or B) for a total of up to 62 slave
devices
11.7.2 Exchanging data between the user program and AS-i slaves
You can access the data of the AS-i slaves in the user program by using the displayed I/O
addresses with the appropriate bit logic operations (for example, "AND") or bit assignments.
Note
"System assignment" is automatically activated if you do not configure the AS-i slaves with
STEP 7.
If you do not configure any slaves, you must inform the AS-i master CM1243-2 about the actual
bus configuration using the online function "ACTUAL > EXPECTED".
Further information
You can find detailed information on the AS-i master CM 1243-2 in the "AS-i master CM 1243-2
and AS-i data decoupling unit DCM 1271 for SIMATIC S7-1200" Manual (https://
support.industry.siemens.com/cs/ww/en/ps/15750/man).
2 3
Access to the digital data is performed here in bytes (in other words, one byte is assigned to each
AS-i digital slave). When you configure the AS-i slaves in STEP 7, the I/O address for accessing the
data from the user program is displayed in the inspection window for the respective AS-i slave.
The digital input module (AS-i SM-U, 4DI) in the AS-i network above has been assigned slave
address 1. By clicking on the digital input module, the "AS interface" tab in the device "Properties"
displays the slave address, as shown below:
The digital input module (AS-i SM-U, 4DI) in the AS-i network above has been assigned I/O
address 2. By clicking on the digital input module, the "I/O addresses" tab in the device
"Properties" displays the I/O address, as shown below:
You can access the data of the AS-i slaves in the user program by using their I/O addresses with
the appropriate bit logic operations (for example, "AND") or bit assignments. The following
simple program illustrates how the assignment works:
Input 2.0 is polled in this program. In the AS-i system, this input belongs to slave1 (Input byte 2,
bit 0). Output 4.3, which is then set, corresponds to AS-i slave 3 (Output byte 4, bit 3)
Note
A configuration of the AS-i slaves specified through STEP 7 and downloaded into the S7 station
is transferred by the CPU on the AS-i master CM1243-2 during S7 station start-up. Any existing
configuration that was determined through the "System assignment" online function
(Page 750) ("ACTUAL -> EXPECTED") will be overwritten.
Further information
You can find detailed information on the AS-i master CM 1243-2 in the "AS-i master CM 1243-2
and AS-i data decoupling unit DCM 1271 for SIMATIC S7-1200" Manual (https://
support.automation.siemens.com/WW/view/en/50414115/133300).
In the "Set AS-i address" field, you can change the AS-i slave address. A new slave that has not
been assigned an address always has address 0. It is detected by the master as a new slave
without an address assignment and is not included in normal communication until assigned an
address.
Configuration error
When the yellow "CER" LED is ON, there is an error in the AS-i slave device configuration. Select
the "ACTUAL > EXPECTED" button to overwrite the AS-i master CM1243-2 module slave device
configuration with the AS-i field network slave device configuration.
11.8 S7 communication
11.8.1 GET and PUT (Read and write from a remote CPU)
You can use the GET and PUT instructions to communicate with S7 CPUs through PROFINET and
PROFIBUS connections. This is only possible if the "Permit access with PUT/GET communication"
function is activated for the partner CPU in the "Protection" property of the local CPU properties:
• Accessing data in a remote CPU: An S7-1200 CPU can only use absolute addresses in the
ADDR_x input field to address variables of remote CPUs (S7-200/300/400/1200).
• Accessing data in a standard DB: An S7-1200 CPU can only use absolute addresses in the
ADDR_x input field to address DB variables in a standard DB of a remote S7 CPU.
• Accessing data in an optimized DB: An S7-1200 CPU cannot access DB variables in an
optimized DB of a remote S7-1200 CPU.
• Accessing data in a local CPU: An S7-1200 CPU can use either absolute or symbolic addresses
as inputs to the RD_x or SD_x input fields of the GET or PUT instruction, respectively.
Note
V4.0 CPU program GET/PUT operation is not automatically enabled
A V3.0 CPU program GET/PUT operation is automatically enabled in a V4.0 CPU.
However, a V4.0 CPU program GET/PUT operation in a V4.0 CPU is not automatically enabled.
You must go to the CPU "Device configuration", inspector window "Properties"tab, "Protection"
property to enable GET/PUT access (Page 152).
You must ensure that the length (number of bytes) and data types for the ADDR_x (remote CPU)
and RD_x or SD_x (local CPU) parameters match. The number after the identifier "Byte" is the
number of bytes referenced by the ADDR_x, RD_x, or SD_x parameter.
Note
The total number of bytes received on a GET instruction or the total number of bytes sent on a
PUT instruction is limited. The limitations are based on how many of the four possible address
and memory areas you use:
• If you use only ADDR_1 and RD_1/SD_1, a GET instruction can get 222 bytes and a PUT
instruction can send 212 bytes.
• If you use ADDR_1, RD_1/SD_1, ADDR_2, and RD_2/SD_2, a GET instruction can get a total of
218 bytes and a PUT instruction can send a total of 196 bytes.
• If you use ADDR_1, RD_1/SD_1, ADDR_2, RD_2/SD_2, ADDR_3, and RD_3/SD_3 a GET
instruction can get a total of 214 bytes and a PUT instruction can send a total of 180 bytes.
• If you use ADDR_1, RD_1/SD_1, ADDR_2, RD_2/SD_2, ADDR_3, RD_3/SD_3, ADDR_4, RD_4/
SD_4 a GET instruction can get a total of 210 bytes and a PUT instruction can send a total of
164 bytes.
The sum of the number of bytes of each of your address and memory area parameters must be
less than or equal to the defined limits. If you exceed these limits, the GET or PUT instruction
returns an error.
On the rising edge of the REQ parameter, the read operation (GET) or write operation (PUT) loads
the ID, ADDR_1, and RD_1 (GET) or SD_1 (PUT) parameters.
• For GET: The remote CPU returns the requested data to the receive areas (RD_x), starting with
the next scan. When the read operation has completed without error, the NDR parameter is
set to 1. A new operation can only be started after the previous operation has completed.
• For PUT: The local CPU starts sending the data (SD_x) to the memory location (ADDR_x) in the
remote CPU. When the write operation has completed without error, the remote CPU returns
an execution acknowledgement. The DONE parameter of the PUT instruction is then set to 1.
A new write operation can only be started after the previous operation has completed.
Note
To ensure data consistency, always evaluate when the operation has been completed
(NDR = 1 for GET, or DONE = 1 for PUT) before accessing the data or initiating another read
or write operation.
The ERROR and STATUS parameters provide information about the status of the read (GET) or
write (PUT) operation.
Connection mechanisms
To access remote connection partners with PUT/GET instructions, the user must also have
permission.
By default, the "Permit access with PUT/GET communication" option is not enabled. In this case,
read and write access to CPU data is only possible for communication connections that require
configuration or programming both for the local CPU and for the communication partner. Access
through BSEND/BRCV instructions is possible, for example.
Connections for which the local CPU is only a server (meaning that no configuration/
programming of the communication with the communication partner exists at the local CPU),
are therefore not possible during operation of the CPU, for example:
• PUT/GET, FETCH/WRITE or FTP access through communication modules
• PUT/GET access from other S7 CPUs
• HMI access through PUT/GET communication
If you want to allow access to CPU data from the client side, that is, you do not want to restrict
the communication services of the CPU, you can configure the access protection for the S7-1200
CPU (Page 152) for this level of security.
Connection types
The connection type that you select creates a communication connection to a partner station.
The connection is set up, established, and automatically monitored.
In the Devices and Networks portal, use the "Network view" to create the network connections
between the devices in your project. First, click the "Connections" tab, and then select the
connection type with the dropdown, just to the right (for example, an S7 connection). Click the
green (PROFINET) box on the first device, and drag a line to the PROFINET box on the second
device. Release the mouse button and your PROFINET connection is joined.
Refer to "Creating a network connection" (Page 565) for more information.
Click the "Highlighted: Connection" button to access the "Properties" configuration dialog of the
communication instruction.
The GET/PUT instructions connection parameter assignment is a user aid for configuring CPU-to-
CPU S7 communication connections.
After inserting a GET or PUT block, STEP 7 displays the connection parameter assignment dialog
for the GET/PUT instructions:
The inspector window displays the properties of the connection whenever you have selected
any part of the instruction. You can configure the communication parameters in the
"Configuration" tab of the "Properties" for the communication instruction.
Note
V4.1 and later CPU program GET/PUT operation is not automatically enabled
A V3.0 CPU program GET/PUT operation is automatically enabled in a V4.1 and later CPU.
However, a V4.1 and later CPU program GET/PUT operation in a V4.1 and later CPU is not
automatically enabled. You must go to the CPU "Device configuration", inspector window
"Properties"tab, "Protection" property to enable GET/PUT access (Page 152).
The "Connection parameters" page allows you to configure the necessary S7 connection and to
configure the parameter "Connection ID" that is referenced by the GET/PUT block parameter "ID".
The page's content has information about the local endpoint and allows you to define the local
interface. You can also define the partner end point.
The "Block parameters" page allows you to configure the additional block parameters.
Parameter Definition
Connection End point "Local End point": Name assigned to the Local CPU
parameter: "Partner End point": Name assigned to the Partner (remote) CPU
General Note: In the "Partner End point" dropdown list, the system displays all potential S7
connection partners of the current project as well as the option "unspecified". An
unspecified partner represents a communication partner which is not currently in
the STEP 7 project (for example, a third party device communication partner).
Interface Name assigned to the interfaces
Note: You can change the connection by changing the Local and Partner inter‐
faces
Interface type Type of interface
Subnet name Name assigned to the subnets
Address Assigned IP addresses
Note: You can specify the remote address of a third party device for an "unspeci‐
fied" communication partner.
Connection ID ID number: Automatically generated by the GET/PUT connection parameter as‐
signment
Connection name Local and Partner CPU data storage location: Automatically generated by the GET/
PUT connection parameter assignment
Active connection estab‐ Checkbox to select Local CPU as the active connection
lishment
One-way Checkbox to specify a one-way or two-way connection; read-only
Note: In a PROFINET GET/PUT connection, both the local and partner devices can
act as a server or a client. This allows a two-way connection, and the "One-way"
checkbox is unchecked.
In a PROFIBUS GET/PUT connection, in some cases, the Partner device can only act
as a server (for example, an S7-300), and the "One-way" checkbox is checked.
Connection ID parameter
There are three ways to change the system-defined connection IDs:
1. The user can change the current ID directly on the GET/PUT block. If the new ID belongs to an
already existing connection, the connection is changed.
2. The user can change the current ID directly on the GET/PUT block, but the new ID does not
already exist. A new S7 connection is created by the system.
3. The user can change the current ID through the "Connection overview" dialog: The user-input
is synchronized with the ID-parameter on the corresponding GET/PUT block.
Note
The parameter "ID" of the GET/PUT block is not a connection name, but a numerical
expression which is written like the following example: W#16#1
Given the configuration of PLC_1, PLC_2, and PLC_3 as shown in the figure below, insert GET or
PUT blocks for "PLC_1".
For the GET or PUT instruction, the "Properties" tab is automatically displayed in the inspector
window with the following menu selections:
• "Configuration"
• "Connection parameters"
Parameter Definition
Connection End point "Local End point" contains "PLC_1" as read-only.
parameter: "Partner End point" field contains "PLC_3[CPU319-3PN/DP]":
General
• The color switches from red to white
• The "Partner" device image is shown.
• A connection line appears between the PLC_1- and PLC_3 device images
(green Ethernet line).
Interface "Local Interface" contains "CPU1214C DC/DC/DC, PROFINET interface (R0/S1)".
"Partner Interface" contains: "CPU319-3PN/DP, PROFINET interface (R0/S2)".
Interface type "Local Interface type" contains "Ethernet/IP"; control is read-only.
"Partner Interface type" contains "Ethernet/IP"; control is read-only.
Interface type images are shown at the right beside the Local and Partner "Inter‐
face type" (green Ethernet icon).
Subnet name "Local Subnet name" contains "PN/IE_1"; control is read only.
"Partner Subnet name" contains "PN/IE_1"; control is read only.
Address "Local Address" contains the Local IP address; control is read only.
"Partner Address" contains the Partner IP address; control is read only.
Connection ID "Connection ID" contains "100".
In the Program editor, in the Main [OB1], the GET/PUT block "Connection ID" value
also contains "100".
Connection name "Connection name" contains the default connection name (for example, "S7_Con‐
nection_1"); control is enabled.
Active connection estab‐ Checked and enabled to select the Local CPU as the active connection.
lishment
One-way Read-only and unchecked.
Note: "PLC_1" (an S7-1200 CPU 1214CDC/DC/Relay) and "PLC_3" (an S7-300 CPU
319-3PN/DP) can both act as a server and a client in a PROFINET GET/PUT con‐
nection, allowing a two-way connection.
The GET/PUT icon in the Property View tree also changes from red to green.
Parameter Definition
Connection End point "Local End point" contains "PLC_1" as read-only.
parameter: "Partner End point" field contains "PLC_3[CPU319-3PN/DP]":
General
• The color switches from red to white
• The "Partner" device image is shown.
• A connection line appears between the PLC_1- and PLC_3 device images
(purple PROFIBUS line).
Interface "Local Interface" contains "CPU1214C DC/DC/DC, PROFIBUS interface (R0/S1)".
"Partner Interface" contains: "CPU319-3PN/DP, PROFIBUS interface (R0/S2)".
Interface type "Local Interface type" contains "PROFIBUS"; control is read-only.
"Partner Interface type" contains " PROFIBUS "; control is read-only.
Interface type images are shown at the right beside the Local and Partner "Inter‐
face type" (purple PROFIBUS icon).
Subnet name "Local Subnet name" contains " PROFIBUS _1"; control is read only.
"Partner Subnet name" contains " PROFIBUS _1"; control is read only.
Address "Local Address" contains the Local IP address; control is read only.
"Partner Address" contains the Partner IP address; control is read only.
Connection ID "Connection ID" contains "100".
In the Program editor, in the Main [OB1], the GET/PUT block "Connection ID" value
also contains "100".
Connection name "Connection name" contains the default connection name (for example, "S7_Con‐
nection_1"); control is enabled.
Active connection estab‐ Read-only, checked, and enabled to select the Local CPU as the active connection.
lishment
One-way Read-only and checked.
Note: "PLC_3" (an S7-300 CPU319-3PN/DP) can act only as a server (cannot also
be a client) in a PROFIBUS GET/PUT connection, allowing only a one-way con‐
nection.
The GET/PUT icon in the Property View tree also changes from red to green.
11.9 What to do when you cannot access the CPU by the IP address
In case you cannot reach a CPU by the IP address, you can set an emergency (temporary) IP
address for the CPU. The emergency IP address enables you to re-establish communication with
the CPU in order to download a device configuration with a valid IP address.
Under these conditions, you can use a DCP tool to set the IP address of the device to an
emergency IP address. The SIMATIC Automation Tool, for example, has a DCP Set IP address
command. You can set an emergency IP address regardless of the protection level (Page 152) of
the CPU. After you set a temporary IP address with a DCP tool, the Maintenence LED on the CPU
turns on. The Diagnostic Buffer also includes an entry indicating that you enabled an emergency
address of an Ethernet interface.
See also
OPC Foundation (https://opcfoundation.org/)
You can configure the OPC UA server in TIA Portal in the CPU hardware properties.
To configure the OPC UA server, follow these steps:
1. Select the General tab in the Device Configuration view.
• In the General window, select "OPC UA".
– In the OPC UA>Server window, you can set the:
- General settings
- Options
- Security
- Diagnostics
Examples
• You only want to add another code block to the program.
Neither data blocks nor inputs, outputs, flags, times or counters are affected.
Reaction during loading: A running OPC UA server is not interrupted.
• You want to load a new data module and you have flagged the data module as non-OPC-UA-
relevant.
Reaction during loading: A running OPC UA server is not interrupted.
• You want to overwrite a data module.
Reaction during loading: A warning appears that the server will be restarted. Background:
STEP 7 cannot determine whether the changes refer to OPC-UA-relevant data or not.
Reading out the CPU operating mode over the OPC UA server
The OPC UA server settings table gives further information about the settings you configure for
the OPC UA server. The table also describes the limitations of the server for the S7‑1200 V4.5 or
later firmware.
The default values for each column works with the default CPU communications load of 20%. If
the maximum load parameters are specified, the CPU percentage communications load will
need to be increased. This depends on the load imposed by other communications activities (for
example PROFINET).
Server security is only one of the security methods used to secure technology. Other methods
used to secure technology include TIAP security and PLC security.
The OPC UA server requires a certificate for activation. The TIA Portal automatically generates a
certificate when you activate the server. You can change this certificate in the PLC properties.
Note
S7-1200 certificate limit
The S7-1200 has a system certificate limit of 64.
All certificates count against this number (for example, Web certificates, OPC UA certificates, and
OUC certificates).
If you have more than 64 certificates, the TIA Portal displays an error stating that you have
exceeded the maximum number of 64 certificates. You must remove some certificates from the
PLC configuration.
Note
Establishing a secure OPC UA connection
More sophisticated OPC UA security policies can require that the communications load
percentage be increased from the specified default in order to maintain online connections to
external devices, such as the TIA Portal, HMIs, etc.
For example, when establishing a connection from an OPC UA client to the S7-1200 OPC UA
server, an existing online TIA Portal connection can be aborted. This is due to the initial time
intensive computations required to establish the secure connection which can cause the TIA
Portal online connection to time out.
Note that the increased security does not adversely affect OPC UA Client/Server communications
beyond initial connection establishment.
One solution to this issue is to simply re-establish the online connection. Another solution is to
increase the default communications load percentage as shown below.
Note however, that increasing the default commications load percentage will proportionally
increase the scan cycle time.
You can define valid users for the OPC UA server in two ways:
• Define valid users in the hardware properties of the CPU.
• If you have enabled global security for your project, valid users are identified via the roles you
specify for individual TIA Portal project users. You can configure a maximum of 21 users.
The S7‑1200 OPC UA server supports the standard SIMATIC server interface. However it does not
support the automatic "publishing" of CPU and DB tags using this selection. Instead, you must
define the structure and content of the server interface in TIA Portal and then download to the
PLC.
Note that this list represents supported base node types. It does not represent a complete list of
supported node types since many SIMATIC data types map to the base node types. Any SIMATIC
data type that maps to a base node type is also a supported node type.
The S7-1200 V4.5 CPUs support server methods as well as structured data types (structures and
arrays).
Unions are not supported by S7-1200 CPUs.
The S7‑1200 accepts a download of a server with unsupported types. However, the PLC returns
an error if the client attempts to read or write to a node with an unsupported type.
Attribute Value
Nodeld Ns=SI;s=PLC
BrowseName SI:<PLC>
Where <PLC> is the name the user has assigned to the PLC in their TIA Portal project
References NodeClass BrowseName Comment
ComponentOf the DeviceSet Object
OrganizedBy the Objects folder
HasTypeDefinition ObjectType SimaticDeviceType Derived from device type
HasProperty Variable DeviceManual
HasProperty Variable DeviceRevision
HasProperty Variable EngineeringRevision
HasProperty Variable HardwareRevision
HasProperty Variable Icon
Attribute Value
HasProperty Variable Manufacturer
HasProperty Variable Model
HasProperty Variable OperatingMode
HasProperty Variable OrderNumber
HasProperty Variable RevisionCounter
HasProperty Variable SerialNumber
HasProperty Variable SoftwareRevision
When downloaded, these define the server interface that is visible to an OPC UA client.
You must set a specific TAG attributes for the TAG to be read/writable from OPC UA.
In the server creation dialog, you can add or define the service interface.. To define the OPC UA
server interface in the TIA portal:
• Select "Server interface", Type: Interface
• Select "Companion specification", Type: Companion specification
• Select "Companion specification", Type: Reference namespace
The required license type is displayed under "Properties > General > Runtime licenses > OPC-UA
> Type of required license. To confirm purchase of the required license, follow these steps:
1. Click "Runtime licenses > OPC UA" in the properties of the CPU.
2. Select the required license from the "Type of purchased license" drop-down list.
With S7-1200 V4.5, the OPC UA server lets you generate events to a component that manages
all OPC UA Diagnostic messages and adds the messages to the diagnostic buffer of the CPU
S7-1200. Whenever a sub component of OPC UA emits an event to this component, the central
component checks if the diagnostic message is switched on in the configuration and needs to
be added to the diagnostic buffer.
You configure the OPC UA diagnostic in the TIA Portal V17 and download the settings to the PLC.
Then, trigger diagnostic messages with an OPC client and check the diagnostic buffer entries via
the OPC client.
Note
Enabled/disabled OPC UA server
The settings of the OPC UA diagnostics menu can only be changed when OPC UA server is
enabled.
When OPC UA server is disabled, all settings are greyed out and can only be read.
Note
Service request exceeds a configured limit or a system limit
If a service request exceeds a configured limit or a system limit, the server will respond with a
service fault in the most cases.
If a specific sampling rate cannot be reached, the client will receive a value with the Status
"GoodOverload". This also triggers a "Sampling Overload" diagnostic buffer entry:
"OPC UA Server sampling rate could not be reached. Overload of SubscriptionID"
The message is only triggered when the status of the monitored item changes from "Good" to
"GoodOverload".
Any time the user gets a negative response, a message is generated The most common use
cases are shown below:
Note
Software download
A software download will also result in a OPC UA Server restart.
A running subscription often changes between the states "Normal" and "KeepAlive" (when the
monitored values changes only occasionally). There are no messages triggered for the
"KeepAlive" state because that would add too many messages to the diagnostic buffer.The
following usecases are implemented:
Table 11-82 Implemented usecases for implemented usecases for OPC UA Server security activated
• CreateMonitoredItems
• ModifyMonitoredItems
• DeleteMonitoredItems
• SetMonitoringMode
• SetTriggering
• CreateSubscription
• ModifySubscription
• DeleteSubscription
• Publish
• Republish
• SetPublishingMode
• OpenSecureChannel
• CloseSecureChannel
Table 11-83 Summary of messages for OPC UA from Wrong usage of service
6DV23&8$VHUYHU
0HWKRG
23&8$ )LUPZDUH 23&B8$B )%&RRO &\FOLF
&OLHQW 23&8$ 6HUYHU0HWKRG3UH &DOO XVHUSURJUDP
6HUYHU 23&3UHB
,QVWDQFH
$ % &
0HWKRG
)XQFWLRQDOLW\!
&DOO
&DOO &RRO
23&3RVWB
23&B8$B ,QVWDQFH
6HUYHU0HWKRG3RVW
&DOO
&RRO
'
A Call of the server method and management of the "Done" information (method com‐
plete)
① Asynchronous call of the server method
② Asynchronous "Done" information for the method called (method complete)
B Wait for OPC UA client calls, management of calls in the queue, forwarding of "Done"
information from the cyclic user program to the OPC UA client
③ Data transfer from the OPC UA server to the method instances of the user program and
vice versa
C Check whether method has been called. If it has, forwarding of input data from the OPC
UA server to the method instance of the user program and feedback to the method
instance that the method has been called ("called").
④ Synchronous call of the instruction OPC_UA_ServerMethodPre as a multi-instance stat‐
ing the storage area for the input data from the OPC UA server. The return value indicates
whether or not the method has been called by the OPC UA client. ⑤ Check whether the
method has been completed or is still active ("busy").
⑤ Check whether the method has been completed.
D If it has, the output data of the method instance is forwarded to the OPC UA server and
the method instance is notified that the method has been completed. The OPC UA server
is notified.
⑥ Call of the method FB (in this case: FB Cool) with the required instance and the process
parameters .
USINT Byte
UINT UINT16
UDINT UINT32
REAL Float
Note
Web server multiple concurrent connections
The S7-1200 Web server allows for 30 concurrent connections (assuming that you have enough
dynamic connections). Open browser instances can consume between 2 to 8 connections each.
The Web server allows up to 7 logged-in users but Siemens recommends that you keep the
number of concurrent users as low as possible. An average of 7 users at a time is typically okay
under average workloads.
• Watch tables (Page 835) - watch tables that you configured in STEP 7
• Online backup (Page 836) - ability to backup an online CPU or restore a previously-made
online backup
• Data Logs (Page 838)- ability to view a list of all data logs on the PLC, download a data log
from the PLC to your computer, delete a data log from the PLC, and retrieve and clear a data
log from the PLC
• User Files (Page 841)- ability to view a list of user files on the PLC, download a user file from
the PLC to your computer, upload a user file from your computer to the PLC, and delete a user
file on your PLC
• User-defined pages (Page 847)- create user-defined Web pages to access CPU data
• File Browser (Page 845) - browser for files stored internally in the CPU or on a memory card,
for example, data logs and recipes
• Login (Page 817) - log in as a different user, or log out.
These pages are included in the S7-1200 CPU, and are available in English, German, French,
Spanish, Italian, and Simplified Chinese. Additional configuration is needed in TIA Portal to view
PLC diagnostic messages (chapter 15). All pages except for the Introduction and Start page
require additional user privileges (Page 808) that you configure in STEP 7 to view the page.
Web API
The S7‑1200 CPU also provides a Web API (Page 885) that is an interface for you to read and
write process data.
• Opera V58
• Google Chrome V75
• Android browser for Android Pie V9
• Mobile Chrome for Android Pie V9
• Mobile Safari and Chrome for iOS V13
When using the HTML Browser control in a WinCC project, the Web server supports the following
Siemens HMI Panels for the standard pages:
• Basic Panels
– Gen 2 KTP400 to KTP1200
• Comfort Panels
– TP700 to TP2200
– KP400 to KP1500
– KTP400
– TP700 Comfort Outdoor
• Mobile Panels
– Gen 2 KTP700[F], KTP900[F]
• Unified Comfort Panels
– Basic Panel (2nd Gen)
– Mobile Panel (2nd Gen)
For browser-related restrictions that can interfere with the display of standard or user-defined
Web pages, see the Constraints (Page 886) section.
WARNING
Unauthorized access to the CPU through the Web server
Users with CPU full access or full access (incl. fail-safe) privileges have privileges to read and
write PLC variables. Regardless of the access level for the CPU, Web server users can have
privileges to read and write PLC variables. Unauthorized access to the CPU or changing PLC
variables to invalid values could disrupt process operation and could result in death, severe
personal injury and/or property damage.
Authorized users can perform operating mode changes, writes to PLC data, and firmware
updates. Siemens recommends that you observe the following security practices:
• Password protect CPU access levels (Page 152) and Web server user IDs (Page 808) with
strong passwords.
• Strong passwords are at least twelve characters, are not trivial or easy to guess, and include
at least three of the following:
– Uppercase letters
– Lowercase letters
– Digits
– Special characters
• A trivial password is one that is easy to guess. It is usually based on a characteristic of the
user, such as a pet’s name, family name, or the company where the user works. For
example: Siemens1$, June2015, or Qwerty1234.
• Best practices for generating strong but easy-to-remember passwords include the use of
meaningless short sentences and mixing several random words. For example:
PC;House#R3d
• Enable access to the Web server only with the HTTPS protocol.
• Do not extend the default minimum privileges of the Web server "Everybody" user.
• Perform error-checking and range-checking on your variables in your program logic
because Web page users can change PLC variables to invalid values.
• Use a secure Virtual Private Network (VPN) to connect to the S7-1200 PLC Web server from
a location outside your protected network.
After you download the device configuration, you can use the standard Web pages to access the
Introduction and Start page of the CPU. To access additional pages, you must configure one or
more Web server users (Page 808).
If you created and enabled user-defined Web pages (Page 847), you can access them from the
standard or basic Web page navigation menu.
Note
Device exchange: Replacing a V3.0 CPU with a V4.x CPU
If you replace an existing V3.0 CPU with a V4.x CPU (Page 1380) and convert your V3.0 project
to a V4.x project, note that STEP 7 and the V4.x CPU retain the Web server settings for
• "Activate web server on all modules of this device"
• "Permit access only with HTTPS"
Note
If a "Download in RUN" (Page 1162) is in progress, standard and user-defined Web pages do not
update data values or permit you to write data values until the download is complete. The Web
server discards any attempts to write data values while a download is in progress.
WARNING
Unauthorized access to the CPU through the Web server
Users with CPU full access or full access (incl. fail-safe) privileges have privileges to read and
write PLC variables. Regardless of the access level for the CPU, Web server users can have
privileges to read and write PLC variables. Unauthorized access to the CPU or changing PLC
variables to invalid values could disrupt process operation and could result in death, severe
personal injury and/or property damage.
Authorized users can perform operating mode changes, writes to PLC data, and firmware
updates. Siemens recommends that you observe the following security practices:
• Password protect CPU access levels (Page 152) and Web server user IDs with strong
passwords.
• Strong passwords are at least twelve characters, are not trivial or easy to guess, and include
at least three of the following:
– Uppercase letters
– Lowercase letters
– Digits
– Special characters
• A trivial password is one that is easy to guess. It is usually based on a characteristic of the
user, such as a pet’s name, family name, or the company where the user works. For
example: Siemens1$, June2015, or Qwerty1234.
• Best practices for generating strong but easy-to-remember passwords include the use of
meaningless short sentences and mixing several random words. For example:
PC;House#R3d
• Enable access to the Web server only with the HTTPS protocol.
• Do not extend the default minimum privileges of the Web server "Everybody" user.
• Perform error-checking and range-checking on your variables in your program logic
because Web page users can change PLC variables to invalid values.
• Use a secure Virtual Private Network (VPN) to connect to the S7-1200 PLC Web server from
a location outside your protected network.
Note
Update password encryption for device exchange to V4.5 (or greater)
After a device exchange to V4.5 (or greater), you must update the Web server user password
encryption. From the CPU's device configuration in the TIA Portal, click the "Upgrade password
encryption" button in the Web server user management.
Note
Use a secure Virtual Private Network (VPN) to connect to the S7-1200 PLC Web server from a
location outside your protected network. Be aware also of any constraints (Page 886) that your
Web environment or operating system might impose.
Note
Note that any standard Web page that is not listed specifically above (for example, the Online
backup page (Page 836)) does not have a direct access URL.
Secure access
Use a secure Virtual Private Network (VPN) to connect to the S7-1200 PLC Web server from a
location outside your protected network. Require and use https:// instead of https:// for secure
access (Page 805) to the standard Web pages. When you connect to the S7-1200 with https://,
the Web site encrypts the session with a digital certificate. The Web server transmits the data
securely and it is not accessible for anyone to view. You typically get a security warning that you
can confirm with "Yes" to proceed to the standard Web pages. To avoid the security warning with
each secure access, you can import the Siemens software certificate to your Web browser
(Page 813).
&HOOXODUVHUYLFHSURYLGHU:LUHOHVVDFFHVVSRLQW
3/&
:$1
3/&
931WXQQHORYHU
WKH,QWHUQHW 0RELOHGHYLFH
3/&
5RXWHU)LUHZDOO
6ZLWFK
3/&
/RFDOZLUHOHVV
DFFHVVSRLQW 0RELOHGHYLFH
In this example, a mobile device that is within range of the local wireless access point can
connect to PLC 3 and PLC 4 by their IP addresses. From the Internet outside the local wireless
range, a mobile device can connect to PLC 1 and PLC 2 using the port forwarded address for each
PLC.
To access the standard Web pages, you must have access to a cellular service or wireless access
point. To access a PLC from the Internet, enter the port forwarded address in the Web browser
of your mobile device to access the PLC, for example https://ww.xx.yy.zz:pppp or https://
ww.xx.yy.zz:pppp, where ww.xx.yy.zz is the address of the router and pppp is the port
assignment for a specific PLC.
For local access through a local wireless access point, enter the IP address of the S7‑1200 CPU
or a Web server-enabled CP (Page 812) in the local rack:
• https://ww.xx.yy.zz or https://ww.xx.yy.zz to access the standard Web pages (Page 816)
• https://ww.xx.yy.zz/basic or https://ww.xx.yy.zz/basic to access the basic Web pages
(Page 817)
For increased security, configure the Web server to be accessible only by secure access (HTTPS)
(Page 805).
• CP 1243‑7 LTE‑US
• CP 1243-8 IRC
You use the Start standard Web page (Page 822) to access the Web pages through these CP
modules. The Start page displays all configured and installed CP modules that you have in your
local rack, but you can only access Web pages from the ones listed above.
Note
Access to standard Web pages when Web server-enabled CPs are in the local rack
You might observe delays up to one or two minutes when connecting to the S7-1200 standard
Web pages when Web server-enabled CPs are in the local rack. If the pages do not appear to be
available, or you get errors, just wait one or two minutes and refresh the page.
Note
S7-1200 certificate limit
The S7-1200 has a system certificate limit of 64.
All certificates count against this number (for example, Web certificates, OPC UA certificates, and
OUC certificates).
If the Web server certificate has been signed by a Certificate authority (CA) certificate and
present in the TIA Portal, then 2 certificates are used by the Web server (one for the Web server
certificate and one for its downloaded CA certificate).
If you have more than 64 certificates, the TIA Portal displays an error stating you have exceeded
the maximum number of 64 certificates. You must remove some certificates from the PLC
configuration.
Other browsers
Follow the conventions of your Web browser to import and install the Siemens certificate.
After you install the Siemens security certificate "S7-1200 Controller Family" in the Internet
options for your Web browser content, you do not have to verify a security prompt when you
access the Web server with https:// ww.xx.yy.zz.
Note
The security certificate remains constant through reboots of the CPU. If you change the IP
address of the device you must download a new certificate if you are using a browser other than
Internet Explorer or Mozilla Firefox.
① Web server header with selector to display PLC Local time or UTC time, and a selector for
the display language (Page 143)
② Log in or log out
③ Standard Web page header with name of the page that you are viewing. This example is the CPU
Diagnostics > Identification page. Some of the standard Web pages, such as module information,
also display a navigation path here if multiple screens of that type can be accessed.
④ Refresh icon: for pages with automatic refresh, enables or disables the automatic refresh func‐
tion; for pages without automatic refresh, causes the page to update with current data
⑤ Print icon: prepares and displays a printable version of the information available from the dis‐
played page
⑥ Navigation area to switch to another page
⑦ Content area for specific standard Web page that you are viewing. This example is the Diagnostics
page.
Note
CP module standard Web pages
Certain CP modules (Page 812) provide standard Web pages that are similar in appearance and
functionality to the S7‑1200 CPU standard Web pages. Refer to your CP documentation for
descriptions of the CP standard Web pages.
Note that the standard Web page illustrations in this chapter represent the standard PC Web
page appearance. Most of the standard Web pages have equivalent basic pages.
• Write tags
• Read tag status
• Write tag status
• Open user-defined Web pages
• Write in user-defined Web pages
• Read files
• Write/delete files
• Change operating mode
• Flash LEDs
• Perform a firmware update
• Create a backup of the PLC
• Restore the PLC by backup firmware
• Parameter access (F-Admin) for S7-1200 Fail-Safe CPUs only
You configure user roles, associated access levels (privileges), and passwords (Page 808) in the
Web server user management properties of the STEP 7 device configuration of the CPU.
Logging in
STEP 7 provides a default user named "Everybody" with no password. By default, this user has no
additional privileges and can only view the Start (Page 822) and Introduction (Page 821)
standard Web pages. You can, however, grant additional privileges to the "Everybody" user as
well as other users that you configure:
WARNING
Unauthorized access to the CPU through the Web server
Users with CPU full access or full access (incl. fail-safe) privileges have privileges to read and
write PLC variables. Regardless of the access level for the CPU, Web server users can have
privileges to read and write PLC variables. Unauthorized access to the CPU or changing PLC
variables to invalid values could disrupt process operation and could result in death, severe
personal injury and/or property damage.
Authorized users can perform operating mode changes, writes to PLC data, and firmware
updates. Siemens recommends that you observe the following security practices:
• Password protect CPU access levels (Page 152) and Web server user IDs (Page 808) with
strong passwords.
• Strong passwords are at least twelve characters, are not trivial or easy to guess, and include
at least three of the following:
– Uppercase letters
– Lowercase letters
– Digits
– Special characters
• A trivial password is one that is easy to guess. It is usually based on a characteristic of the
user, such as a pet’s name, family name, or the company where the user works. For
example: Siemens1$, June2015, or Qwerty1234.
• Best practices for generating strong but easy-to-remember passwords include the use of
meaningless short sentences and mixing several random words. For example:
PC;House#R3d
• Enable access to the Web server only with the HTTPS protocol.
• Do not extend the default minimum privileges of the Web server "Everybody" user.
• Perform error-checking and range-checking on your variables in your program logic
because Web page users can change PLC variables to invalid values.
• Use a secure Virtual Private Network (VPN) to connect to the S7-1200 PLC Web server from
a location outside your protected network.
To perform certain actions such as changing the operating mode of the controller, writing values
to memory, and updating the CPU firmware you must have the required privileges. Note that if
you have set the protection level of the CPU (Page 152) to "Complete protection (no access)",
then the "Everybody" user has no permission to access the Web server, regardless of the Web
server user permission settings.
Note
If you encounter any problems logging in, download the Siemens security certificate (Page 813)
from the Introduction page (Page 821). You can then log in with no errors.
Logging out
To log out, simply click the "Logout" link from any page
when viewing from a PC or wide mobile device.
After you log out, you can only access and view standard Web pages according to the privileges
of the "Everybody" user. Each of the standard Web page descriptions defines the required
privileges for that page.
Note
Log off prior to closing Web server
If you have logged in to the Web server, be sure to log off prior to closing your Web browser. The
Web server supports a maximum of seven concurrent logins.
12.7.4 Introduction
The Introduction page is the welcome screen for entry into the S7-1200 standard Web pages.
From this page, you click "Enter" to access the S7-1200 standard Web pages. At the top of the
screen are links to useful Siemens Web sites, as well as a link to download the Siemens security
certificate (Page 813). You can also choose to skip the introduction page on future accesses to
the Web server.
12.7.5 Start
The Start page displays a representation of the CPU or CP to which you are connected and lists
general information about the device and the TIA Portal version you used to download the
project to the CPU. For the CPU, you can use the buttons to change the operating mode and
flash the LEDs, if you have logged in (Page 817) with the "change operating mode" privilege
(Page 808).
The bottom portion of the screen is visible if you have configured and installed Web server-
enabled CP modules (Page 812) in the local rack with the S7‑1200 CPU. You can hover over and
click a Web server-enabled CP module to access the standard Web pages. Refer to the
documentation for your CP module for information about the CP module Web pages. You see the
name of the CP module when you hover over it.
The Web server also displays any other CM and CP modules in the local rack, but you cannot click
them as they do not contain Web pages. The module appearance for these CMs and CPs are light
gray (desensitized) to indicate that they are display-only and not clickable modules.
Note that the S7-1200 fail-safe CPUs display additional data on this page related to functional
safety.
12.7.6 Diagnostics
The Diagnostics page displays identifying characteristics of the CPU, configuration settings for
know-how protection and memory usage for load memory, work memory, and retentive
memory:
The page consists of three tabs:
• Identification: identifying characteristics of the module and plant and location information
from STEP 7
• Program protection: status of know-how protection and CPU binding, which can be useful in
planning for spare parts as well as STEP 7 configuration setting for allowing or preventing the
copy of internal load memory to external load memory (SIMATIC memory card).
• Memory: load, work, and retentive memory usage
For F-CPUs, there is an additional Fail-safe tab.
Viewing the Identification page requires the "query diagnostics" privilege (Page 808).
Identification tab
Memory tab
Fail-safe tab
Refer to the S7-1200 Functional Safety Manual (https://
support.industry.siemens.com/cs/ww/en/view/104547552) for information about the
Diagnostics page Fail-safe tab.
The Diagnostic Buffer page also includes a button to save the diagnostic buffer to a CSV file.
By default, the Web server saves the file in comma-separated format to ASLog.csv in your
Downloads folder. The file contains the complete diagnostic buffer at the time of the save
operation. You can save the file as many times as you choose and keep multiple files. You can
open the diagnostic buffer file with Microsoft Excel or any text editor.
Viewing the Diagnostic Buffer page requires the "query diagnostics" privilege (Page 808).
Icon Meaning
No fault
Deactivated
Maintenance required
Maintenance demanded
Error
The CPU cannot reach the module or device (for devices other than the CPU)
The CPU has established a connection to the device, but the module status is unknown (for
devices other than the CPU)
Input and output data are unavailable because the submodule has blocked its I/O channels (for
devices other than the CPU)
Drilling down
You can select a link in the top section to drill down to the module information for that particular
module. Modules with submodules have links for each submodule. The type of information that
is displayed varies with the module selected. For example, the module information dialog
initially displays the name of the S7‑1200 station, a status indicator, and a comment. If you drill
down to the CPU, the module information displays the name of the digital and analog inputs and
outputs that the CPU model provides, addressing information for the I/O, status indicators, slot
numbers, and comments.
As you drill down, the module information page shows the path you have followed. You can click
any link in this path to return to a higher level.
Note that if you click an F‑I/O module in the top section, then the bottom section has a Safety tab.
On this tab, you can see specific data related to the selected module as described in the S7-1200
Functional Safety Manual (https://support.industry.siemens.com/cs/ww/en/view/104547552).
Note
For updating CPU firmware, you can only update S7-1200 CPUs of version 3.0 and higher.
Note
Potential problems with performing a firmware update from the Web server
In the event of a communications disruption during a firmware update from the Web server, your
Web browser could display a message asking whether you want to leave or stay on the current
page. To avoid potential problems, select the option to stay on the current page.
If you close the Web browser while in the process of performing a firmware update from the Web
server, you will be unable to change the operating mode of the CPU to RUN mode. If this situation
happens, you must cycle power to the CPU to be able to change the CPU to RUN mode.
12.7.9 Communication
The communication page displays the parameters of the connected CPU, communications
statistics, resources and information about connections.
Viewing the Communication page requires the "query diagnostics" privilege.
Parameter tab
The Parameter tab shows the MAC address of the CPU, the IP address and IP settings of the CPU,
and physical properties:
Statistics tab
The Statistics tab shows send and receive communication statistics:
If you login as a user with the "write tag status" privilege (Page 817), you can also modify data
values. Enter any values that you wish to set in the appropriate "Modify Value" field. Click the "Go"
button beside a value to write that value to the CPU. You can also enter multiple values and click
"Apply" to write all of the values to the CPU. The buttons and column labels for modifying only
appear if you have the "write tag status" privilege.
If you leave the Tag status page and return, the Tag status page does not retain your entries. You
can bookmark the page and return to the bookmark to see the same entries. If you do not
bookmark the page, you must re-enter the variables.
For values you frequently monitor or modify, consider using a Watch table (Page 835) instead.
Note
Be aware of the following issues when using the standard Tag status page:
• Enclose all string modifications in single quotes.
• The Tag status page can monitor and modify tags that contain any of the following
characters: &, <, (, +, ,(comma), ., [, ], $, or %, providing you enclose the tag name in double
quotation marks, for example, "Clock_2.5Hz".
• To monitor or modify just one field of a DTL tag, include the field in the Address, for example,
"Data_block_1".DTL_tag.Year. Enter an integer value for the modify value according to the
data type of the specific field of the DTL. For example, the Year field is a UInt.
• The maximum number of variable entries per page is 50.
• If a tag name displays special characters such that it is rejected as an entry on the Tag status
page, you can enclose the tag name in double quotation marks. In most cases, the page will
then recognize the tag name.
See also
Rules for entering tag names and values (Page 888)
After you complete the watch table configuration in the Web server section of the device
configuration, download your hardware configuration to the CPU.
Note
Advantages of watch tables for modifying tags
In order for a user to modify tags and data block tags in the CPU from a watch table, you must
configure the watch table in the Web server properties in the STEP 7 device configuration, and
you must make it have Read/Write access. By so doing, you can restrict the tags to which a user
with the "write tags" privilege can modify to only those tags in the configured Web server watch
tables.
The Tag Status (Page 833) page on the other hand allows any user with the "write tag status"
privilege to write to any tag or data block tag in the CPU.
By careful configuration of the Web server user management privileges (Page 808), you can help
safeguard access to your PLC data.
See also
Rules for entering tag names and values (Page 888)
If you have accessed the Online backup page through one of the Web-enabled CP modules, you
can perform a backup but you cannot restore.
Note
You can also perform backup and restore operations from STEP 7 (Page 1176). Refer to these
topics for a full description of what data you can back up and restore. The SIMATIC Automation
Tool (SAT) also provides backup and restore capability.
When you back files up from the Web server, your PC or device saves the backup files in the
default folder for downloads. When you back files up from STEP 7, STEP 7 stores the files within
the STEP 7 project. You cannot restore STEP 7 backup files from the Web server and you cannot
restore Web server backup files from STEP 7. You can, however, save STEP 7 backup files directly
to the download folder of your PC or device. If you do so, then you can restore these files from
the Web server.
Backup PLC
From the Backup PLC section of the page, click the "Create online backup" button to make a
backup of the project that is currently stored in the PLC. This function requires the "Backup CPU"
user privilege (Page 808). If the CPU is in RUN mode and you have to change it to STOP mode,
you also need the "Change operating mode" privilege. The PC or device will store the backup file
at the default location for downloads. Depending on your browser and device settings, you
might be prompted about saving the file.
Restore PLC
From the Restore PLC section of the page, enter the Web server user password and click the
"Browse" or "Choose File" button (depending on your browser) to select a previously-saved
backup file. Click the "Load online backup" button and confirm the prompt to load this file in the
connected PLC. This page requires the "Restore CPU" user privilege (Page 808). If the CPU is in
RUN mode and you have to change it to STOP mode, you also need the "Change operating mode"
privilege.
As the restore operation proceeds, you see a series of progress messages and you must reenter
your user login and password. After each step of the process completes successfuly, you see the
following completion indicators and a link to reload the page:
WARNING
Restoring backups with unknown content
If you restore a backup with unknown content, you can cause serious damage or injuries in case
of malfunctions or program errors.
In addition, if you restore a backup that does not have the Web server enabled in the device
configuration of the CPU, you will not be able to access the CPU from the Web server.
Make sure that the backup consists of a configuration with known content.
Note
Restoring a backup where the CPU IP address is different
If you attempt to restore a backup where the CPU IP address in the backup is different from the
IP address of the current CPU, the Web server cannot display the message that the restore is
complete. After you see the "Reset CPU" message for greater than five minutes, enter the new IP
address that corresponds to the address in the backup file. The CPU now has this address and you
can resume Web server access.
Note
Data log management
Keep no more than 1000 data logs in a file system. Exceeding this number can prevent the Web
server from having enough CPU resources to display the data logs.
If you find that the Data Logs Web page is not able to display the data logs, then you must place
the CPU in STOP mode in order to display and delete data logs.
Manage your data logs to ensure that you only keep the number that you need to maintain, and
do not exceed 1000 data logs.
Active state
The "Active" column on the Data Logs page shows "Yes" when there is a data log control block
on the CPU associated with that file, and "No" when one does not exist. You can set the active
state to "Yes" even if the STEP 7 program is not currently interacting with the file.
If the STEP 7 program has a data log open or is writing to a data log, the Web server is unable to
delete, download, or retrieve and clear the data log file. In addition, while the Web server is
performing a download of a data log either through a download or a Retrieve and Clear, you can
perform no other data log operation until the download is completed or cancelled. The Web
server displays an "Application Busy" error message.
Note
Data logs error message
The Web server 's auto-refresh functionality does not remove the error message from the page.
The following scenarios generate error messages on the Data Logs page:
See also
Web server (Page 803)
The file list includes the file’s current size and the date of last modification. The list of files is
populated from the "User Files" directory in the root of the SMC.
Note
User file management
Keep no more than 1000 user files on the SMC. If more files are present, the Web server only
allows you to view the first 1,000 files. Files are displayed in ascending, case-insensitive,
alphabetical order.
The error message remains on the page until you initiate an operation to reload the User Files
page. the following operations cause the Web server to reload the User Files page:
• Refreshing the User Files page or navigating away and returning to the User Files page
• Changing the current user files pagination selection
• Successfully deleting a user file
• Successfully uploading a user file
Note
User files error message
The Web server's auto-refresh functionality does not remove an error message from the User
Files page.
The following scenarios generate error messages on the User Files page:
To upload a user file, select the file and click the "Upload file" to begin transferring the file from
your computer to your PLC. Before the transfer begins, the following preconditions must be met:
Requirement Message
A file must be selected Please enter a file name
The file name must be valid Allowed characters are a to z, 0 to 9, (){}[]$!=~
(space)
The file must be less than 2 GB in size (file system Error while uploading the file - file too big
limitation).
See also
Web server (Page 803)
Recipe files
The recipe folder displays any recipe files that are present in load memory. Recipe files are also
in CSV format, and you can open them in Microsoft Excel, or another program. You must have
modify privileges in order to delete, modify and save, rename or upload recipe files.
Additional information
Note
File name conventions
In order for the Web server to work with data log and recipe files, the characters in the file names
must be from the ASCII character set with the exception of the characters \ / : * ? " < > | and the
space character.
If your files are not compliant with this naming convention, the Web server can have errors in
operations such as file upload, deletion or renaming. In this case, you might need to use a card
reader and the Windows file explore to rename files that were on external load memory.
For information on programming with the data log instructions, and importing (Page 459) and
exporting (Page 457) recipes, see the Recipes and Data logs (Page 453) chapter.
See also
Importing CSV format data logs to non-USA/UK versions of Microsoft Excel (Page 888)
WARNING
Unauthorized access to the CPU through user-defined Web pages
Unauthorized access to the CPU through user-defined Web pages could disrupt process
operation, which could result in death, severe personal injury and/or property damage.
Insecure coding of user-defined Web pages introduces security vulnerabilites such as cross-site
scripting (XSS), code injection, and others.
Protect your S7‑1200 CPU from unauthorized access by installing it in a secure fashion as
outlined in the Operational Guidelines found on the Industrial Security Web site (https://
www.siemens.com/industrialsecurity).
You create user-defined Web pages using the HTML editor of your choice and download them to
the CPU where they are accessible from the standard Web page menu. This process involves
several tasks:
• Creating HTML pages with an HTML editor, such as Microsoft Frontpage (Page 848)
• Including AWP commands in HTML comments in the HTML code (Page 849):The AWP
commands are a fixed set of commands that Siemens provides for accessing CPU information.
• Configuring STEP 7 to read and process the HTML pages (Page 862)
• Generating blocks from the HTML pages (Page 862)
• Programming STEP 7 to control the use of the HTML pages (Page 864)
• Compiling and downloading the blocks to the CPU (Page 865)
• Accessing the user-defined Web pages from your PC (Page 866)
This process is illustrated below:
See also
Web server (Page 803)
To program your HTML code to use data from the S7-1200, you include AWP commands
(Page 849) as HTML comments. When finished, save your HTML pages to your PC and note the
folder path where you save them.
Note
The file size limit for HTML files containing AWP commands is 64 kilobytes. You must keep your
file size below this limit for STEP 7 to be able to successfully compile your pages.
Siemens recommends that all Web resource files (.ccc files, images, JavaScript files, and html
files) are created with a size not exceeding 512 KB; otherwise, problems can occur when sending
the file from the Web server to the browser. You can view the size of the respective Web resource
file in the file explorer of the directory.
The S7-1200 Web server provides AWP commands that you embed in your user-defined Web
pages as HTML comments for the following purposes:
• Reading variables (Page 851)
• Writing variables (Page 851)
• Reading special variables (Page 853)
• Writing special variables (Page 854)
• Defining enum types (Page 856)
• Assigning variables to enum types (Page 857)
• Creating fragment data blocks (Page 858)
General syntax
Except for the command to read a variable, the AWP commands are of the following syntax:
<!-- AWP_ <command name and parameters> -->
You use the AWP commands in conjunction with typical HTML form commands to write to
variables in the CPU.
The descriptions of the AWP commands in the following pages use the following conventions:
• Items enclosed in brackets [ ] are optional.
• Items enclosed in angle brackets < > are parameter values to be specified.
• Quotation marks are a literal part of the command. They must be present as indicated.
• Special characters in tag or data block names, depending on usage, must be escaped or
enclosed in quotation marks (Page 860).
Use a text editor or HTML editing mode to insert AWP commands into your pages.
Note
Expected syntax of AWP commands
The space after "<!--" and the space before "-->" in the formulation of an AWP command are
essential to proper compiling of the command. Omission of the space characters can cause the
compiler to be unable to generate the proper code. The compiler does not display an error in this
case.
Syntax
:=<Varname>:
Parameters
<Varname> The variable to be read, which can be a PLC tag name from your STEP 7 program, a data
block tag, I/O, or addressable memory. For memory or I/O addresses or alias names
(Page 860), do not use quotation marks around the tag name. For PLC tags, use
double quotation marks around the tag name. For data block tags, enclose the block
name only in double quotation marks. The tag name is outside of the quotation marks.
Note that you use the data block name and not a data block number. Reference array
elements using array element syntax.
Examples
:="Conveyor_speed":
:="My_Data_Block".flag1:
:=I0.0:
:=MW100:
:="My_Data_Block".Array_Dim1[0]:
:="My_Data_Block".Array_Dim2[0,0]:
Note
Defining alias names for PLC tags and data block tags is described in the topic Using an alias for
a variable reference (Page 856).
If a tag name or data block name includes special characters, you must use additional quotation
marks or escape characters as described in the topic Handling tag names that contain special
characters (Page 860).
blocks from STEP 7 such that they are included in your STEP 7 program. When a user with
privileges to modify variables subsequently accesses this page and types data into the input
fields or selects a choice from a select list, the Web server converts the input to the appropriate
data type for the variable, and writes the value to the variable in the CPU. Note that the name
clause for HTML input fields and HTML select lists uses syntax typical for the name clause of the
AWP_In_Variable command. Typically enclose the name in single quotation marks and if you
reference a data block, enclose the data block name in double quotation marks.
For form management details, refer to documentation for HTML.
Syntax
<!-- AWP_In_Variable Name='<Varname1>' [Use='<Varname2>'] ... -->
Parameters
<Varname1> If no Use clause is provided, Varname1 is the variable to be written. It can be a PLC tag
name from your STEP 7 program, a tag from a specific data block, or a data block name.
If a Use clause is provided, Varname1 is an alternate name for the variable referenced
in <Varname2> (Page 856). It is a local name within the HTML page.
<Varname2> If a Use clause is provided, Varname2 is the variable to be written. It can be a PLC tag
name from your STEP 7 program or a tag from a specific data block.
For both Name clauses and Use clauses, the complete name must be enclosed in single
quotation marks. Within the single quotes, use double quotation marks around a PLC tag and
double quotation marks around a data block name. The data block name is within the double
quotes but not the data block tag name. Note that for data block tags, you use the name of the
block and not a data block number. Reference array elements using array element syntax.
If you use an AWP_In_Variable command to make a data block writable, then every tag in the
data block is writable.
Note
Only a user with the "Write in user-defined pages" privilege (Page 808) can write data to the CPU.
The Web server ignores the commands if the user does not have modify privileges.
If a tag name or data block name includes special characters, you must use additional quotation
marks or escape characters as described in the topic "Handling tag names that contain special
characters (Page 860)".
Syntax
<!-- AWP_Out_Variable Name='<Type>:<Name>' [Use='<Varname>'] -->
Parameters
If a tag name or data block name includes special characters, you must use additional quotation
marks or escape characters as described in the topic Handling tag names that contain special
characters (Page 860).
Syntax
<!-- AWP_In_Variable Name='<Type>:<Name>' [Use='<Varname>']-->
Parameters
Examples
<!-- AWP_In_Variable Name='"SERVER:current_user_id"' -->
In this example, the Web page writes the value of the HTTP special variable
"SERVER:current_user_id" to the PLC tag named "SERVER:current_user_id ".
<!-- AWP_In_Variable Name=SERVER:current_user_id' Use='"my_userid"'
-->
In this example, the Web page writes the value of the HTTP special variable
"SERVER:current_user_id" to the PLC tag named "my_userid".
Note
Only a user with privileges to modify variables can write data to the CPU. The Web server ignores
the commands if the user does not have modify privileges.
If a tag name or data block name includes special characters, you must use additional quotation
marks or escape characters as described in the topic "Handling tag names that contain special
characters (Page 860)".
Syntax
<-- AWP_In_Variable Name='<Varname1>' Use='<Varname2>' -->
<-- AWP_Out_Variable Name='<Varname1>' Use='<Varname2>' -->
Parameters
Examples
<-- AWP_In_Variable Name='SERVER:current_user_id'
Use='"Data_Block_10".server_user' -->
In this example, the special variable SERVER:current_user_id is written to the tag "server_user"
in data block "Data_Block_10".
<-- AWP_Out_Variable Name='Weight'
Use='"Data_Block_10".Tank_data.Weight' -->
In this example, the value in data block structure member Data_Block_10.Tank_data.Weight can
be referenced simply by "Weight" throughout the rest of the user-defined Web page.
<-- AWP_Out_Variable Name='Weight' Use='"Raw_Milk_Tank_Weight"' -->
In this example, the value in the PLC tag "Raw_Milk_Tank_Weight" can be referenced simply by
"Weight" throughout the rest of the user-defined Web page.
If a tag name or data block name includes special characters, you must use additional quotation
marks or escape characters as described in the topic Handling tag names that contain special
characters (Page 860).
Syntax
<!-- AWP_Enum_Def Name='<Enum type name>' Values='<Value>,
<Value>,... ' -->
Parameters
<Enum type Name of the enumerated type, enclosed in single or double quotation marks.
name>
<Value> <constant>:<name>
The constant indicates the numerical value for the enum type assignment. The total
number is unbounded.
The name is the value assigned to the enum element.
Note that the entire string of enum value assignments is enclosed in single quotation marks, and
each individual enum type element assignment is enclosed in double quotation marks. The
scope of an enum type definition is global for the user-defined Web pages. If you have set up your
user-defined Web pages in language folders (Page 878), the enum type definition is global for
all pages in the language folder.
Example
<!-- AWP_Enum_Def Name='AlarmEnum' Values='0:"No alarms", 1:"Tank is
full", 2:"Tank is empty"' -->
Syntax
<!-- AWP_In_Variable Name='<Varname>' Enum="<EnumType>" -->
<!-- AWP_Out_Variable Name='<Varname>' Enum="<EnumType>" -->
Parameters
<Varname> Name of PLC tag or data block tag to associate with the enum type, or the name of
the alias name for a PLC tag (Page 856) if declared.
Varname must be enclosed in single quotation marks. Within the single quotes, use
double quotation marks around a PLC tag or data block name. Note that for data block
tags, you use the name of the block and not a data block number. The data block name
is within the double quotes but not the data block tag name.
<EnumType> Name of the enumerated type, which must be enclosed in single or double quotation
marks
If the value of "Alarm" in the CPU is 2, the HTML page displays 'The current value of "Alarm" is Tank
is empty' because the enum type definition (Page 856) assigns the text string "Tank is empty" to
the numerical value 2.
Note
Previous releases required a separate AWP_Enum_Ref declaration to associate a variable with a
defined enum type. STEP 7 and the S7-1200 support existing code with AWP_Enum_Ref
declarations; however, this command is no longer needed.
Syntax
<!-- AWP_Start_Fragment Name='<Name>' [Type=<Type>][ID=<id>]
[Mode=<Mode>] -->
Parameters
Manual fragments
If you create a manual fragment for a user-defined Web page or portion of a page, then your
STEP 7 program must control when the fragment is sent. The STEP 7 program must set
appropriate parameters in the control DB for a user-defined page under manual control and then
call the WWW instruction with the control DB as modified. For understanding the structure of the
control DB and how to manipulate individual pages and fragments, see the topic Advanced user-
defined Web page control (Page 881).
Syntax
<!-- AWP_Import_Fragment Name='<Name>' -->
Parameters
Example
Excerpt from HTML code that creates a fragment to display an image:
<!-- AWP_Start_Fragment Name='My_company_logo' --><p><img
src="company_logo.jpg"></p>
Excerpt from HTML code in another .html file that imports the fragment that displays the logo
image:
<!-- AWP_Import_Fragment Name='My_company_logo' -->
Both .html files (the one that creates the fragment and the one that imports it) are in the folder
structure that you define when you configure the user-defined pages in STEP 7 (Page 862).
Examples
<!-- AWP_In_Variable Name='"Level"' Name='"Weight"' Name='"Temp"' -->
<!-- AWP_Out_Variable Name='HEADER:Status' Use='"Status"'
Name='HEADER:Location' Use="Location"
Name='COOKIE_VALUE:name' Use="my_cookie" -->
<!-- AWP_In_Variable Name='Alarm' Use='"Data_block_10".Alarm' -->
Reading variables
You use the following syntax to read a variable (Page 851):
:=<Varname>:
The following rules apply to reading variables:
• For variable names from the PLC tag table, enclose the tag name in double quotation marks.
• For variable names that are data block tags, enclose the data block name in double quotation
marks. The tag is outside of the quotation marks.
• For variable names that are direct I/O addresses, memory addresses, or alias names, do not
use quotation marks around the read variable.
• For tag names or data block tag names that contain a backslash, precede the backslash with
another backslash.
• If a tag name or data block tag name contains a colon, less than sign, greater than sign, or
ampersand define an alias that has no special characters for the read variable, and read the
variable using the alias. Precede colons in tag names in a Use clause with a backslash.
Note
Regardless of what characters you use in your HTML page, set the charset of the HTML page to
UTF-8 and save it from the editor with UTF-8 character encoding.
8. In the Advanced section, enter filename extensions of files that include AWP commands. By
default, STEP 7 analyzes files with .htm, .html, or .js extensions. If you have additional file
extensions, append them. To save processing resources, do not enter file extensions if no
files of that type include AWP commands.
9. Keep the default for the Web DB number, or enter a number of your choice. This is the DB
number of the control DB that controls display of the Web pages.
10.Keep the default for the fragment DB start number, or enter a number of your choice. This is
the first of the fragment DBs that contains the Web pages.
After you have completed configuration and downloaded the project to the CPU, the Web server
can use the "Default HTML page" that you selected when you configured your user-defined Web
pages (Page 862) as the entry page.
Note
The CPU must be in RUN mode to display a user-defined entry page.
You must provide the control data block input parameter (CTRL_DB) which corresponds to the
integer DB number of the control DB. You can find this control DB block number (called Web DB
Number) in the Web Server properties of the CPU after you create the blocks for the user-
defined Web pages. Enter the integer DB number as the CTRL_DB parameter of the WWW
instruction. The return value (RET_VAL) contains the function result. Note that the WWW
instruction executes asynchronously and that the RET_VAL output might have an initial value of
0 although an error can occur later. The program can check the state of the control DB to ensure
that the application started successfully, or check RET_VAL with a subsequent call to WWW.
RET_VAL Description
0 No error
16#00yx x: The request represented by the respective bit is in the waiting state:
x=1: request 0
x=2: request 1
x=4: request 2
x=8: request 3
The x values can be logically OR-ed to represent waiting states of multiple requests. If x = 6, for
example, requests 1 and 2 are waiting.
y: 0: no error; 1: error exists and "last_error" has been set in the control DB (Page 881)
16#803a The control DB is not loaded.
16#8081 The control DB is of the wrong type, format, or version.
16#80C1 No resources are available to initialize the web application.
Note
You can also define a user-defined page as the entry page (Page 863) for the Web server.
You can check the amount of load memory space that is used and the amount that is available
from the Online and Diagnostic tools in STEP 7. You can also look at the properties for the
individual blocks that STEP 7 generates from your user-defined Web pages and see the load
memory consumption.
Note
If you need to reduce the space required for your user-defined Web pages, reduce your use of
images if applicable.
Description
In this application, each wind turbine in a wind turbine farm is equipped with an S7-1200 for
control of the turbine. Within the STEP 7 program, each wind turbine has a data block with data
specific to that wind turbine.
The user-defined Web page provides remote turbine access from a PC. A user can connect to
standard web pages of the CPU of a particular wind turbine and access the user-defined "Remote
Wind Turbine Monitor" Web page to see the data for that turbine. A user with privileges to modify
variables can also put the turbine in manual mode and control the variables for turbine speed,
yaw, and pitch from the Web page. A user with privileges to modify variables can also set a
braking value regardless of whether the turbine is under manual or automatic control.
The STEP 7 program would check the Boolean values for overriding automatic control, and if set,
would use the user-entered values for turbine speed, yaw, and pitch. Otherwise, the program
would ignore these values.
Files used
This user-defined Web page example consists of three files:
• Wind_turbine.html: This is the HTML page that implements the display shown above, using
AWP commands to access controller data.
• Wind_turbine.css: This is the cascading style sheet that contains formatting styles for the
HTML page. Use of a cascading style sheet is optional, but it can simplify the HTML page
development.
• Wind_turbine.jpg: This is the background image that the HTML page uses. Use of images in
user-defined Web pages is, of course, optional, and does require additional space in the CPU.
These files are not provided with your installation, but are described as an example.
Implementation
The HTML page uses AWP commands to read values from the PLC (Page 851) for the display
fields and to write values to the PLC (Page 851) for data coming from user input. This page also
uses AWP commands for enum type definition (Page 856) and reference (Page 857) for handling
ON/OFF settings.
The first part of the page displays a header line that includes the wind turbine number.
Note
Note that if a user-defined page has a data entry field for a writable data block tag that is a string
data type, the user must enclose the string in single quotation marks when entering the string
value in the field.
Note
Note that if you declare an entire data block in an AWP_In_Variable declaration such as <!--
AWP_In_Variable Name='"Data_block_1"' -->, then every tag within that data block can be
written from the user-defined Web page. Use this when you intend for all of the tags in a data
block to be writable. Otherwise, if you only want specific data block tags to be writable from the
user-defined Web page, declare it specifically with a declaration such as <!-- AWP_In_Variable
Name='"Data_block_1".Braking' -->
12.8.9.6 Reference: HTML listing of remote wind turbine monitor Web page
Wind_turbine.html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"https://www.w3.org/TR/html4/loose.dtd">
<!--
This test program simulates a Web page to monitor and control a Wind
Turbine
Required PLC tags and Data Block Tags in STEP 7:
PLC Tag:
User_ID: Int
Data Blocks:
Data_block_1
Tags in Data_Block_1:
TurbineNumber: Int
WindSpeed: Real
WindDirection: Real
Temperature: Real
PowerOutput: Real
ManualOverrideEnable: Bool
TurbineSpeed: Real
YawOverride: Bool
Yaw: Real
PitchOverride: Bool
Pitch: Real
Braking: Real
The user-defined Web page displays current values for the PLC data,
and provides a select list to set the three Booleans using an
enumerated type assignment. The "Submit" button posts the selected
Boolean values as well as the data entry fields for TurbineSpeed,
Yaw, and Pitch. The value for Braking can be set without use of the
"Submit" button.
<html>
<head>
<meta http-equiv="content-type" content="text/html;
charset=utf-8"><link rel="stylesheet" href="Wind_turbine.css">
<title>Remote Wind Turbine Monitor</title>
</head>
<body>
<table cellpadding="0" cellspacing="2">
<tr style="height: 2%;">
<td colspan="2">
<h2>Remote Wind Turbine Monitor: Turbine
#:="Data_block_1".TurbineNumber:</h2>
</td>
<select name='"Data_block_1".ManualOverrideEnable'>
<option value=':="Data_block_1".ManualOverrideEnable:'> </option>
<option value="On">Yes</option>
<option value="Off">No</option>
</select>
</td>
</tr>
<select name='"Data_block_1".YawOverride'>
<option value=':="Data_block_1".YawOverride:'> </option>
<option value="On">Yes</option>
<option value="Off">No</option>
</select>
</td>
</tr>
<select name='"Data_block_1".PitchOverride'>
<option value=':="Data_block_1".PitchOverride:'> </option>
<option value="On">Yes</option>
<option value="Off">No</option>
</select>
</td>
</tr>
</tr>
<tr style="height: 2%;">
<td colspan="2">
<input type="submit" value="Submit override settings and values">
</td>
</tr>
</form>
</table>
</body>
</html>
Wind_turbine.css
BODY {
background-image: url('./Wind_turbine.jpg');
background-position: 0% 0%;
background-repeat: no-repeat;
background-size: cover;
}
H2 {
font-family: Arial;
font-weight: bold;
font-size: 14.0pt;
color: #FFFFFF;
margin-top:0px;
margin-bottom:10px;
}
P {
font-family: Arial;
font-weight: bold;
color: #FFFFFF;
font-size: 12.0pt;
margin-top:0px;
margin-bottom:0px;
}
TD.Text {
font-family: Arial;
font-weight: bold;
color: #FFFFFF;
font-size: 12.0pt;
margin-top:0px;
margin-bottom:0px;
}
Configuration fields
• HTML directory: This field specifies the fully-qualified pathname to the folder where the
default page (home page or start page) is located on the computer. The "..." button allows
you to browse to the folder that you need.
• Default HTML page: This field specifies the filename of the default page or home page of the
HTML application. The "..." button allows you to select the file that you need. For this
example, WindTurbine.html is the default HTML page. The Remote Wind Turbine Monitor
example only consists of a single page, but in other user-defined applications the default
page can call up additional pages from links on the default page. Within the HTML code, the
default page must reference other pages relative to the HTML source folder.
• Application name: This optional field contains the name that the Web browser includes in the
address field when displaying the page. For this example, it is "Remote Wind Turbine
Monitor", but you can use any name.
No other fields require configuration.
Final steps
To use the Remote Wind Turbine Monitor as configured, generate the blocks, program the WWW
instruction (Page 864) with the number of the generated control DB as an input parameter,
download the program blocks, and put the CPU in run mode.
When an operator subsequently accesses the standard Web pages for the S7-1200 that controls
the wind turbine, the "Remote Wind Turbine Monitor" Web page is accessible from the "User-
defined pages" link on the navigation bar. This page now provides the means to monitor and
control the wind turbine.
The Web server provides the means for you to provide user-defined Web pages in the following
languages:
• German (de)
• English (en)
• Spanish (es)
• French (fr)
• Italian (it)
• Simplified Chinese (zh)
You do this by setting up your HTML pages in a folder structure (Page 878) that corresponds to
the languages and by setting a specific cookie named "siemens_automation_language" from
your pages (Page 879). The Web server responds to this cookie, and switches to the default
page in the corresponding language folder.
de: German
en: English
es: Spanish
fr: French
it: Italian
zh: Simplified Chinese
At the same level, you can also include any other folders that your pages need, for example,
folders for images or scripts.
You can include any subset of the language folders. You do not have to include all six languages.
Within the language folders, you create and program your HTML pages in the appropriate
language.
Example
The following example uses a default HTML page named "langswitch.html" in each of the
language folders. Also in the HTML directory is a folder named "script". The script folder includes
a JavaScript file named "lang.js". Each langswitch.html page uses this JavaScript to set the
language cookie, "siemens_automation_language".
Note
If your user-defined Web page implementation includes HTML files within language-specific
folders (en, de, for example) and also HTML files that are not in the language-specific folders,
note that you cannot define enum types with the AWP_Enum_Def command in files in both
locations. If you use enums, you must define them either within files in the language -specific
folders or within files outside of the language-specific folders. You cannot make enum
declarations in files in both places.
For example, if the folder structure shown here was at C:\, the setting
for HTML directory would be C:\html, and if English were to be the
initial page display, you would navigate to en\langswitch.html for the
default HTML page setting.
If you want to turn a web application on and off, for example, or manipulate individual manual
fragments, you use the control DB tags and the WWW instruction to do so.
Commandstate structure
"Commandstate" is a structure that contains global commands and global states for the Web
server.
Global commands in the "Commandstate" structure
The global commands apply to the Web server in general. You can deactivate the Web server or
restart it from the control DB parameters.
Request table
The request table is an array of structures containing commands and states that apply to
individual fragment DBs. If you created fragments with the AWP_Start_Fragment (Page 858)
command of type "manual", the STEP 7 user program must control these pages through the
control DB. The request states are read-only and provide information about the current
fragment. You use the request commands to control the current fragment.
Operation
Whenever your program makes changes to the control DB, it must call the WWW instruction with
the number of the modified control DB as its parameter. The global commands and request
commands take effect when the STEP 7 user program executes the WWW instruction (Page 864).
The STEP 7 user program can set the fragment_index explicitly, thus causing the Web server to
process the specified fragment with a request command. Otherwise, the Web server processes
the current fragment for the current page when the WWW instruction executes.
Possible techniques for using the fragment_index include:
• Processing the current fragment: Leave fragment_index unchanged and set the continue
command.
• Skip the current fragment: Set fragment_index to 0 and set the continue command.
• Replace current fragment with a different fragment: Set the fragment_index to the new
fragment ID and set the continue command.
To check global states or request states that might be changing, the STEP 7 user program must
call the WWW instruction to evaluate the current values of these states. A typical usage might be
to call the WWW instruction periodically until a specific state occurs.
Note
If the STEP 7 user program sets more than one request command, the WWW instruction
processes only one in this order of precedence: abort, finish, repeat, continue. The WWW
instruction clears all of the request commands after processing.
Examples
The following example shows a STEP 7 user program that is checking for a fragment with an ID
of 1 to be in the waiting state, following a prior call to the WWW instruction. It might also wait
for other application-specific conditions to occur. Then it performs whatever processing is
necessary for the fragment, such as setting data block tags, performing calculations, or other
application-specific tasks. Afterwards, it sets the continue flag so that the Web server will
execute this fragment.
When the program calls the WWW instruction with this modified control DB, the user-defined
Web page with this fragment can be displayed from the Web browser.
Note that this is a simplified example; the fragment to check could be in any one of the four
requesttab structs in the array. Your program must handle all four requesttab structs.
Data type
ARRAY
BCD16
BCD32
VARIANT
REMOTE
HW_DEVICE
TP_TIME
TON_TIME
TOF_TIME
TONR_TIME
CTU_SINT
CTU_INT
CTU_DINT
CTU_USINT
CTU_UINT
CTU_UDINT
CTD_SINT
CTD_INT
CTD_DINT
CTD_USINT
CTD_UINT
CTD_UDINT
CTUD_SINT
CTUD_INT
CTUD_DINT
CTUD_USINT
CTUD_UINT
CTUD_UDINT
You can find the S7‑1500 Web API supported data types here: Web pages > Application
Programming Interface (API) > Read and write process data > Supported data types in this
document (https://support.industry.siemens.com/cs/us/en/view/59193560).
12.9 Constraints
The following IT considerations can affect your use of the Web server:
• Typically, you must use the IP address of the CPU to access the standard Web pages or user-
defined Web pages, or the IP address of a wireless router with a port number. If your Web
browser does not allow connecting directly to an IP address, see your IT administrator. If your
local policies support DNS, you can connect to the IP address through a DNS entry to that
address.
• Firewalls, proxy settings, and other site-specific restrictions can also restrict access to the
CPU. See your IT administrator to resolve these issues.
• The standard Web pages use JavaScript and cookies. If your Web browser settings disable
JavaScript or cookies, enable them. If you cannot enable them, some features are restricted
(Page 887). Use of JavaScript and cookies in user-defined Web pages is optional. If used, you
must enable them in your browser.
• The Web server supports Secure Sockets Layer (SSL). You can access the standard Web pages
and user-defined Web pages with an URL of either https://ww.xx.yy.zz or https://ww.xx.yy.zz,
where "ww.xx.yy.zz" represents the IP address of the CPU.
• Siemens provides a security certificate for secure access to the Web server. From
the Introduction standard Web page (Page 821), you can download and import the
certificate into the Internet options of your Web browser (Page 813). If you choose to not
import the certificate, you will get a security verification prompt every time you access the
Web server with https://.
Number of connections
The Web server supports a maximum of 30 active connections. Various actions consume the 30
connections, depending on the Web browser that you use and the number of different objects
per page (.css files, images, JavaScript files, additional .html files). Some connections persist
while the Web server is displaying a page; other connections do not persist after the initial
connection.
If, for example, you are using certain versions of Mozilla Firefox, which support a maximum of
six persistent connections, you could use five browser or browser tab instances before the Web
server starts dropping connections. In the case where a page is not using all six connections, you
could have additional browser or browser tab instances.
Also be aware that the number of active connections can affect page performance. For this
reason, the Web pages may not load fully.
Note
Log off prior to closing Web server
If you have logged in to the Web server, be sure to log off prior to closing your Web browser. The
Web server supports a maximum of seven concurrent logins.
Failure to log off can leave multiple connections open, depending on your browser. By opening
and closing Web server browser windows multiple times without logging off, you could
consume all of the 30 connections. If you consume all of the connections, you would then
receive an "Invalid login" message when you attempt to log in. You would have to wait up to 30
minutes before the Web server frees up enough connections for you to log in again. To avoid this
problem, always log off before closing the Web server if you have logged in.
See also
Layout of the standard Web pages (Page 816)
12.9.2 Feature restrictions when the Internet options do not allow cookies
If you disable cookies in your Web browser, the following restrictions apply:
• You cannot log in.
• You cannot change the language setting.
• You cannot switch from UTC time to PLC time. Without cookies, all times are in UTC time.
12.9.4 Importing CSV format data logs to non-USA/UK versions of Microsoft Excel
Data log files are in the comma-separated values (CSV) file format. You can open these files
directly in Excel from the Data Logs page when your system is running the USA or UK version of
Excel. In other countries, however, this format is not widely used because commas occur
frequently in numerical notation.
To open a data log file that you have saved, follow these steps for non USA/UK versions of Excel:
1. Open Excel and create an empty workbook.
2. From the "Data > Import External Data" menu, select the "Import Data" command.
3. Navigate to and select the data log file you want to open. The Text Import Wizard starts.
4. From the Text Import Wizard, change the default option for "Original data type" from "Fixed
width" to "Delimited".
5. Click the Next button.
6. From the Step 2 dialog, select the "Comma" check box to change the delimiter type from "Tab"
to "Comma".
7. Click the Next button.
8. From the Step 3 dialog, you can optionally change the Date format from MDY (month/day/
year) to another format.
9. Complete the remaining steps of the Text Import Wizard to import the file.
LED indicators
The communication modules have three LED indicators:
• Diagnostic LED (DIAG): This LED flashes red until it is addressed by the CPU. After the CPU
powers up, it checks for CMs and addresses them. The diagnostic LED begins to flash green.
This means that the CPU has addressed the CM, but has not yet provided the configuration
to it. The CPU downloads the configuration to the configured CMs when the program is
downloaded to the CPU. After a download to the CPU, the diagnostic LED on the
communication module should be a steady green.
• Transmit LED (Tx): The transmit LED illuminates when data is being transmitted out the
communication port.
• Receive LED (Rx): This LED illuminates when data is being received by the communication
port.
The communication board provides transmit (TxD) and receive (RxD) LEDs. It has no diagnostic
LED.
Note
You terminate and bias only the two ends of the RS485 network. The devices in between the two
end devices are not terminated or biased. Bare cable shielding: Approximately 12 mm (1/2 in)
must contact the metal guides of all locations.
1 2 3
2Q 2Q
2II
A1 B1 A2 B2 A1 B1 A2 B2 A1 B1 A2 B2
3 3
① Pin number
② Network connector
③ Cable shield
The CB 1241 provides internal resistors for terminating and biasing the network. To terminate
and bias the connection, connect TRA to TA and connect TRB to TB to include the internal
resistors to the circuit. CB 1241 does not have a 9-pin connector. The following table shows the
connections to a 9-pin connector on the communications partner.
ཱ 7$ ˖ ཱ 7$
75$ $ 75$ $
˖
75% % 75% %
ི ི
7% ˖
7%
For this reason, the S7-1200 supports two sets of PtP instructions:
• Legacy point-to-point instructions (Page 1056): These instructions existed prior to version
V4.0 of the S7-1200 and only work with serial communications using a CM 1241
communication module or CB 1241 communication board.
• Point-to-point instructions (Page 911): These instructions provide all of the functionality of
the legacy instructions, plus the ability to support PtP communication modules over
PROFINET and PROFIBUS distributed I/O. The point-to-point instructions allow you to access
the communication modules over the distributed I/O rack.
The S7‑1200 CM 1241 modules must have a minimum firmware version of V2.1 to use the
point-to-point instructions. These modules are limited to the local rack to the left side of the
S7‑1200 CPU. You can also use the point-to-point instructions with a CB 1241.
Communications over distributed I/O use the following modules:
Note
You can use the point-to-point instructions to access a communication board, local (or left side)
serial modules, serial modules over PROFINET, and serial modules over PROFIBUS. STEP 7
provides the legacy point-to-point instructions only to support existing programs. The legacy
instructions still function, however, with the current S7‑1200 CPUs. You do not have to convert
prior programs from one set of instructions to the other.
Note
CM module firmware version requirement for Time synchronization and PtP
communication
If you have enabled "CPU synchronizes the modules of the device" in the Time synchronization
(Page 161) properties for the Profinet interface in the device configuration, update the firmware
versions of the connected communication modules to the latest available versions. Enabling
module time synchronization for communication modules with old firmware versions can cause
communication issues or errors.
You can also use the legacy point-to-point send and receive instructions:
• SEND_PTP (Transmit send buffer data) (Page 1063)
• RCV_PTP (Enable receive messages) (Page 1065)
You can use either of the following methods to configure the communication interfaces for PtP
Freeport communication:
• Use the device configuration in STEP 7 to configure the port parameters (baud and parity), the
send parameters and the receive parameters. The CPU stores the device configuration
settings and applies the settings after a power cycle and a RUN to STOP transition.
• Use the Port_Config (Page 913), Send_Config (Page 916), and Receive_Config
(Page 918) instructions to set the parameters. The port settings set by the instructions are
valid while the CPU is in RUN mode. The port settings revert to the device configuration
settings after a STOP transition or power cycle.
After configuring the hardware devices (Page 127), you configure parameters for the
communication interfaces by selecting one of the CMs in your rack or the CB, if configured.
For the CM 1241 RS232 and CB RS485 (except for flow control (Page 899), which only the
CM 1241 RS232 supports), the port configuration parameters are the same regardless of
whether you are configuring an RS232 or an RS485 communication module or the RS485
communication board. The parameter values can differ.
For the CM 1241 RS422/485, you have additional options for port configuration as shown below.
The 422 mode of the CM 1241 RS422/485 module also supports software flow control.
Parameter Definition
Baud rate The default value for the baud rate is 9.6 Kbits per second. Valid choices are: 300 baud, 600
baud, 1.2 Kbits, 2.4 Kbits, 4.8 Kbits, 9.6 Kbits, 19.2 Kbits, 38.4 Kbits, 57.6 Kbits, 76.8 Kbits, and
115.2 Kbits.
Parity The default value for parity is no parity. Valid choices are: No parity, even, odd, mark (parity bit
always set to 1), and space (parity bit always set to 0).
Data bits per character The number of data bits in a character. Valid choices are 7 or 8.
Number of stop bits The number of stop bits can be either one or two. The default is one.
Flow control For the RS232 communication module, you can select either hardware or software flow control
(Page 899). If you select hardware flow control, you can select whether the RTS signal is
always on, or RTS is switched. If you select software flow control, you can define the XON and
XOFF characters.
The RS485 communication interfaces do not support flow control. The 422 mode of the CM
1241 RS422/485 module supports software flow control.
Wait time Wait time specifies the time that the CM or CB waits to receive CTS after asserting RTS, or for
receiving an XON after receiving an XOFF, depending on the type of flow control. If the wait
time expires before the communication interface receives an expected CTS or XON, the CM or
CB aborts the transmit operation and returns an error to the user program. You specify the wait
time in milliseconds. The range is 0 to 65535 milliseconds.
Operating mode This selects the operating mode RS422 or RS485 and network configurations.
Receive line initial state This selects the bias options. Valid values are none, forward bias and reverse bias. Reverse bias
is used to allow cable break detection.
Data Terminal Ready (DTR) and Data Set Ready (DSR) signal utilization
The CM sets DTR active for either type of hardware flow control. The module transmits only when
the DSR signal becomes active. The state of DSR is only evaluated at the start of the send
operation. If DSR becomes inactive after transmission has started, the transmission will not be
paused.
You can also dynamically configure or change the transmit message parameters from the user
program by using the Send_Config (Page 916) instruction.
Note
Parameter values set from the Send_Config instruction in the user program override the
"Transmit message configuration" properties. Note that the CPU does not retain parameters set
from the Send_Config instruction in the event of power down.
Parameter Definition
RTS On delay Specifies the amount of time to wait after activating RTS before transmission is initiated. The
range is 0 to 65535 ms, with a default value of 0. This parameter is valid only when the port
configuration (Page 897) specifies hardware flow control. CTS is evaluated after the RTS On
delay time has expired.
This parameter is applicable for RS232 modules only.
RTS Off delay Specifies the amount of time to wait before de-activating RTS after completion of transmission.
The range is 0 to 65535 ms, with a default value of 0. This parameter is valid only when the port
configuration (Page 897) specifies hardware flow control.
This parameter is applicable for RS232 modules only.
Send break at message start Specifies that upon the start of each message, a break will be sent after the RTS On delay (if
Number of bit times in a break configured) has expired and CTS is active.
You specify how many bit times constitute a break where the line is held in a spacing condition.
The default is 12 and the maximum is 65535, up to a limit of eight seconds.
Send idle line after a break Specifies that an idle line will be sent before message start. It is sent after the break, if a break is
Idle line after a break configured. The "Idle line after a break" parameter specifies how many bit times constitute an
idle line where the line is held in a marking condition. The default is 12 and the maximum is
65535, up to a limit of eight seconds.
You can also dynamically configure or change the receive message parameters from the user
program by using the Receive_Config instruction (Page 918).
Note
Parameter values set from the Receive_Config instruction in the user program override the
"Receive message configuration" properties. Note that the CPU does not retain parameters set
from the RCV_CFG instruction in the event of power down or transition to STOP.
Parameter Definition
Start on Any Character The Any Character condition specifies that any successfully received character indicates the start
of a message. This character is the first character within a message.
Line Break The Line Break condition specifies that a message receive operation starts after a break character
is received.
Idle Line The Idle Line condition specifies that a message reception starts once the receive line has been
idle or quiet for the number of specified bit times. Once this condition occurs, the start of a
message begins.
ཱ ཱ ི
① Characters
② Restarts the idle line timer
③ Idle line is detected and message receive is started
Special condition: Specifies that a particular character indicates the start of a message. This character is then the
Recognize message start first character within a message. Any character that is received before this specific character is
with single character discarded. The default character is STX.
Special condition: Specifies that a particular character sequence from up to four configured sequences indicates
Recognize message start the start of a message. For each sequence, you can specify up to five characters. For each
with a character sequence character position, you specify either a specific hex character, or that the character is ignored in
sequence matching (wild-card character). The last specific character of a character sequence
terminates that start condition sequence.
Incoming sequences are evaluated against the configured start conditions until a start condition
has been satisfied. Once the start sequence has been satisfied, evaluation of end conditions
begins.
You can configure up to four specific character sequences. You use a multiple-sequence start
condition when different sequences of characters can indicate the start of a message. If any one
of the character sequences is matched, the message is started.
While checking for multiple start conditions, if one of the conditions is not met, the CM or CB will
restart the checking with the first required condition. After the CM or CB establishes that the start
conditions have been met, it begins evaluating end conditions.
With this configuration, the start condition is satisfied when either pattern occurs:
• When a five-character sequence is received where the first character is 0x6A and the fifth
character is 0x1C. The characters at positions 2, 3, and 4 can be any character with this
configuration. After the fifth character is received, evaluation of end conditions begins.
• When two consecutive 0x6A characters are received, preceded by any character. In this case,
evaluation of end conditions begins after the second 0x6A is received (3 characters). The
character preceding the first 0x6A is included in the start condition.
Example sequences that would satisfy this start condition are:
• <any character> 6A 6A
• 6A 12 14 18 1C
• 6A 44 A5 D2 1C
message will end if the message takes longer than 300 milliseconds to receive, or if the gap
between any two characters exceeds 40 bit times, or if 50 bytes are received.
Parameter Definition
Recognize message end by The message end occurs when the configured amount of time to wait for the message end has
message timeout expired. The message timeout period begins when a start condition has been satisfied. The
default is 200 ms and the range is 0 to 65535 ms.
ཱ ི
① Received characters
②Start Message condition satisfied: message timer starts
③ Message timer expires and terminates the message
Recognize message end by re‐ The message end occurs when the configured amount of time to wait for a response expires
sponse timeout before a valid start sequence is received. The response timeout period begins when a trans‐
mission ends and the CM or CB begins the receive operation. The default response timeout is
200 ms and the range is 0 to 65535 ms. If a character is not received within the response time
period, RCVTIME, then an error is returned to the corresponding RCV_PTP instruction. The
response timeout does not define a specific end condition. It only specifies that a character
must be successfully received within the specified time. You must configure another end con‐
dition to indicate the actual end of a message.
ཱ
5&97,0(
ི
① Transmitted characters
② Received characters
③ First character must be successfully received by this time.
Recognize message end by in‐ The message end occurs when the maximum configured timeout between any two consecu‐
ter-character gap tive characters of a message has expired. The default value for the inter-character gap is 12 bit
times and the maximum number is 65535 bit times, up to a maximum of eight seconds.
ཱ ཱ ི
① Received characters
② Restarts the intercharacter timer
③ The intercharacter timer expires and terminates the message.
Parameter Definition
Recognize message end by re‐ The message end occurs when the specified number of characters has been received. The valid
ceiving a fixed number of range for the fixed length is 1 to 4096.
characters Note that for the S7-1200, this end condition is only valid for V4.0 CPUs or higher.
Recognize message end by The message end occurs when the configured maximum number of characters has been re‐
max length ceived. The valid range for maximum length is 1 to 1024.
This condition can be used to prevent a message buffer overrun error. When this end condition
is combined with timeout end conditions and the timeout condition occurs, any valid received
characters are provided even if the maximum length is not reached. This allows support for
varying length protocols when only the maximum length is known.
Read message length from The message itself specifies the length of the message. The message end occurs when a
message message of the specified length has been received. The method for specifying and interpreting
the message length is described below.
Recognize message end with The message end occurs when a specified character is received.
a character
Recognize message end with The message end occurs when a specified character sequence is received. You can specify a
a character sequence sequence of up to five characters. For each character position, you specify either a specific hex
character, or that the character is ignored in sequence matching.
Leading characters that are ignored characters are not part of the end condition. Trailing
characters that are ignored characters are part of the end condition.
In this case, the end condition is satisfied when two consecutive 0x6A characters are received,
followed by any two characters. The character preceding the 0x6A 0x6A pattern is not part of the
end character sequence. Two characters following the 0x6A 0x6A pattern are required to
terminate the end character sequence. The values received at character positions 4 and 5 are
irrelevant, but they must be received to satisfy the end condition.
Note
If you want your character sequence to indicate the end of the message, put the sequence in the
last character positions. In the example above, if you wanted 0x6A 0x6A to end the message
with no trailing characters, you would configure 0x6A in character positions 4 and 5.
Configure the receive message length parameters for this message as follows:
• n = 2 (The message length starts with byte 2.)
• Length size = 1 (The message length is defined in one byte.)
• Length m = 0 (There are no additional characters following the length specifier that are not
counted in the length count. Twelve characters follow the length specifier.)
In this example, the characters from 3 to 14 inclusive are the characters counted by Len (n).
SD1 Len (n) Len (n) SD2 Characters 5 to 10 counted by length FCS ED
DA SA FA Data unit=3 bytes
1 2 3 4 5 6 7 8 9 10 11 12
xx 0x06 0x06 xx xx xx xx xx xx xx xx xx
Configure the receive message length parameters for this message as follows:
• n = 3 (The message length starts at byte 3.)
• Length size = 1 (The message length is defined in one byte.)
• Length m = 3 (There are three characters following the length specifier that are not counted
in the length. In the protocol of this example, the characters SD2, FCS, and ED are not
counted in the length count. The other six characters are counted in the length count;
therefore the total number of characters following the length specifier is nine.)
In this example, the characters from 5 to 10 inclusive are the characters counted by Len (n).
After adding the communication interfaces to the device configuration (Page 131), you
configure parameters for the communication interfaces by selecting one of the CMs in your rack.
Parameter Definition
Protocol 3964R or Freeport. Select 3964R to configure port for 3964(R) communication
Operating mode* Full duplex (RS422) four-wire operation point-to-point. (Enabled)
Receive line initial state* Enable one of the following choices:
• None
• Bias with R(A)>R(B)>=0V
• Bias with R(B)>R(A)>=0V
Wire break* Enable one of the following choices:
• No wire-break check
• Enable wire-break check
Baud rate The default value for the baud rate is 9.6 Kbits per second. Valid choices are: 300 baud, 600
baud, 1.2 Kbits, 2.4 Kbits, 4.8 Kbits, 9.6 Kbits, 19.2 Kbits, 38.4 Kbits, 57.6 Kbits, 76.8 Kbits, and
115.2 Kbits.
Parity The default value for parity is no parity. Valid choices are: No parity, even, odd, mark (parity bit
always set to 1), space (parity bit always set to 0), and any parity (set parity bit to 0 for trans‐
mission; ignore parity error when receiving).
Data bits per character The number of data bits in a character. Valid choices are 7 or 8.
Number of stop bits The number of stop bits can be either one or two. The default is one.
Parameter Definition
Priority High or low: The CM will be either high or low and the communication partner must be the
opposite.
With block check (3964) If selected, 3964(R) communication employs transmission security by including a block check
character (BCC). If not selected transmission security does not include a block check character.
Use default values If selected, 3964(R) uses default values for the following protocol parameters:
• Connection attempts
• Transmission attempts
• Character delay time
• Acknowledgement delay
If not selected, you can configure values for each of these parameters.
Connection attempts Number of connection attempts (default value: 6 connection attempts)
1 to 255
Transmission attempts Number of transmission attempts (default value: 6 connection attempts)
1 to 255
Character delay time Character delay time setting (depending on the set data transmission rate) (default value:
220 ms) 1 ms to 65535 ms
Acknowledgement delay Acknowledgment delay time setting (depending on the set data transmission rate) (default
value: 2000 ms when block check is enabled; 550 ms when block check is not enabled) 1 ms
to 65535 ms
Note
With the exception of Priority, the protocol settings must be the same for the CM module and the
communication partner.
Parameter Description
REQ Many of the PtP instructions use the REQ input to initiate the operation on a low to high transition.
The REQ input must be high (TRUE) for one execution of an instruction, but the REQ input can remain
TRUE for as long as desired. The instruction does not initiate another operation until it has been called
with the REQ input FALSE so that the instruction can reset the history state of the REQ input. This is
required so that the instruction can detect the low to high transition to initiate the next operation.
When you place a PtP instruction in your program, STEP 7 prompts you to identify the instance DB.
Use a unique DB for each PtP instruction call. This ensures that each instruction properly handles
inputs such as REQ.
PORT A port address is assigned during communication device configuration. After configuration, a default
port symbolic name can be selected from the parameter assistant drop-list. The assigned CM or CB
port value is the device configuration property "hardware identifier". The port symbolic name is
assigned in the "Constants" tab of the PLC tag table.
Bit time resolution Several parameters are specified in a number of bit times at the configured baud rate. Specifying the
parameter in bit times allows the parameter to be independent of baud rate. All parameters that are
in units of bit times can be specified to a maximum number of 65535. However, the maximum
amount of time that a CM or CB can measure is eight seconds.
The DONE, NDR, ERROR, and STATUS output parameters of the PtP instructions provide
execution completion status for the PtP operations.
Note
The DONE, NDR, and ERROR parameters are set for one execution only. Your program logic must
save temporary output state values in data latches, so you can detect state changes in
subsequent program scans.
RUN to STOP mode and after a power cycle. See Configuring the communication ports
(Page 897) and Managing flow control (Page 899) for more information.
APP_END* IN STRING[5] Specifies the number and the characters to be appended to the transmitted
message (only the characters are appended).
STRING[5,0,aa,bb,cc,dd,ee] – End char is not used (default)
• STRING[5,1,aa,bb,cc,dd,ee] – Transmit one end character
• STRING[5,2,aa,bb,cc,dd,ee] – Transmit two end characters
• STRING[5,3,aa,bb,cc,dd,ee]– Transmit three end characters
• STRING[5,4,aa,bb,cc,dd,ee] – Transmit four end characters
• STRING[5,5,aa,bb,cc,dd,ee] – Transmit five end characters
DONE OUT Bool TRUE for one execution after the last request was completed with no error
ERROR OUT Bool TRUE for one execution after the last request was completed with an error
STATUS OUT Word Execution condition code (Default value: 0)
* Not supported for the CM and CB 1241s; you must use an empty string ("") for the parameter.
Example
Consider the following received hexadecimal coded message: "68 10 aa 68 bb 10 aa 16" and the
configured start sequences shown in the table below. Start sequences begin to be evaluated
when the first 68H character is successfully received. Upon successfully receiving the fourth
character (the second 68H), then start condition 1 is satisfied. Once the start conditions are
satisfied, the evaluation of the end conditions begins.
The start sequence processing can be terminated due to various parity, framing, or inter-
character timing errors. These errors result in no received message, because the start condition
was not satisfied.
Start condition First Character First Character +1 First Character +2 First Character +3 First Character +4
1 68H xx xx 68H xx
2 10H aaH xx xx xx
3 dcH aaH xx xx xx
4 e5H xx xx xx xx
1
STEP 7 automatically creates the DB when you insert the instruction.
The CPU does not permanently store the values you set with the P3964_Config instruction. The
CPU restores the parameters configured in the device configuration after a power cycle of the
CPU. See Configuring the 3964(R) communication priority and protocol parameters (Page 910)
for more information.
While a transmit operation is in progress, the DONE and ERROR outputs are FALSE. When a
transmit operation is complete, either the DONE or the ERROR output will be set TRUE to show
the status of the transmit operation. While DONE or ERROR is TRUE, the STATUS output is valid.
The instruction returns a status of 16#7001 if the communication interface accepts the transmit
data. Subsequent Send_P2P executions return 16#7002, if the CM or CB is still busy
transmitting. When the transmit operation is complete, the CM or CB returns the status of the
transmit operation as 16#0000 (if no errors occurred). Subsequent executions of Send_P2P with
REQ low return a status of 16#7000 (not busy).
The following diagrams show the relationship of the output values to REQ. This assumes that the
instruction is called periodically to check for the status of the transmission process. In the
diagram below, it is assumed that the instruction is called every scan (represented by the STATUS
values).
5(4
'21(
(5525
The following diagram shows how the DONE and STATUS parameters are valid for only one scan
if the REQ line is pulsed (for one scan) to initiate the transmit operation.
5(4
'21(
(5525
The following diagram shows the relationship of DONE, ERROR and STATUS parameters when
there is an error.
5(4
'21(
(5525
The DONE, ERROR and STATUS values are only valid until Send_P2P executes again with the same
instance DB.
Note
Setting the maximum record length for Profibus communication
When using a CM1243-5 Profibus Master module to control an ET 200SP or ET 200MP Profibus
device that uses an RS232, RS422, or RS485 point-to-point module, you need to explicitly set the
"max_record_len" data block tag to 240 as defined below:
Set "max_record_len" in the instance DB (for example, "Send_P2P_DB".max_record_len) to 240
after running any configuration instruction such as Port_Config, Send_Config, or
Receive_Config.
Explicitly assigning max_record_len is only necessary with Profibus communication; Profinet
communication already uses a valid max_record_len value.
You can always set the LENGTH parameter to 0 and ensure that SEND_P2P sends the entire data
structure represented by the BUFFER parameter. If you only want to send part of a data structure
in the BUFFER parameter, you can set LENGTH as follows:
The STATUS value is valid when either NDR or ERROR is TRUE. The STATUS value provides the
reason for termination of the receive operation in the CM or CB. This is typically a positive value,
indicating that the receive operation was successful and that the receive process terminated
normally. If the STATUS value is negative (the Most Significant Bit of the hexadecimal value is
set), the receive operation was terminated for an error condition such as parity, framing, or
overrun errors.
Each PtP communication interface can buffer up to a maximum of 1024 bytes. This could be one
large message or several smaller messages. If more than one message is available in the CM or
CB, the Receive_P2P instruction returns the oldest message available. A subsequent Receive_P2P
instruction execution returns the next oldest message available.
1
STEP 7 automatically creates the DB when you insert the instruction.
13.3.5.11 Get_Features
*Get_Features returns TRUE (1) if the feature is available, FALSE (0) if the feature is not available
13.3.5.12 Set_Features
EN_SUPPLY_VOLT:=_bool_in_,
DONE=>_bool_out_,
ERROR=>_bool_out_,
STATUS=>_word_out_);
1
STEP 7 automatically creates the DB when you insert the instruction.
STEP 7 provides extended instructions that enable the user program to perform Point-to-Point
communications with a protocol designed and implemented in the user program. These
instructions fall into two categories:
• Configuration instructions
• Communication instructions
Configuration instructions
Before your user program can engage in PtP communication, you must configure the
communication interface port and the parameters for sending data and receiving data.
You can perform the port configuration and message configuration for each CM or CB through
the device configuration or through these instructions in your user program:
• Port_Config (Page 913)
• Send_Config (Page 916)
• Receive_Config (Page 918)
Communication instructions
The PtP communication instructions enable the user program to send messages to and receive
messages from the communication interfaces. For information about transferring data with
these instructions, see the section on data consistency (Page 177).
All of the PtP functions operate asynchronously. The user program can use a polling architecture
to determine the status of transmissions and receptions. Send_P2P and Receive_P2P can
execute concurrently. The communication modules and communication board buffer the
transmit and receive messages as necessary up to a maximum buffer size of 1024 bytes.
The CMs and CB send messages to and receive messages from the actual point-to-point devices.
The message protocol is in a buffer that is either received from or sent to a specific
communication port. The buffer and port are parameters of the send and receive instructions:
• Send_P2P (Page 924)
• Receive_P2P (Page 927)
Additional instructions provide the capability to reset the receive buffer, and to get and set
specific RS232 signals:
• Receive_Reset (Page 929)
• Signal_Get (Page 930)
• Signal_Set (Page 931)
You must connect the communication interface of the CM 1241 RS232 module to the RS232
interface of the PC, which is normally COM1. Because both of these ports are Data Terminal
Equipment (DTE), you must switch the receive and transmit pins (2 and 3) when connecting the
two ports, which you can accomplish by either of the following methods:
• Use a NULL modem adapter to swap pins 2 and 3 together with a standard RS232 cable.
• Use a NULL modem cable, which already has pins 2 and 3 swapped. You can usually identify
a NULL modem cable as one with two female 9-pin D connector ends.
Note
The configuration settings for "Operating mode" and "Receive line initial state" are only
applicable for the CM 1241 (RS422/RS485) module. The other CM 1241 modules do not have
these port configuration settings. Refer to Configuring the RS422 and RS485 (Page 939).
• Transmit message configuration: Accept the default for transmit message configuration. No
break is to be sent at message start.
• Receive message start configuration: Configure the CM 1241 to start receiving a message
when the communication line is inactive for at least 50 bit times (about 5 milliseconds at
9600 baud = 50 * 1/9600):
• Receive message end configuration: Configure the CM 1241 to end a message when it
receives a maximum of 100 bytes or a linefeed character (10 decimal or a hexadecimal). The
end sequence allows up to five end characters in sequence. The fifth character in the
sequence is the linefeed character. The preceding four end sequence characters are "don’t
care" or unselected characters. The CM 1241 does not evaluate the "don’t care" characters but
looks for a linefeed character preceded by zero or more "don’t care" characters to indicate the
message end.
9
5%
5$
˖
9 *URXQG 9
5%
5$
([WHUQDO7HUPLQDWLRQ5HVLVWRU
9 ˖
9
5%
5$
9 9
5%
5$
9
Bias and termination are added by the user at the end nodes of the network.
1RELDV 6HUYHU
6ODYH
5%
5$ 6HUYHU
9 6ODYH
&OLHQW0DNHU
1RUPDO
5%
ELDV
5$
9 9
1RUPDO
ELDV 5%
5$
9
9 9
5% 5%
5$ 5$
9 9
5% 5%
5$ 5$
Network 2: Use the NDR value (Tag_1 at M0.0) set by the RCV_PTP instruction to make a copy
of the number of bytes received and to set a flag (Tag_8 at M20.0) to trigger the SEND_PTP
instruction.
Network 3: Enable the SEND_PTP instruction when the M20.0 flag is set. Also use this flag to set
the REQ input to TRUE for one scan. The REQ input tells the SEND_PTP instruction that a new
request is to be transmitted. The REQ input must only be set to TRUE for one execution of
SEND_PTP. The SEND_PTP instruction is executed every scan until the transmit completes. The
transmit is complete when the last byte of the message has been transmitted from the CM 1241.
When the transmit is complete, the DONE output (Tag_5 at M10.0) is set TRUE for one execution
of SEND_PTP.
Network 4: monitor the DONE output of SEND_PTP and reset the transmit flag (Tag_8 at M20.0)
when the transmit operation is complete. When the transmit flag is reset, the RCV_PTP
instruction in Network 1 is enabled to receive the next message.
&0
5656 6
PRGXOHV &38
866
1HW
'ULYHV
866
1HW
'ULYHV
For this reason, the S7-1200 supports two sets of PtP instructions:
• Legacy USS instructions (Page 1074): These USS instructions existed prior to version V4.0 of
the S7-1200 and only work with serial communications using a CM 1241 communication
module or CB 1241 communication board.
• USS instructions (Page 949): These USS instructions provide all of the functionality of the
legacy instructions, plus the ability to connect to PROFINET and PROFIBUS distributed I/O.
These USS instructions allow you to configure the communications between the PtP
communication modules in the distributed I/O rack and the PtP devices. S7‑1200 CM 1241
modules must have a minimum firmware version of V2.1 to use these USS instructions.
0RWRU 0RWRU
352),1(7'HYLFH 352),1(7'HYLFH
(703 &03W356 (763
&03W3
56 &03W3
6,1$0,&'ULYH 6,1$0,&'ULYH
0RWRU
0RWRU
86656
86656
6,1$0,&'ULYH
6,1$0,&'ULYH &60
352),1(7
&0 6&38
352),%860DVWHU
352),%86
352),1(7
56
352),%86'HYLFH 0RWRU
0RWRU 352),%86'HYLFH
(703 &03W356 (763
&03W3
56 &03W3
6,1$0,&'ULYH 6,1$0,&'ULYH
0RWRU
0RWRU
86656
86656
6,1$0,&'ULYH
6,1$0,&'ULYH
352),%86
The blue arrows indicate the flow of bidirectional communication between devices.
Note
With version V4.1 of the S7-1200, you can use the point-to-point instructions for all types of
point-to-point communication: serial, serial over PROFINET, and serial over PROFIBUS. STEP 7
provides the legacy point-to-point instructions only to support existing programs. The legacy
instructions still function with all S7-1200 CPUs. You do not have to convert prior programs from
one set of instructions to the other.
Click the icon on the instruction tree task card to enable the headers and columns of
the instruction tree.
866B3RUWB6FDQ
7KH866B'ULYHB&RQWUROB'%GDWD
866B'ULYHB&RQWUROB'% 866B'%
EORFNLVDEXIIHUWKDW\RXRQO\
DFFHVVLQGLUHFWO\WKURXJKWKH866
LQVWUXFWLRQV 866B'ULYHB&RQWUROB'%
5HUVHUYHGIRU
373
&20GDWD
E\WHV
'ULYHGDWD
Communication Options:
866B'ULYHB&RQWUROB'%
CM 1241 RS485
CB 1241 RS485
866B'ULYHB
&RQWURO PROFINET: (7036,3/866&03W3
(7636,3/866&03W3
PROFIBUS:(7036,3/866&03W3
'5,9(
(7636,3/866&03W3
866B5HDGB3DUDP
'5,9(
'ULYH
'ULYH
(DFKFRPPXQLFDWLRQ
866B:ULWHB3DUDP
SRUWVXSSRUWVXSWR
'5,9( GULYHV8VHWRDV
WKH'5,9(SDUDPHWHU
ER[LQSXW
All drives (up to 16) connected to a single RS485 port are part of the same USS network. All drives
connected to a different RS485 port are part of a different USS network. Each USS network is
managed using a unique data block. All instructions associated with a single USS network must
share this data block. This includes all USS_Drive_Control, USS_Port_Scan, USS_Read_Param,
and USS_Write_Param instructions used to control all drives on a single USS network.
The USS_Drive_Control instruction is a Function Block (FB). When you place the
USS_Drive_Control instruction into the program editor, you will be prompted by the "Call
options" dialog to assign a DB for this FB. If this is the first USS_Drive_Control instruction in this
program for this USS network, then you can accept the default DB assignment (or change the
name if you wish) and the new DB is created for you. If however this is not the first
USS_Drive_Control instruction for this channel, then you must use the drop-down list in the "Call
options" dialog to select the DB name that was previously assigned for this USS network.
The USS_Port_Scan instruction is a Function Block (FB) and handles the actual communication
between the CPU and the drives through the Point-to-Point (PtP) RS485 communication port.
Each call to this FB handles one communication with one drive. Your program must call this FB
fast enough to prevent a communication timeout by the drives. You may call this function FB in
a main program cycle OB or any interrupt OB.
The USS_Read_Param, and USS_Write_Param instructions are both Functions (FCs). No DB is
assigned when you place these FCs in the editor. Instead, you must assign the appropriate DB
reference to the "USS_DB" input of these instructions. Double-click on the parameter field and
then click on the parameter helper icon to see the available DB names).
Typically, you should call the USS_Port_Scan FB from a cyclic interrupt OB. The cycle time of the
cyclic interrupt OB should be set to about half of the minimum call interval (As an example, 1200
baud communication should use a cyclic time of 350 ms or less).
The USS_Drive_Control FB provides your program access to a specified drive on the USS network.
Its inputs and outputs are the status and controls for the drive. If there are 16 drives on the
network, your program must have at least 16 USS_Drive_Control calls, one for each drive. These
blocks should be called at the rate that is required to control the operation of the drive.
You may only call the USS_Drive_Control FB from a main program cycle OB.
CAUTION
Considerations in calling USS instructions from OBs
Only call USS_Drive_Control, USS_Read_Param, and USS_Write_Param from a main program
cycle OB. The USS_Port_Scan FB can be called from any OB, usually from a cyclic interrupt OB.
Do not use instructions USS_Drive_Control, USS_Read_Param, and USS_Write_Param in a
higher priority OB than the corresponding USS_Port_Scan instruction. For example, do not
place the USS_Port_Scan in the main OB and a USS_Read_Param in a cyclic interrupt OB. Failure
to prevent interruption of USS_Port_Scan execution can produce unexpected errors, which
could result in personal injury.
The USS_Read_Param, and USS_Write_Param FCs read and write the remote drive operating
parameters. These parameters control the internal operation of the drive. See the drive manual
for the definition of these parameters. Your program can contain as many of these functions as
necessary, but only one read or write request can be active per drive, at any given time. You may
only call the USS_Read_Param, and USS_Write_Param FCs from a main program cycle OB.
Baud rate Calculated minimum USS_Port_Scan call Drive message interval timeout per
Interval ( milliseconds ) drive ( milliseconds )
1200 790 2370
2400 405 1215
4800 212.5 638
9600 116.3 349
19200 68.2 205
38400 44.1 133
57600 36.1 109
115200 28.1 85
Typically, there is only one USS_Port_Scan instruction per PtP communication port in the
program, and each call of this Function Block (FB) handles a transmission to or from a single
drive. All USS functions associated with one USS network and PtP communication port must use
the same instance DB.
Your program must execute the USS_Port_Scan instruction often enough to prevent drive
timeouts. USS_Port_Scan is usually called from a cyclic interrupt OB to prevent drive timeouts
and keep the most recent USS data updates available for USS_Drive_Control calls.
Note
When using the USS protocol library and the USS_Port_Scan instruction with a CB 1241, you
must set the LINE_PRE data block tag to a value of 0 (No initial state). The default value of 2 for
the LINE_PRE data block tag results in an error value of 16#81AB being returned by the
USS_Port_Scan instruction. The LINE_PRE data block tag is found in the data block associated
with the USS_Port_Scan instruction (usually named USS_Port_Scan_DB).
Ensure the start value of LINE_PRE is changed to a 0 (zero).
When the initial USS_Drive_Control execution occurs, the drive indicated by the USS address
(parameter DRIVE) is initialized in the Instance DB. After this initialization, subsequent
executions of USS_Port_Scan can begin communication to the drive at this drive number.
Changing the drive number requires a CPU STOP-to-RUN mode transition that initializes the
instance DB. Input parameters are configured into the USS TX message buffer and outputs are
read from a "previous" valid response buffer if any exists. There is no data transmission during
USS_Drive_Control execution. Drives communicate when USS_Port_Scan is executed.
USS_Drive_Control only configures the messages to be sent and interprets data that might have
been received from a previous request.
You can control the drive direction of rotation using either the DIR input (Bool) or using the sign
(positive or negative) with the SPEED_SP input (Real). The following table indicates how these
inputs work together to determine the drive direction, assuming the motor is wired for forward
rotation.
Note
EEPROM write operations (for the EEPROM inside a USS drive)
Do not overuse the EEPROM permanent write operation. Minimize the number of EEPROM write
operations to extend the EEPROM life.
STATUS Description
(W#16#....)
0000 No error
8180 The length of the drive response did not match the characters received from the drive. The drive number
where the error occurred is returned in the "USS_Extended_Error" variable. See the extended error descrip‐
tion below this table.
8181 VALUE parameter was not a Word, Real or DWord data type.
8182 The user supplied a Word for a parameter value and received a DWord or Real from the drive in the response.
8183 The user supplied a DWord or Real for a parameter value and received a Word from the drive in the response.
8184 The response telegram from drive had a bad checksum. The drive number where the error occurred is
returned in the "USS_Extended_Error" variable. See the extended error description below this table.
8185 Illegal drive address (valid drive address range: 1 to16)
8186 The speed set point is out of the valid range (valid speed SP range: -200% to 200%).
8187 The wrong drive number responded to the request sent. The drive number where the error occurred is
returned in the "USS_Extended_Error" variable. See the extended error description below this table.
8188 Illegal PZD word length specified (valid range = 2, 4, 6 or 8 words)
8189 Illegal Baud Rate was specified.
818A The parameter request channel is in use by another request for this drive.
818B The drive has not responded to requests and retries. The drive number where the error occurred is returned
in the "USS_Extended_Error" variable. See the extended error description below this table.
818C The drive returned an extended error on a parameter request operation. See the extended error description
below this table.
818D The drive returned an illegal access error on a parameter request operation. See your drive manual for
information of why parameter access may be limited.
STATUS Description
(W#16#....)
818E The drive has not been initialized. This error code is returned to USS_Read_Param or USS_Write_Param when
USS_Drive_Control, for that drive, has not been called at least once. This keeps the initialization on first scan
of USS_Drive_Control from overwriting a pending parameter read or write request, since it initializes the
drive as a new entry. To fix this error, call USS_Drive_Control for this drive number.
80Ax-80Fx Specific errors returned from PtP communication FBs called by the USS Library - These error code values are
not modified by the USS library and are defined in the PtP instruction descriptions.
1
In addition to the USS instruction errors listed above, errors can be returned from the
underlying PtP communication instructions (Page 911).
For several STATUS codes, additional information is provided in the "USS_Extended_Error"
variable of the USS_Drive_Control Instance DB. For STATUS codes hexadecimal 8180, 8184,
8187, and 818B, USS_Extended_Error contains the drive number where the communication
error occurred. For STATUS code hexadecimal 818C, USS_Extended_Error contains a drive error
code returned from the drive when using a USS_Read_Param or USS_Write_Param instruction.
To make the connection to a MicroMaster Series 4 (MM4) drive, insert the ends of the RS485
cable into the two caged-clamp, screw-less terminals provided for USS operation. Standard
PROFIBUS cable and connectors can be used to connect the S7-1200.
CAUTION
Interconnecting equipment with different reference potentials can cause unwanted
currents to flow through the interconnecting cable
These unwanted currents can cause communications errors or damage equipment. Be sure all
equipment that you are about to connect with a communications cable either shares a
common circuit reference or is isolated to prevent unwanted current flows. The shield must be
tied to chassis ground or pin 1 on the 9-pin connector. It is recommended that you tie wiring
terminal 2-0 V on the MicroMaster drive to chassis ground.
The two wires at the opposite end of the RS485 cable must be inserted into the MM4 drive
terminal blocks. To make the cable connection on a MM4 drive, remove the drive cover(s) to
access the terminal blocks. See the MM4 user manual for details about how to remove the
covers(s) of your specific drive.
B (P)
A (N)
The terminal block connections are labeled numerically. Using a PROFIBUS connector on the
S7-1200 side, connect the A terminal of the cable to the drive terminal 15 (for an MM420) or
terminal 30 (MM440). Connect the B terminal of B (P) A (N) the cable connector to terminal 14
(MM420) or terminal 29 (MM440).
If the S7-1200 is a terminating node in the network, or if the connection is point-to-point, it is
necessary to use terminals A1 and B1 (not A2 and B2) of the connector since they allow the
termination settings to be set (for example, with DP connector type 6ES7972-0BA40-0X40).
CAUTION
Replace drive covers properly before supplying power
Make sure the drive covers are replaced properly before supplying power to the unit.
+10 VDC 1
WARNING
Avoiding security risks from physical network attacks
If an attacker can physically access your networks, the attacker can possibly read and write data.
Some forms of communication (I/O exchange through PROFIBUS, PROFINET, AS-i, or other I/O
bus, GET/PUT, T-Block, and communication modules (CM)) have no security features. You must
protect these forms of communication by limiting physical access. If an attacker can physically
access your networks using these forms of communication, the attacker can possibly read and
write data.
If you fail to protect these forms of communication, death or severe personal injury can result.
For security information and recommendations, see the "Operational Guidelines for Industrial
Security" on the Siemens Service and Support site.
Table 13-52 Read data functions: Read remote I/O and program data
Table 13-53 Write data functions: Write remote I/O and modify program data
Station Address
RTU station Standard station address 1 to 247
Extended station address 1 to 65535
TCP station Station address IP address and port number
See also
Siemens service and support site (https://www.industry.siemens.com/topics/global/en/
industrial-security/Documents/operational_guidelines_industrial_security_en.pdf)
13.5.2.1 Overview
As of version V4.1 of the S7-1200 CPU together with STEP 7 V13 SP1, the CPU extends the
capability of Modbus TCP to use enhanced T-block instructions.
For this reason, the S7-1200 supports two sets of PtP instructions:
• Legacy Modbus TCP instructions (Page 1084): These Modbus TCP instructions existed prior
to version V4.0 of the S7-1200.
• Modbus TCP instructions (Page 965): These Modbus TCP instructions provide all of the
functionality of the legacy instructions.
,QGXVWULDO(WKHUQHW
UG3DUW\
0RGEXV7&3
6HUYHU
• Version 5.1: Compatible with V4.2 and later CPUs and V2.1 and later CMs
• Version 6.0: Compatible with V4.2 and later CPUs and V2.1 and later CMs
For compatibility and ease of migration, you can choose which instruction version to insert into
your user program.
In the Instruction task card, display the MODBUS TCP instructions under "Others" in the Com‐
munication group.
To change the version of the Modbus
TCP instructions, select the version
from the drop-down list. You can se‐
lect the group or individual instruc‐
tions.
When you use the instruction tree to place a Modbus TCP instruction in your program, a new FB
instance is created in the project tree. You can see new FB instance in the project tree under
PLC_x > Program blocks > System blocks > Program resources.
To verify the version of a Modbus TCP instruction in a program, you must inspect project tree
properties and not the properties of a box displayed in the program editor. Select a project tree
Modbus TCP FB instance, right-click, select "Properties", and select the "Information" page to see
the Modbus TCP instruction version number.
Modbus function 23
Description
With the Modbus function 23, the following is carried out in a job:
1. Data is transferred from the CPU to the Modbus server and written into one or more holding
registers.
2. Data is read from one or more holding registers of the Modbus server and transferred to the
CPU.
The "MB_CLIENT" instruction supports the Modbus function 23 as of instruction version V6.0.
Parameters
When the Modbus function 23 is used, the MB_MODE parameter must have the value 123.
The parameters MB_DATA_ADDR, MB_DATA_LEN and MB_DATA_PTR are not used and must have
their default values as values.
When Modbus function 23 is used, six new parameters are used, which are described in the table
below. Each of these parameters starts with "RD_" or "WR_" to indicate that it belongs to the read
or write task. The default is that these parameters are hidden. When using Modbus function 23,
these six parameters must all be used. If you use another Modbus function, then these six
parameters must have the value 0 or they must be empty. Otherwise, the STATUS value
16#818D is returned.
STATUS parameter
The meaning of the STATUS values 16#8383, 8189, 818A, 818B is expanded. The STATUS value
16#818D is added.
REQ parameter
FALSE = No Modbus communication request
TRUE = Request to communicate with a Modbus TCP server
If no instance of MB_CLIENT is active and parameter DISCONNECT=0, when REQ=1 a new
Modbus request starts. If the connection is not already established, then a new connection is
made.
If the same instance of MB_CLIENT is executed again with DISCONNECT=0 and REQ=1, before
the completion of the current request, then no subsequent Modbus transmission will be made.
However, as soon as the current request is completed, a new request can be processed if
MB_CLIENT is executed with REQ=1.
When the current MB_CLIENT communication request is complete, the DONE bit is TRUE for one
cycle. The DONE bit can be used as a time gate to sequence multiple MB_CLIENT requests.
Note
Input data consistency during MB_CLIENT processing
Once a Modbus client initiates a Modbus operation, all the input states are saved internally and
are then compared on each successive call. The comparison is used to determine if this particular
call was the originator of the active client request. More than one MB_CLIENT call can be
performed using a common instance DB.
It is important that the inputs are not changed during the period of time that an MB_CLIENT
operation is actively being processed. If this rule is not followed, then an MB_CLIENT cannot
determine the active instance.
Note
MB_DATA_PTR assigns a buffer to store data read/written to/from a Modbus TCP server
The data buffer can be located in a non-optimized global DB or M memory address.
For a buffer in M memory, use the Any Pointer format. This is in the format P#"Bit Address" "Data
Type" "Length", an example would be P#M1000.0 WORD 500.
• RemotePort: The default is 502. This number is the IP port number of the Modbus server that
MB_CLIENT attempts to connect and communicate with. Some third-party Modbus servers
require that you use another port number.
• LocalPort: This value must be 0, for an MB_CLIENT connection.
Table 13-60 MB_CLIENT instance data block: User accessible static variables
See also
Asynchronous communication connections (Page 561)
Note
CPU firmware version requirement
The Modbus TCP instructions described in this section of the manual require firmware release
V4.1 or later.
• ConnectionType: For TCP/IP, use the default 16#0B (decimal value = 11).
• ActiveEstablished: This value must be 0 or FALSE. The connection is passive in that
MB_SERVER is waiting for a communication request from a Modbus client.
• RemoteAddress: There are two options.
– Use 0.0.0.0 and MB_CLIENT will respond to a Modbus request from any TCP client
– Enter the IP address of a target Modbus TCP client and MB_CLIENT only responds to a
request originating from this client's IP address. For example, enter 192.168.2.241, as in
the previous image.
• RemotePort: This value must be 0, for an MB_SERVER connection.
• LocalPort: The default is 502. This number is the IP port number of the Modbus client that
MB_SERVER attempts to connect and communicate with. Some third-party Modbus clients
require another port number.
Incoming Modbus message function codes function codes (3, 6, and 16) read/write words in a
Modbus holding register, which can be in M memory or a data block. The type of holding register
is specified by the MB_HOLD_REG parameter.
Note
MB_HOLD_REG parameter assignment
Modbus holding registers defined as arrays of word, integer, wide character, unsigned integer,
byte, short integer, unsigned short integer, character, double word, double integer, unsigned
double integer, or real can be placed in any memory area.
You must place Modbus holding registers that you defined as structures in non-optimized DBs.
For a Modbus holding register in M memory, use the Any Pointer format. This is in the format
P#"Bit Address" "Data Type" "Length". An example would be P#M1000.0 WORD 500.
The following table shows examples of Modbus addresses to holding register mapping used for
Modbus function codes 03 (read words), 06 (write word), and 16 (write words). The actual
upper limit of DB addresses is determined by the maximum work memory limit and M memory
limit, for each CPU model.
The connection ID must be unique for each individual connection. A single, connection ID must
be used with each individual instance DB. The instance DB and the connection ID are paired
together and must be unique for every connection.
Your program can write data to the control Modbus server operations and the following
variables:
• HR_Start_Offset
• QB_Start
• QB_Count
• QB_Read_Start
• QB_Read_Count
• IB_Read_Start
• IB_Read_Count
Version requirements for MB_SERVER instruction data block (DB) variables availability are as
follows:
Table 13-69 MB_SERVER instruction data block (DB) variables availability version requirements:
Instruction, TIA Portal, and S7‑1200 CPU
MB_SERVER instruc‐ TIA Portal version S7-1200 CPU firmware Data block variables
tion version (FW) version
4.2 V14 SP1 CPU FW V4.0 or later QB_Start
QB_Count
5.0 or later V15 or later CPU FW V4.2 or later QB_Start
QB_Count
QB_Read_Start
QB_Read_Count
IB_Read_Start
IB_Read_Count
NDR_immediate
DR_immediate
HR_Start_Offset
Modbus holding register addresses begin at 40001. These addresses correspond to the
beginning PLC memory address of the holding register. However, you can use the
"HR_Start_Offset" variable to start the beginning Modbus holding register address at another
number instead of 40001.
For example, if the holding register starts at MW100 and is 100 words long. An offset of 20
specifies a beginning holding register address of 40021 instead of 40001. Any address less than
40021 or greater than 40119 results in an addressing error.
HR_Start_Offset is word data in the MB_SERVER instance data block that assigns the starting
address of the Modbus holding register. You can set this public static variable by using the
parameter helper drop list, after MB_SERVER is placed in your program.
For example, after you place MB_SERVER in a LAD network, you can go to a previous network and
assign HR_Start_Offset. The start address must be assigned prior to execution of MB_SERVER.
Access to data areas in data blocks (DB) instead of direct access to Modbus addresses
As of version V5.0 of the MB_SERVER instruction and firmware (FW) version V4.2 of the S7-1200
CPU, you can access data areas in DBs instead of directly accessing process images and holding
registers. In order to do this, in the global DB "Attributes" Property page, you must deselect the
"Only store in load memory" and "Optimized block access" check boxes.
If a Modbus request arrives and you did not define a data area for the Modbus data type of the
corresponding function code, the MB_SERVER instruction treats the request as in previous
instruction versions: You access process images and holding registers directly.
If you have defined a data area for the Modbus data type of the function code, the MB_SERVER
instruction reads from or writes to that data area. Whether it reads or writes depends on the job
type.
Note
If a data area is configured, the MB_SERVER instruction ignores the offsets or ranges configured
by the static variables in the instance data block that corresponds to the data_type of the data
area. Those offsets and ranges only apply to the process image or the memory referenced by
MB_HOLD_REG. The data area start and length parameters provide its own way of defining
offsets and ranges
For one individual Modbus request, you can only read from or write to one data area. If, for
example, you want to read holding registers that extend over multiple data areas, you require
multiple Modbus requests.
These are the rules for defining data areas:
• You can define up to eight data areas in different DBs; each DB must only contain one data
area. An individual MODBUS request can only read from precisely one data area or write to
precisely one data area. Each data area corresponds to one MODBUS address area. You
define the data areas in the "Data_Area_Array" static tag of the instance DB.
• If you want to use less than eight data areas, you must place the required data areas one
behind the other, without any gaps. The first blank entry in the data areas ends the data area
search during processing. If, for example, you define the field elements 1, 2, 4, and 5, the
"Data_Area_Array" only recognizes field elements 1 and 2. as field element 3 is empty.
Condition codes
Note
Consistent input data during an MB_RED_CLIENT call
When a Modbus client instruction is called, the values of the input parameters are stored
internally. The values must not be changed while the frame is being processed.
Note
CPU firmware version requirement
The Modbus TCP instructions described in this section of the manual require firmware release
V4.2 or later.
To use the instruction, you do not require an additional hardware module.
– If the S7 is designed as standalone and the link partner is designed redundantly, one
connection is created from the S7 connection point 0 to junction A of the link partner
(connection from the S7 connection point 0 to the partner/node A => connection 0A),
and one connection from the S7 connection point 0 to junction B of the link partner
(connection from the S7 connection point 0 to the partner/node B => connection 0B). The
figure illustrates the connection designations:
• Double-sided redundancy:
– Description: One connection each must be configured for each connection between the
communication partners. The connection points of the SIMATIC S7 are referred to as 0
and 1; the connection points of the communication partner are referred to as A and B.
The R-CPU or H-CPU 1 refers to the connection point 0 the R-CPU or H-CPU 2 refers to the
connection point 1.
– Configuration: In the case of double-sided redundancy, two connections are created from
connection point 0 (connection from the S7 connection point 0 to the partner/node A =>
connection 0A and connection from the S7 connection point 0 to the partner/node B =>
connection 0B), and two connections from connection point 1 of the S7 to the junctions
A and B of the link partner (connection from the S7 connection point 1 to the partner/
node A => connection 1A and connection from the S7 connection point 1 to the partner/
node B => connection 1B). The figure illustrates the connection designations:
• Frame processing: The frames can be sent via one or via all configured connections:
– Send frames via one connection: The MODBUS frame is sent via one - the currently active
- connection with the setting USE_ALL_CONN = FALSE. In case of a timeout (no response
from the server) or a connection fault an attempt is made to send the frame via the other
(maximum 4) configured connections. The sequence is then 0A, 1A, 0B and 1B. If a frame
was transmitted successfully via a connection, this connection is marked as "active" and
the further frame traffic is executed via this connection. In the case of a connection fault
of the active connection it is again attempted to send the frame via all configured
connections. If all send attempts fail, ERROR and STATUS_x are set accordingly.
If a response frame was received, a plausibility check is executed. If this check is
successful, the required actions are performed and the job is executed without errors; the
output DONE is set. If errors are detected during the check, the job is ended without
errors, the bit ERROR is set and an error number is displayed at STATUS_x. In this case no
new attempt is made to send the frame on the next configured connection. A switchover
to the other configured connections only takes place if a connection fault was detected or
no response was received.
– Sending frames via all connections: The MODBUS frame is sent via all configured,
established connections with the setting USE_ALL_CONN = TRUE. A validity check is
performed after the response frame has been received on one of the connections. If this
check is successful, the required actions are performed. If a valid response frame was
received on at least one connection, the output DONE is set.
• Redundancy outputs RED_ERR_S7, RED_ERR_DEV, and TOT_COM_ERR:
– The redundancy bits RED_ERR_S7, RED_ERR_DEV, and TOT_COM_ERR are set based on
the states of the status outputs:
Figure 13-4 Display of the interrupt bits for redundancy setup on both sides
Figure 13-5 Display of the interrupt bits for redundancy setup on one side
Note
Port numbers for client and server
The Modbus client uses a port number starting at 2000. The Modbus server is usually addressed
over the port number 502.
Parameter assignment
You can use the MB_RED_CLIENT instruction V1.0 and V1.1 for S7-1200. The CPU implements
the connections over the local interface of the CPU or CM/CP. The CPU configures and establishes
the connections using the TCON_IP_V4 structure.
Configuration of MB_RED_CLIENT: You make the following settings using the configuration
dialog of the MB_RED_CLIENT instruction:
• Connection parameters for the connections 0A, 1A, 0B and 1B (Refer to "Operation and
Redundancy", above, for more information on redundancy configuration.)
• Internal parameter (optional)
You can open the configuration dialog with the MB_RED_CLIENT instruction or through the
technology objects:
Note
Tag MB_Transaction_ID
If the transaction ID in the answer of the Modbus TCP server does not match the transaction ID
of the job from MB_RED_CLIENT, the MB_RED_CLIENT instruction waits for the time period
RCV_TIMEOUT * RETRIES for the answer of the Modbus TCP server with the correct transaction
ID; once this time has expired, it returns the error W#16#80C8.
Licensing
The MB_RED_CLIENT instruction is subject to a fee, and you must license the instruction on each
CPU individually. Licensing takes place in two steps:
• Displaying the license IDENT_CODE
• Entering the REG_KEY registration key: You must assign the REG_KEY registration key at each
MB_RED_CLIENT instruction. Save the REG_KEY in a global data block from which all
MB_RED_CLIENT instructions receive the necessary registration key.
Procedure for displaying the license IDENT_CODE:
1. Assign parameters to the MB_RED_CLIENT instruction in line with your requirements in a
cyclic OB. Download the program to the CPU and set the CPU to RUN.
2. Open the instance DB of the Modbus instruction, and click the "Monitor all" button.
4. Copy this string using copy/paste from the data block and paste it in the form (that was sent
to you by email after you ordered the product or is included on the CD).
5. Send the form to Customer support (https://support.industry.siemens.com/my/ww/en/
requests/#createRequest) using a service request. You will then receive the registration key
for your CPU.
Procedure for entering the registration key REG_KEY:
1. Insert a new global data block with a unique symbolic name, for example "License_DB", using
"Add new block…".
2. Create a REG_KEY parameter in this block with the data type STRING[17].
3. Copy the transmitted 17-digit registration key using copy/paste to the "Start value" column.
4. In the cyclic OB, enter the name of the license DB and the name of the string (for example,
License_DB.REG_KEY) at the REG_KEY parameter of the MB_RED_CLIENT instruction.
5. Download the modified blocks to the CPU. You can enter the registration key during runtime;
a change from STOP to RUN is not necessary.
6. The Modbus/TCP communication using the MB_RED_CLIENT instruction is now licensed for
this CPU; the LICENSED output bit is TRUE.
• In the case of a missing or incorrect registration key, the CPU processes the Modbus TCP
communication; however, the CPU always displays "W#16#0A90" (No valid license key for
functional package) at the STATUS_x output. The LICENSED output bit is FALSE.
Example:
Tag Meaning
MB_MODE = 1 Writes 1 output bit with function code 5, starting from the remote address
MB_DATA_ADDR = 1 0.
MB_DATA_LEN = 1
MB_MODE = 1 Writes 2 output bits with function code 15, starting from the remote address
MB_DATA_ADDR = 1 0.
MB_DATA_LEN = 2
MB_MODE = 104 Reads 125 input words with function code 4, starting from the remote ad‐
MB_DATA_ADDR = 17834 dress 17.834.
MB_DATA_LEN = 125
MB_DATA_PTR:
The MB_DATA_PTR parameter is a pointer to a data buffer for the data to be received from the
Modbus server or to be sent to the Modbus server. You can use a global data block or a memory
area (M) as the data buffer.
For a buffer in the memory area (M), use a pointer in the ANY format as follows: "P#bit address"
"data type" "length" (example: P#M1000.0 WORD 500)
Depending on the memory area in which the data buffer is located, MB_DATA_PTR can reference
different data structures:
• When you use a global DB with optimized access, MB_DATA_PTR can reference a tag with
elementary data type or an array of elementary data types. The following data types are
supported:
Note
Using a bit memory address area as data buffer
If you use a bit memory address area as data buffer for MB_DATA_PTR, you need to observe this
variable. With the S7-1200 CPUs, it is 8 KB.
Note
You can display the error status codes as integer or hexadecimal values in the program editor:
1. Open the desired block in the programming editor.
2. Switch on the programming status by clicking "Monitor on/off". (If you have not already
established an online connection, the "Go online" dialog opens. In this dialog, you can
establish an online connection.)
3. Select the tag that you want to monitor and select the desired display format in the shortcut
menu under "Display format".
STATUS Description
(W#16#)
0000 Instruction executed without errors.
0001 Connection established.
0003 Connection terminated.
0A90 The instruction MB_RED_CLIENT is not licensed. Refer to the "Licensing" section above
for further information.
0AFF The connection is not configured and is not used. The connection "0A" must be config‐
ured.
7000 No job active and no connection established (REQ=0, DISCONNECT=1).
7001 Connection establishment triggered.
7002 Intermediate call. Connection is being established.
7003 Connection is being terminated.
7004 Connection established and monitored. No job processing active.
7005 Data is being sent.
7006 Data is being received.
STATUS Description
(W#16#)
80C8 No response of the server in the defined period. Check the connection to the Modbus
server. This error is only reported on completion of the configured repeated attempts.
If the MB_RED_CLIENT instruction does not receive an answer with the originally trans‐
ferred transaction ID (see static tag MB_TRANSACTION_ID) within the defined period,
this error code is output.
8380 Received Modbus frame has incorrect format or too few bytes were received.
8382 • The length of the Modbus frame in the frame header does not match the number of
received bytes.
• The number of bytes does not match the number of actually transmitted bytes (only
functions 1-4).
• The start address in the received frame does not match the saved start address
(functions 5, 6, 15, and 16).
• The number of words does not match the number of actually transmitted words
(functions 15 and 16).
8383 Error reading or writing data or access outside the address area of MB_DATA_PTR. Refer
to the "MB_DATA_PTR" section above for further information.
8384 • Invalid exception code received.
• A different data value was received than was originally sent by the client (func‐
tions 5, 6, and 8)
• Invalid status value received (function 11)
8385 • Diagnostics code not supported.
• A different subfunction code was received than was originally sent by the client
(function 8).
8386 Received function code does not match the one sent originally.
STATUS Description
(W#16#)
8387 The protocol ID of the Modbus TCP frame received by the server is not "0".
8388 The Modbus server sent a different data length than was processed. This error occurs
only when using the Modbus functions 5, 6, 15, or 16.
STATUS Description
(W#16#)
80B6 Invalid connection type; only TCP connections are supported.
80BB The ActiveEstablished parameter has an invalid value. Only active connection estab‐
lishment permitted for client (ActiveEstablished = TRUE).
8188 The MB_MODE parameter has an invalid value.
8189 Invalid addressing of data at the MB_DATA_ADDR parameter
818A Invalid data length at the MB_DATA_LEN parameter
818B The MB_DATA_PTR parameter has an invalid pointer. You should also check the values
of the MB_DATA_ADDR and MB_DATA_LEN parameters. (Refer to the "MB_DATA_ADDR"
section above for further information on the "MB_DATA_ADDR".)
818C Timeout at parameter BLOCKED_PROC_TIMEOUT or RCV_TIMEOUT (see static tags of
instruction). BLOCKED_PROC_TIMEOUT and RCV_TIMEOUT must be between 0.5 s and
55.0 s.
8200 • The CPU is currently processing a different Modbus request through the port.
• Another instance of MB_RED_CLIENT with the same connection parameters is pro‐
cessing an existing Modbus request.
Note
Error codes of internally used communication instructions
With the MB_RED_CLIENT instruction, in addition to the errors listed in the tables, errors caused
by the communication instructions (TCON, TDISCON, TSEND, TRCV, T_DIAG, and TRESET), used
by the instruction, can occur.
The CPU assigns the error codes through the instance data block of the MB_RED_CLIENT
instruction. The CPU displays the error codes for the respective instruction under STATUS in the
"Static" section.
The meaning of the error codes is available in the documentation of the corresponding
communications instruction.
Note
Communication error when sending or receiving data
If a communication error occurs when sending or receiving data (80C4 (Temporary
communications error. The specified connection is temporarily terminated.), 80C5 (The remote
partner has actively terminated the connection.), and 80A1 (The specified connection is
disconnected or is not yet established.)), the CPU terminates the existing connection.
This means that you can see all returned STATUS values when the connection is terminated and
that the STATUS code that caused the connection to be terminated is only output when the
connection is terminated.
Example: If a temporary communication error occurs when data is received, the STATUS 7003
(ERROR=false) is output initially and then 80C4 (ERROR=true).
Note
Security information
Note that each client of the network is given read and write access to the process image inputs
and outputs and to the data block or bit memory area defined by the Modbus holding register.
The option is available to restrict access to an IP address to prevent unauthorized read and write
operations. Note, however, that the shared address can also be used for unauthorized access.
Note
CPU firmware version requirement
The Modbus TCP instructions described in this section of the manual require firmware release
V4.2 or later.
To use the instruction, you do not require an additional hardware module.
The maximum number of connections depends on the CPU being used and can be found in the
technical specifications of the CPU. The total number of connections of one CPU, including those
of the Modbus TCP clients and server must not exceed the maximum number of supported
connections.
In the case of server connections, remember the following rules:
• Each MB_RED_SERVER connection must use a unique instance DB.
• One unique connection/connection ID is required for each and every client that wants to
connect to the server port.
• The connection IDs must be unique throughout the CPU.
Modbus function
Function code Function Data area Address space
01 Read: Bits Output 0 to 65.535
02 Read: Bits Input 0 to 65.535
04 Read: WORD Input 0 to 65.535
05 Write: Bit Output 0 to 65.535
15 Write: Bits Output 0 to 65.535
Incoming Modbus requests with the function codes 3, 6, 16, and 23 write or read the Modbus
holding registers (you specify the holding register with the MB_HOLD_REG parameter or using
Data_Area_Array).
Modbus functions
The following table lists all the Modbus functions that are supported by the MB_RED_SERVER
instruction:
Function Description
code
01 Read output bits
02 Read input bits
03 Read a holding register
04 Read input words
05 Write an output bit
06 Write a holding register
Function Description
code
08 Diagnostics function:
• Echo test (subfunction 0x0000): The MB_RED_SERVER instruction receives a data word
and returns this unchanged to the Modbus client.
• Reset event counter (subfunction 0x000A): The MB_RED_SERVER instruction resets
the following event counters: "Success_Count", "Xmt_Rcv_Count", "Exception_Count",
"Server_Message_Count", and "Request_Count".
11 Diagnostics function: Fetch event counter of the communication
The MB_RED_SERVER instruction uses an internal event counter for communication to
record the number of successfully executed read and write requests sent to the Modbus
server.
The event counter is not incremented with the functions 8 or 11. The same holds true for
requests that cause a communications error, for example, if a protocol error has occurred;
the function code in the received Modbus request is not supported).
15 Write output bits
16 Write a holding register
23 Write a holding register and read a holding register with a request
– If the S7 is designed as standalone and the link partner is designed redundantly, one
connection is created from the S7 connection point 0 to junction A of the link partner
(connection from the S7 connection point 0 to the partner/node A => connection 0A),
and one connection from the S7 connection point 0 to junction B of the link partner
(connection from the S7 connection point 0 to the partner/node B => connection 0B). The
figure illustrates the connection designations:
• Double-sided redundancy:
– Description: One connection each must be configured for each connection between the
communication partners. The connection points of the SIMATIC S7 are referred to as 0
and 1; the connection points of the communication partner are referred to as A and B.
The R-CPU or H-CPU 1 refers to the connection point 0, the R-CPU or H-CPU 2 refers to the
connection point 1.
– Configuration: In the case of double-sided redundancy, two connections are created from
connection point 0 (connection from the S7 connection point 0 to the partner/node A =>
connection 0A and connection from the S7 connection point 0 to the partner/node B =>
connection 0B), and two connections from connection point 1 of the S7 to the junctions
A and B of the link partner (connection from the S7 connection point 1 to the partner/
node A => connection 1A and connection from the S7 connection point 1 to the partner/
node B => connection 1B). The figure illustrates the connection designations:
• Frame processing: Frames can be received through all configured connections. The client can
send frames either through one connection or through all connections. If a frame was
received on a connection, the CPU displays the status at the corresponding output DR_NDR_x
or ERROR_x. Each connection runs independently and has no influence on the display of the
other connections.
• Redundancy outputs RED_ERR_S7, RED_ERR_DEV, and TOT_COM_ERR:
– The redundancy bits RED_ERR_S7, RED_ERR_DEV, and TOT_COM_ERR are set based on
the states of the status outputs:
Figure 13-15 Display of the interrupt bits for redundancy setup on both sides
Figure 13-16 Display of the interrupt bits for redundancy setup on one side
Note
Port numbers for client and server
The Modbus client uses a port number starting at 2000. The Modbus server is usually addressed
over the port number 502. Depending on the CPU, it is possible to configure port 502 for multiple
connections (Multiport). If the local port 502 was configured for two or more connections, the
requesting clients are randomly distributed to the existing server connections in the case of
unspecified connections. The first client that wants to connect to the "MB_RED_SERVER"
instruction is not automatically assigned the connection 0A. Once the assignment of the client
requests to the server connections has taken place, the assignment remains intact during the
frame exchange until the connection is terminated.
Parameter assignment
You can use the MB_RED_SERVER instruction V1.0 and V1.1 for S7-1200. The CPU implements
the connections over the local interface of the CPU or CM/CP. The CPU configures and establishes
the connections using the TCON_IP_V4 structure.
Configuration of MB_RED_SERVER: You make the following settings using the configuration
dialog of the MB_RED_SERVER instruction:
• Connection parameters for the connections 0A, 1A, 0B and 1B (Refer to "Operation and
Redundancy", above, for more information on redundancy configuration.)
• Internal parameter (optional)
You can open the configuration dialog with the MB_RED_SERVER instruction or through the
technology objects:
You can define the HR_Start_Offset tag so that the Modbus holding register has a start address
other than 0.
Example: An offset value of 20 in the HR_Start_Offset parameter means that the start address of
the holding register is moved from 0 to 20. This causes an error whenever you address the
holding register below the address 20 and above the address 119.
Data_Area_Array [1..8]
There are eight data areas available for mapping the MODBUS addresses in the SIMATIC S7
memory. If the data area is defined with the "Holding Register" data type, the MB_HOLD_REG
parameter is not evaluated. Instead, the Modbus master writes or reads the Modbus register and
bits in the data blocks depending on the job type. The CPU can further process these values in
the subsequent execution of the program.
You can only read from one DB or write to one DB with any job. Access to registers or bit values
that are located in several DBs, even if the numbers are in a sequence without gaps, are to be
divided into two jobs. Keep this in mind during configuration. It is possible to map more Modbus
areas (registers or bit values) in one data block than the Modbus master can process with one
frame.
data_type
The data_type parameter specifies which MODBUS data types the Modbus master maps in this
data block. If the value "0" is entered in data_type, the Modbus master does not use the
corresponding data area. If the Modbus master is to use multiple Data_Area, you must define
these one after the other. The Modbus master does not process any entries after a data_type =
0.
db
The db parameter specifies the data block which maps the MODBUS registers or bit values
defined below. The CPU does not permit the DB number 0 because it is reserved for the system.
start, length
start specifies the first Modbus address which the Modbus master maps in data word 0 of the DB.
The parameter length defines the length of how many MODBUS addresses the Modbus master
maps in the data block. The defined data areas must not overlap. The length parameter must not
be 0.
Licensing
The MB_RED_SERVER instruction is subject to a fee, and you must license the instruction on each
CPU individually. Licensing takes place in two steps:
• Displaying the license IDENT_CODE
• Entering the REG_KEY registration key: You must assign the REG_KEY registration key at each
MB_RED_SERVER instruction. Save the REG_KEY in a global data block from which all
MB_RED_SERVER instructions receive the necessary registration key.
Procedure for displaying the license IDENT_CODE:
1. Assign parameters to the MB_RED_SERVER instruction in line with your requirements in a
cyclic OB. Download the program to the CPU and set the CPU to RUN.
2. Open the instance DB of the Modbus instruction, and click the "Monitor all" button.
3. The instance DB displays an 18-digit character string at the IDENT_CODE output.
4. Copy this string using copy/paste from the data block and paste it in the form (that was sent
to you by email after you ordered the product or is included on the CD).
5. Send the form to Customer support (https://support.industry.siemens.com/my/ww/en/
requests/#createRequest) using a service request. You will then receive the registration key
for your CPU.
Procedure for entering the registration key REG_KEY:
1. Insert a new global data block with a unique symbolic name, for example "License_DB", using
"Add new block…".
2. Create a REG_KEY parameter in this block with the data type STRING[17].
3. Copy the transmitted 17-digit registration key using copy/paste to the "Start value" column.
4. In the cyclic OB, enter the name of the license DB and the name of the string (for example,
License_DB.REG_KEY) at the REG_KEY parameter of the MB_RED_SERVER instruction.
5. Download the modified blocks to the CPU. You can enter the registration key during runtime;
a change from STOP to RUN is not necessary.
6. The Modbus/TCP communication using the MB_RED_SERVER instruction is now licensed for
this CPU; the LICENSED output bit is TRUE.
Procedure for correcting missing or incorrect licensing:
• If you enter an incorrect registration key or no registration key, the ERROR LED of the CPU
flashes. In addition, for the S7-1200, the CPU makes a cyclic entry in the diagnostics buffer
regarding the missing license.
• In the case of a missing or incorrect registration key, the CPU processes the Modbus TCP
communication; however, the CPU always displays "W#16#0A90" (No valid license key for
functional package) at the STATUS_x output. The LICENSED output bit is FALSE.
Data_Area_Array [1..8]: To use the optional parameters Data_Area_Array [1..8], refer to the
"Parameter assignment" section above.
Note
You can display the error status codes as integer or hexadecimal values in the program editor:
1. Open the desired block in the programming editor.
2. Switch on the programming status by clicking "Monitor on/off". (If you have not already
established an online connection, the "Go online" dialog opens. In this dialog, you can
establish an online connection.)
3. Select the tag that you want to monitor and select the desired display format in the shortcut
menu under "Display format".
STATUS Description
(W#16#)
0000 Instruction executed without errors.
0001 Connection established.
0003 Connection terminated.
0A90 The instruction MB_RED_SERVER is not licensed. Refer to the "Licensing" section above for
further information.
0AFF The connection is not configured and is not used. The connection 0A must be configured.
7000 No call active and no connection established (REQ=0, DISCONNECT=1).
7001 First call. Connection establishment triggered.
7002 Intermediate call. Connection is being established.
7003 Connection is being terminated.
7005 Data is being sent.
7006 Data is being received.
STATUS Description
(W#16#)
80BB The ActiveEstablished parameter has an invalid value
Only passive connection establishment permitted for server (active_established = FALSE).
8187 The MB_HOLD_REG parameter has an invalid pointer. Data area is too small.
8389 Invalid data area definition:
• Invalid data_type value
• DB number invalid or does not exist:
– Invalid db value
– DB number does not exist
– DB number is already used by another data area
– DB with optimized access
– DB is not located in the work memory
• Invalid length value
• Overlapping of MODBUS address ranges that belong to the same MODBUS data type
Note
Error codes of internally used communication instructions
With the MB_RED_SERVER instruction, in addition to the errors listed in the tables, errors caused
by the communication instructions ("TCON", "TDISCON", "TSEND", "TRCV", "T_DIAG" and
"T_RESET") used by the instruction can occur.
The error codes are assigned via the instance data block of the MB_RED_SERVER instruction. The
error codes are displayed for the respective instruction under STATUS in the "Static" section of the
individual instances.
The meaning of the error codes is available in the documentation of the corresponding
communications instruction.
Note
Communication error when sending or receiving data
If a communication error occurs when sending or receiving data (80C4 (Temporary
communication error. The specified connection is temporarily terminated.), 80C5 (The remote
partner has actively terminated the connection.), 80A1 (The specified connection is
disconnected or is not yet established.)), the CPU terminates the existing connection.
This also means that you can see all STATUS values that are returned when the connection is
terminated and that the STATUS code that caused the connection to be terminated is only output
when the connection is terminated.
Example: If a temporary communication error occurs when data is received, the STATUS 7003
(ERROR=false) is output initially and then 80C4 (ERROR=true).
Network 2: Modbus function 2 - Read 32 input bits from a Modbus TCP server with the IP address
assigned in "Modbus connections".TCPactive_1.
Network 2: Modbus function 3 - Read holding register words from a Modbus TCP server
CONNECT parameter = "Modbus connections".TCPactive_2: Connection ID = 2, RemoteAddress
= 192.168.2.242, RemotePort = 502
Network 2: Modbus function 3 - Read Modbus TCP server holding register words
13.5.3.1 Overview
As of version V4.1 of the S7-1200 CPU together with STEP 7 V13 SP1, the CPU extends the
capability of Modbus RTU to use a PROFINET or PROFIBUS distributed I/O rack to communicate
to various devices (RFID readers, GPS device, and others):
• PROFINET (Page 564): You connect the Ethernet interface of the S7-1200 CPU to a PROFINET
interface module. PtP communication modules in the rack with the interface module can
then provide serial communications to the PtP devices.
• PROFIBUS (Page 739): You insert a PROFIBUS communication module in the left side of the
rack with the S7-1200 CPU. You connect the PROFIBUS communication module to a rack
containing a PROFIBUS interface module. PtP communication modules in the rack with the
interface module can then provide serial communications to the PtP devices.
For this reason, the S7-1200 supports two sets of PtP instructions:
• Legacy Modbus RTU instructions (Page 1100): These Modbus RTU instructions existed prior
to version V4.0 of the S7-1200 and only work with serial communications using a CM 1241
communication module or CB 1241 communication board.
• Modbus RTU instructions (Page 1032): These Modbus RTU instructions provide all of the
functionality of the legacy instructions, plus the ability to connect to PROFINET and PROFIBUS
distributed I/O. These Modbus RTU instructions allow you to configure the communications
between the PtP communication modules in the distributed I/O rack and the PtP devices.
S7‑1200 CM 1241 modules must have a minimum firmware version of V2.1 to use these
Modbus RTU instructions.
352),1(7'HYLFH 352),1(7'HYLFH
(763 ,03167
(703 6&03W356
6&03W3
6&03W3
56
56RU56
56
56
&60
&0 6&38
352),%860DVWHU &%
352),%86 352),1(7
56RU56
352),%86'HYLFH 352),%86'HYLFH
(763 ,03167
6&0
3W356 6&03W3
(703
6&0
3W356
56
56RU56
56
352),%86
Note
With version V4.1 of the S7-1200, you can use the point-to-point instructions for all types of
point-to-point communication: serial, serial over PROFINET, and serial over PROFIBUS. STEP 7
provides the legacy point-to-point instructions only to support existing programs. The legacy
instructions still function, however, with V4.1 CPUs as well as V4.0 and earlier CPUs. You do not
have to convert prior programs from one set of instructions to the other.
In the Instruction task card, display the MODBUS (RTU) instructions in the Communication
processor group.
To change the ver‐
sion of the Mod‐
bus RTU instruc‐
tions, select the
version from the
drop-down list.
You can select the
group or individu‐
al instructions.
When you use the instruction tree to place a Modbus RTU instruction in your program, a new FB
instance is created in the project tree. You can see new FB instance in the project tree under
PLC_x > Program blocks > System blocks > Program resources.
To verify the version of a Modbus RTU instruction in a program, you must inspect project tree
properties and not the properties of a box displayed in the program editor. Select a project tree
Modbus RTU FB instance, right-click, select "Properties", and select the "Information" page to see
the Modbus RTU instruction version number.
Modbus_Comm_Load (Configure SIPLUS I/O or port on the PtP module for Modbus RTU) instruction
An instance data block is assigned for Modbus_Master or Modbus_Slave when you place these
instructions in your program. This instance data block is referenced when you specify the MB_DB
parameter for the Modbus_Comm_Load instruction.
Note
Required setting for the use of PROFIBUS cables with CM 1241 for RS485
Modbus_Master (Communicate using SIPLUS I/O or the PtP port as Modbus RTU master) instruction
• Call all Modbus_Master execution for a given port from a program cycle OB. Modbus_Master
instructions may execute in only one of the program cycle or cyclic/time delay execution
levels. They must not execute in both execution priority levels. Pre-emption of a
Modbus_Master instruction by another Modbus_Master instruction in a higher priority
execution priority level will result in improper operation. Modbus_Master instructions must
not execute in the startup, diagnostic or time error execution priority levels.
• Once a Modbus_Master instruction initiates a transmission, this instance must be continually
executed with the EN input enabled until a DONE=1 state or ERROR=1 state is returned. A
particular Modbus_Master instance is considered active until one of these two events occurs.
While the original instance is active, any call to any other instance with the REQ input enabled
will result in an error. If the continuous execution of the original instance stops, the request
state remains active for a period of time specified by the static variable
"Blocked_Proc_Timeout". Once this period of time expires, the next Modbus_Master
instruction called with an enabled REQ input will become the active instance. This prevents
a single Modbus_Master instance from monopolizing or locking access to a port. If the
original active instance is not enabled within the period of time specified by the static variable
"Blocked_Proc_Timeout", then the next execution by this instance (with REQ not set) will
clear the active state. If (REQ is set), then this execution initiates a new Modbus_Master
request as if no other instance was active.
REQ parameter
0 = No request; 1 = Request to transmit data to Modbus Slave
You may control this input either through the use of a level or edge triggered contact. Whenever
this input is enabled, a state machine is started to ensure that no other Modbus_Master using
the same instance DB is allowed to issue a request, until the current request is completed. All
other input states are captured and held internally for the current request, until the response is
received or an error detected.
If the same instance of Modbus_Master is executed again with REQ input = 1 before the
completion of the current request, then no subsequent transmissions are made. However, when
the request is completed, a new request is issued whenever a Modbus_Master is executed again
with REQ input = 1.
actual Modbus message. The following table shows the correspondence between parameter
MODE, Modbus function code, and Modbus address range.
DATA_PTR parameter
The DATA_PTR parameter points to the DB or M address that is written to or read from. If you use
a data block, then you must create a global data block that provides data storage for reads and
writes to Modbus slaves.
Note
The DATA_PTR data block type must allow direct addressing
The data block must allow both direct (absolute) and symbolic addressing. When you create the
data block the "Standard" access attribute must be selected.
As of Modbus_Master instruction version V4.0 or later, you can enable the data block attribute
"Optimized block access". You can only use a single element, or an array of elements, in
optimized memory with the following data types: Bool, Byte, Char, Word, Int, DWord, Dint, Real,
USInt, UInt, UDInt, SInt, or WChar.
Condition codes
Table 13-84 Modbus_Master execution condition codes (communication and configuration errors) 1
Note
Setting the maximum record length for Profibus communication
When using a CM1243-5 Profibus Master module to control an ET 200SP or ET 200MP Profibus
device that uses an RS232, RS422, or RS485 point-to-point module, you need to explicitly set the
"max_record_len" data block tag to 240 as defined below:
Set "max_record_len" in the Send_P2P section of the instance DB (for example,
"Modbus_Master_DB".Send_P2P.max_record_len) to 240 after running Modbus_Comm_Load.
Explicitly assigning max_record_len is only necessary with Profibus communication; Profinet
communication already uses a valid max_record_len value.
Modbus_Slave (Communicate using SIPLUS I/O or the PtP port as Modbus RTU slave) instruction
Modbus communication function codes (1, 2, 4, 5, and 15) can read and write bits and words
directly in the input process image and output process image of the CPU. For these function
codes, the MB_HOLD_REG parameter must be defined as a data type larger than a byte. The
following table shows the example mapping of Modbus addresses to the process image in the
CPU.
Modbus communication function codes (3, 6, 16) use a Modbus holding register which can be
an M memory address range or a data block. The type of holding register is specified by the
MB_HOLD_REG parameter on the Modbus_Slave instruction.
Note
MB_HOLD_REG data block type
A Modbus holding register data block must allow both direct (absolute) and symbolic
addressing. When you create the data block the "Standard" access attribute must be selected.
As of Modbus_Slave instruction version V4.0 or later, you can enable the data block attribute
"Optimized block access". You can only use a single element, or an array of elements, in
optimized memory with the following data types: Bool, Byte, Char, Word, Int, DWord, Dint, Real,
USInt, UInt, UDInt, SInt, or WChar.
The following table shows examples of Modbus address to holding register mapping that is used
for Modbus function codes 03 (read words), 06 (write word), and 16 (write words). The actual
upper limit of DB addresses is determined by the maximum work memory limit and M memory
limit, for each CPU model.
The Modbus_Slave instruction supports broadcast write requests from any Modbus master as
long as the request is for accessing valid addresses. Modbus_Slave will produce error code
"0x8188" for function codes not supported in broadcast.
• The Modbus instructions do not use communication interrupt events to control the
communication process. Your program must control the communication process by polling
the Modbus_Slave instruction for transmit and receive complete conditions.
• The Modbus_Slaveinstruction must execute periodically at a rate that allows it to make a
timely response to incoming requests from a Modbus_Master. It is recommended that you
execute Modbus_Slave every scan from a program cycle OB. Executing Modbus_Slave from
a cyclic interrupt OB is possible, but is not recommended because of the potential for
excessive time delays in the interrupt routine to temporarily block the execution of other
interrupt routines.
5HVSRQVH
WLPHRXWSHULRG
$'5 )& 'DWD &5& $'5
0DVWHUVHQGV 6ODYHVHQGV
The response timeout period RESP_TO is the amount of time a Modbus_Master waits for the start
of a response from a Modbus_Slave. This time period is not defined by the Modbus protocol, but
is a parameter of each Modbus_Master. The frequency of execution (the time between one
execution and the next execution) of Modbus_Slave must be based upon the particular
parameters of your Modbus_Master. At a minimum, you should execute Modbus_Slave twice
within the response timeout period of the Modbus_Master.
Your program can write data to the control Modbus server operations and the following
variables:
• HR_Start_Offset
• Extended_Addressing
• QB_Start
• QB_Count
• QB_Read_Start
• QB_Read_Count
• IB_Read_Start
• IB_Read_Count
Version requirements for Modbus_Slave instruction data block (DB) variables availability are as
follows:
Table 13-92 Modbus_Slave instruction data block (DB) variables availability version requirements:
Instruction, TIA Portal, and S7‑1200 CPU
Modbus_Slave instruc‐ TIA Portal version S7-1200 CPU firmware Data block variables
tion version (FW) version
3.0 V14 SP1 CPU FW V4.0 or later QB_Start
QB_Count
Modbus_Slave instruc‐ TIA Portal version S7-1200 CPU firmware Data block variables
tion version (FW) version
4.0 or later V15 or later CPU FW V4.2 or later QB_Start
QB_Count
QB_Read_Start
QB_Read_Count
IB_Read_Start
IB_Read_Count
HR_Start_Offset
Modbus holding register addresses begin at 40001 or 400001. These addresses correspond to
the beginning PLC memory address of the holding register. However, you can configure the
"HR_Start_Offset" variable to start the beginning Modbus holding register address at another
value instead of 40001 or 400001.
For example, if the holding register is configured to start at MW100 and is 100 words long. An
offset of 20 specifies a beginning holding register address of 40021 instead of 40001. Any
address below 40021 and above 400119 will result in an addressing error.
HR_Start_Offset is a word value that specifies the starting address of the Modbus holding register
and is stored in the Modbus_Slave instance data block. You can set this public static variable
value by using the parameter helper drop-list, after Modbus_Slave is placed in your program.
For example, after Modbus_Slave is placed in a LAD network, you can go to a previous network
and assign the HR_Start_Offset value. The value must be assigned prior to execution of
Modbus_Slave.
Extended_Addressing
The Extended_Addressing variable is accessed in a similar way as the HR_Start_Offset reference
discussed above except that the Extended_Addressing variable is a Boolean value. The Boolean
value must be written by an output coil and not a move box.
Modbus slave addressing can be configured to be either a single byte (which is the Modbus
standard) or double byte. Extended addressing is used to address more than 247 devices within
a single network. Selecting extended addressing allows you to address a maximum of 64000
addresses. A Modbus function 1 frame is shown below as an example.
Access to data areas in data blocks (DB) instead of direct access to Modbus addresses
As of version V4.0 of the Modbus_Slave instruction and firmware (FW) version V4.2 of the
S7-1200 CPU, you can access data areas in DBs instead of directly accessing process images and
holding registers. In order to do this, in the global DB "Attributes" Property page, you must
deselect the "Only store in load memory" and "Optimized block access" check boxes.
If a Modbus request arrives and you did not define a data area for the Modbus data type of the
corresponding function code, the Modbus_Slave instruction treats the request as in previous
instruction versions: You access process images and holding registers directly.
If you have defined a data area for the Modbus data type of the function code, the Modbus_Slave
instruction reads from or writes to that data area. Whether it reads or writes depends on the job
type.
Note
If a data area is configured, the Modbus_Slave instruction ignores the offsets or ranges
configured by the static variables in the instance data block that corresponds to the data_type
of the data area. Those offsets and ranges only apply to the process image or the memory
referenced by MB_HOLD_REG. The data area start and length parameters provide its own way of
defining offsets and ranges
For one individual Modbus request, you can only read from or write to one data area. If, for
example, you want to read holding registers that extend over multiple data areas, you require
multiple Modbus requests.
These are the rules for defining data areas:
• You can define up to eight data areas in different DBs; each DB must only contain one data
area. An individual MODBUS request can only read from precisely one data area or write to
precisely one data area. Each data area corresponds to one MODBUS address area. You
define the data areas in the "Data_Area_Array" static tag of the instance DB.
• If you want to use less than eight data areas, you must place the required data areas one
behind the other, without any gaps. The first blank entry in the data areas ends the data area
search during processing. If, for example, you define the field elements 1, 2, 4, and 5, the
"Data_Area_Array" only recognizes field elements 1 and 2. as field element 3 is empty.
Condition codes
Table 13-96 Modbus_Slave execution condition codes (communication and configuration errors) 1
Note
Setting the maximum record length for PROFIBUS communication
When using a CM1243-5 PROFIBUS Master module to control an ET 200SP or ET 200MP
PROFIBUS device that uses an RS232, RS422, or RS485 point-to-point module, you need to
explicitly set the "max_record_len" data block tag to 240 as defined below:
Set "max_record_len" in the Send_P2P section of the instance DB (for example,
"Modbus_Slave_DB".Send_P2P.max_record_len) to 240 after running Modbus_Comm_Load.
Explicitly assigning max_record_len is only necessary with PROFIBUS communication; PROFINET
communication already uses a valid max_record_len value.
One Modbus_Master instruction is used in the program cycle OB to communicate with a single
slave. Additional Modbus_Master instructions can be used in the program cycle OB to
communicate with other slaves, or one Modbus_Master FB could be re-used to communicate
with additional slaves.
Network 2: Read 100 words of holding register data from location 400001 on slave #2 to
memory location MW500-MW698.
Network 3: Move the first 3 words of the holding register data that has been read to some other
location, and set a DONE history bit. This network also sets an ERROR history bit and saves the
STATUS word to another location in the event of an error.
Network 4: Write 64 bits of data from MW600-MW607 to output bit locations 00017 to 00081
on slave #2.
Network 5: Set a DONE history bit when the write is complete. If an error occurs, the program
sets an ERROR history bit and saves the STATUS code.
MB_SLAVE shown below is placed in a cyclic OB that is executed every 10 ms. While this does not
give the absolute fastest response by the slave, it does provide good performance at 9600 baud
for short messages (20 bytes or less in the request).
Network 2: Check for Modbus master requests during each scan. The Modbus holding register is
configured for 100 words starting at MW1000.
mode and after a power cycle. See Configuring the communication ports (Page 897) and
Managing flow control (Page 899) for more information.
mode and after a power cycle. See Configuring receive parameters (Page 901) for more
information.
Example
Consider the following received hexadecimal coded message: "68 10 aa 68 bb 10 aa 16" and the
configured start sequences shown in the table below. Start sequences begin to be evaluated
when the first 68H character is successfully received. Upon successfully receiving the fourth
character (the second 68H), then start condition 1 is satisfied. Once the start conditions are
satisfied, the evaluation of the end conditions begins.
The start sequence processing can be terminated due to various parity, framing, or inter-
character timing errors. These errors result in no received message, because the start condition
was not satisfied.
Start condition First Character First Character +1 First Character +2 First Character +3 First Character +4
1 68H xx xx 68H xx
2 10H aaH xx xx xx
3 dcH aaH xx xx xx
4 e5H xx xx xx xx
5(4
'21(
(5525
The following diagram shows how the DONE and STATUS parameters are valid for only one scan
if the REQ line is pulsed (for one scan) to initiate the transmit operation.
5(4
'21(
(5525
The following diagram shows the relationship of DONE, ERROR and STATUS parameters when
there is an error.
5(4
'21(
(5525
The DONE, ERROR and STATUS values are only valid until SEND_PTP executes again with the
same instance DB.
Note the following correlation between the EN_R input and the message buffer of the RCV_PTP
instruction:
Input EN_R controls the copy of a received message to the BUFFER.
When the EN_R input is TRUE and a message is available, the CPU transfers the message from the
CM or CB to the BUFFER and updates the NDR, ERROR, STATUS, and LENGTH outputs.
When EN_R is FALSE, the CPU checks the CM or CB for messages and updates the NDR, ERROR,
and STATUS outputs, but does not transfer the message to the BUFFER. (Note that the default
value of EN_R is FALSE.)
The recommended practice is to set EN_R to TRUE and control execution of the RCV_PTP
instruction with the EN input.
The STATUS value is valid when either NDR or ERROR is TRUE. The STATUS value provides the
reason for termination of the receive operation in the CM or CB. This is typically a positive value,
indicating that the receive operation was successful and that the receive process terminated
normally. If the STATUS value is negative (the Most Significant Bit of the hexadecimal value is
set), the receive operation was terminated for an error condition such as parity, framing, or
overrun errors.
Each PtP communication interface can buffer up to a maximum of 1024 bytes. This could be one
large message or several smaller messages. If more than one message is available in the CM or
CB, the RCV_PTP instruction returns the oldest message available. A subsequent RCV_PTP
instruction execution returns the next oldest message available.
Note
You might want to use the RCV_RST instruction to be sure the message buffers are clear
following a communications error, or after changing a communication parameter such as the
baud rate. Executing RCV_RST causes the module to clear all of the internal message buffers.
After clearing the message buffers, you can be assured that when your program executes a
subsequent receive instruction, the messages it returns are new messages and not old messages
from some time prior to the RCV_RST call.
&0
5656 6
PRGXOHV &38
866
1HW
'ULYHV
866
1HW
'ULYHV
Prior to the release of STEP 7 V13 SP1 and the S7-1200 V4.1 CPUs, the USS communication
instructions existed with different names, and in some cases, slightly different interfaces. The
general concepts apply to both sets of instructions. Refer to the individual legacy USS
instructions for programming information.
Click the icon on the instruction tree task card to enable the headers and columns of
the instruction tree.
When you use the instruction tree to place a USS instruction in your program, a new FB or FC
instance, depending on the USS instruction selected, is created in the project tree. You can see
new FB or FC instance in the project tree under PLC_x > Program blocks > System blocks >
Program resources.
To verify the version of a USS instruction in a program, you must inspect project tree properties
and not the properties of a box displayed in the program editor. Select a project tree USS FB or
FC instance, right-click, select "Properties", and select the "Information" page to see the USS
instruction version number.
866B3257
7KH866B'59B'%GDWDEORFNLVD
866B'59B'% 866B'%
EXIIHUWKDW\RXRQO\DFFHVV
LQGLUHFWO\YLDWKH866LQVWUXFWLRQV
866B'59B'%
5HUVHUYHGIRU
373
&20GDWD
E\WHV
'ULYHGDWD
866B'59B'% &056
RU
866B'59 &%56
(DFKFRPPXQLFDWLRQ
SRUWVXSSRUWVXSWR
GULYHV8VHWRDV
'5,9(
WKH'ULYHSDUDPHWHU
ER[LQSXW
'ULYH
866B530
'ULYH
'5,9(
866B:30
'5,9(
All drives (up to 16) connected to a single RS485 port are part of the same USS network. All drives
connected to a different RS485 port are part of a different USS network. Each USS network is
managed using a unique data block. All instructions associated with a single USS network must
share this data block. This includes all USS_DRV, USS_PORT, USS_RPM, and USS_WPM
instructions used to control all drives on a single USS network.
The USS_DRV instruction is a Function Block (FB). When you place the USS_DRV instruction into
the program editor, you will be prompted by the "Call options" dialog to assign a DB for this FB.
If this is the first USS_DRV instruction in this program for this USS network, then you can accept
the default DB assignment (or change the name if you wish) and the new DB is created for you.
If however this is not the first USS_DRV instruction for this channel, then you must use the drop-
down list in the "Call options" dialog to select the DB name that was previously assigned for this
USS network.
Instructions USS_PORT, USS_RPM, and USS_WPM are all Functions (FCs). No DB is assigned when
you place these FCs in the editor. Instead, you must assign the appropriate DB reference to the
"USS_DB" input of these instructions. Double-click on the parameter field and then click on the
parameter helper icon to see the available DB names).
The USS_PORT function handles the actual communication between the CPU and the drives via
the Point-to-Point (PtP) RS485 communication port. Each call to this function handles one
communication with one drive. Your program must call this function fast enough to prevent a
communication timeout by the drives. You may call this function in a main program cycle OB or
any interrupt OB.
Typically, you should call the USS_PORT function from a cyclic interrupt OB. The cycle time of the
cyclic interrupt OB should be set to about half of the minimum call interval (As an example, 1200
baud communication should use a cyclic time of 350 ms or less).
The USS_DRV function block provides your program access to a specified drive on the USS
network. Its inputs and outputs are the status and controls for the drive. If there are 16 drives on
the network, your program must have at least 16 USS_DRV calls, one for each drive. These blocks
should be called at the rate that is required to control the operation of the drive.
You may only call the USS_DRV function block from a main program cycle OB.
CAUTION
Considerations in calling USS instructions from OBs
Only call USS_DRV, USS_RPM, and USS_WPM from a main program cycle OB. The USS_PORT
function can be called from any OB, usually from a cyclic interrupt OB.
Do not use instructions USS_DRV, USS_RPM, or USS_WPM in a higher priority OB than the
corresponding USS_PORT instruction. For example, do not place the USS_PORT in the main and
a USS_RPM in a cyclic interrupt OB. Failure to prevent interruption of USS_PORT execution can
produce unexpected errors, which could result in personal injury.
The USS_RPM and USS_WPM functions read and write the remote drive operating parameters.
These parameters control the internal operation of the drive. See the drive manual for the
definition of these parameters. Your program can contain as many of these functions as
necessary, but only one read or write request can be active per drive, at any given time. You may
only call the USS_RPM and USS_WPM functions from a main program cycle OB.
more frequently than the USS_PORT interval will not increase the number of transactions. The
drive timeout interval is the amount of time that might be taken for a transaction, if
communications errors caused 3 tries to complete the transaction. By default, the USS protocol
library automatically does up to 2 retries on each transaction.
Baud rate Calculated minimum USS_PORT call Drive message interval timeout per
Interval ( milliseconds ) drive ( milliseconds )
1200 790 2370
2400 405 1215
4800 212.5 638
9600 116.3 349
19200 68.2 205
38400 44.1 133
57600 36.1 109
115200 28.1 85
Typically, there is only one USS_PORT instruction per PtP communication port in the program,
and each call of this function handles a transmission to or from a single drive. All USS functions
associated with one USS network and PtP communication port must use the same instance DB.
Your program must execute the USS_PORT instruction often enough to prevent drive timeouts.
USS_PORT is usually called from a cyclic interrupt OB to prevent drive timeouts and keep the most
recent USS data updates available for USS_DRV calls.
When the initial USS_DRV execution occurs, the drive indicated by the USS address (parameter
DRIVE) is initialized in the Instance DB. After this initialization, subsequent executions of
USS_PORT can begin communication to the drive at this drive number.
Changing the drive number requires a CPU STOP-to-RUN mode transition that initializes the
instance DB. Input parameters are configured into the USS TX message buffer and outputs are
read from a "previous" valid response buffer if any exists. There is no data transmission during
USS_DRV execution. Drives communicate when USS_PORT is executed. USS_DRV only
configures the messages to be sent and interprets data that might have been received from a
previous request.
You can control the drive direction of rotation using either the DIR input (Bool) or using the sign
(positive or negative) with the SPEED_SP input (Real). The following table indicates how these
inputs work together to determine the drive direction, assuming the motor is wired for forward
rotation.
Note
EEPROM write operations (for the EEPROM inside a USS drive)
Do not overuse the EEPROM permanent write operation. Minimize the number of EEPROM write
operations to extend the EEPROM life.
STATUS Description
(W#16#....)
0000 No error
8180 The length of the drive response did not match the characters received from the drive. The drive number
where the error occurred is returned in the "USS_Extended_Error" variable. See the extended error descrip‐
tion below this table.
8181 VALUE parameter was not a Word, Real or DWord data type.
8182 The user supplied a Word for a parameter value and received a DWord or Real from the drive in the response.
8183 The user supplied a DWord or Real for a parameter value and received a Word from the drive in the response.
8184 The response telegram from drive had a bad checksum. The drive number where the error occurred is
returned in the "USS_Extended_Error" variable. See the extended error description below this table.
8185 Illegal drive address (valid drive address range: 1 to16)
8186 The speed set point is out of the valid range (valid speed SP range: -200% to 200%).
8187 The wrong drive number responded to the request sent. The drive number where the error occurred is
returned in the "USS_Extended_Error" variable. See the extended error description below this table.
8188 Illegal PZD word length specified (valid range = 2, 4, 6 or 8 words)
8189 Illegal Baud Rate was specified.
818A The parameter request channel is in use by another request for this drive.
818B The drive has not responded to requests and retries. The drive number where the error occurred is returned
in the "USS_Extended_Error" variable. See the extended error description below this table.
818C The drive returned an extended error on a parameter request operation. See the extended error description
below this table.
818D The drive returned an illegal access error on a parameter request operation. See your drive manual for
information of why parameter access may be limited.
STATUS Description
(W#16#....)
818E The drive has not been initialized. This error code is returned to USS_RPM or USS_WPM when USS_DRV, for
that drive, has not been called at least once. This keeps the initialization on first scan of USS_DRV from
overwriting a pending parameter read or write request, since it initializes the drive as a new entry. To fix this
error, call USS_DRV for this drive number.
80Ax-80Fx Specific errors returned from PtP communication FBs called by the USS Library - These error code values are
not modified by the USS library and are defined in the PtP instruction descriptions.
1
In addition to the USS instruction errors listed above, errors can be returned from the
underlying PtP communication instructions.
For several STATUS codes, additional information is provided in the "USS_Extended_Error"
variable of the USS_DRV Instance DB. For STATUS codes hexadecimal 8180, 8184, 8187, and
818B, USS_Extended_Error contains the drive number where the communication error
occurred. For STATUS code hexadecimal 818C, USS_Extended_Error contains a drive error code
returned from the drive when using a USS_RPM or USS_WPM instruction.
13.8.1 Overview
Prior to the release of STEP 7 V13 SP1 and the S7-1200 V4.1 CPUs, the Modbus TCP
communication instructions existed with different names, and in some cases, slightly different
interfaces. The general concepts apply to both sets of instructions. Refer to the individual legacy
Modbus TCP instructions for programming information.
In the Instruction task card, display the MODBUS TCP instructions under "Others" in the Com‐
munication group.
To change the version of the Modbus
TCP instructions, select the version
from the drop-down list. You can se‐
lect the group or individual instruc‐
tions.
When you use the instruction tree to place a Modbus TCP instruction in your program, a new FB
instance is created in the project tree. You can see new FB instance in the project tree under
PLC_x > Program blocks > System blocks > Program resources.
To verify the version of a Modbus TCP instruction in a program, you must inspect project tree
properties and not the properties of a box displayed in the program editor. Select a project tree
Modbus TCP FB instance, right-click, select "Properties", and select the "Information" page to see
the Modbus TCP instruction version number.
REQ parameter
FALSE = No Modbus communication request
TRUE = Request to communicate with a Modbus TCP server
If no instance of MB_CLIENT is active and parameter DISCONNECT=0, when REQ=1 a new
Modbus request will start. If the connection is not already established then a new connection
will be made.
If the same instance of MB_CLIENT is executed again with DISCONNECT=0 and REQ=1, before
the completion of the current request, then no subsequent Modbus transmission will be made.
However, as soon as the current request is completed, a new request can be processed if
MB_CLIENT is executed with REQ=1.
When the current MB_CLIENT communication request is complete, the DONE bit is TRUE for one
cycle. The DONE bit can be used as a time gate to sequence multiple MB_CLIENT requests.
Note
Input data consistency during MB_CLIENT processing
Once a Modbus client initiates a Modbus operation, all the input states are saved internally and
are then compared on each successive call. The comparison is used to determine if this particular
call was the originator of the active client request. More than one MB_CLIENT call can be
performed using a common instance DB.
As a result, it is important that the inputs are not changed during the period of time that a
MB_CLIENT operation is actively being processed. If this rule is not followed, then a MB_CLIENT
cannot determine that it is the active instance.
Note
MB_DATA_PTR assigns a buffer to store data read/written to/from a Modbus TCP server
The data buffer can be in a non-optimized global DB or M memory address.
For a buffer in M memory, use the standard Any Pointer format. This is in the format P#"Bit
Address" "Data Type" "Length", an example would be P#M1000.0 WORD 500.
Table 13-139 MB_CLIENT instance data block user accessible static variables
NOTICE
Security information
Note that each client of the network is given read and write access to the process image inputs
and outputs and to the data block or bit memory area defined by the Modbus holding register.
The option is available to restrict access to an IP address to prevent unauthorized read and write
operations. Note, however, that the shared address can also be used for unauthorized access.
MB_SERVER allows incoming Modbus function codes (1, 2, 4, 5, and 15) to read or write bits and
words directly in the input process image and output process image of the S7-1200 CPU. For data
transfer function codes (3, 6, and 16), the MB_HOLD_REG parameter must be defined as a data
type larger than a byte. The following table shows the mapping of Modbus addresses to the
process image in the CPU.
Incoming Modbus message function codes function codes (3, 6, and 16) read or write words in
a Modbus holding register which can be an M memory address range or a data block. The type
of holding register is specified by the MB_HOLD_REG parameter.
Note
MB_HOLD_REG parameter assignment
The Modbus Holding Register can be in a non-optimized global DB or an M memory address.
For A Modbus holding register in M memory, use the standard Any Pointer format. This is in the
format P#"Bit Address" "Data Type" "Length". An example would be P#M1000.0 WORD 500
The following table shows examples of Modbus address to holding register mapping used for
Modbus function codes 03 (read words), 06 (write word), and 16 (write words). The actual
upper limit of DB addresses is determined by the maximum work memory limit and M memory
limit, for each CPU model.
MB_SERVER variables
This table shows the public static variables stored in the MB_SERVER instance data block that can
be used in your program
Your program can write values to the HR_Start_Offset and control Modbus server operations.
The other variables can be read to monitor Modbus status.
HR_Start_Offset
Modbus holding register addresses begin at 40001. These addresses correspond to the
beginning PLC memory address of the holding register. However, you can configure the
"HR_Start_Offset" variable to start the beginning Modbus holding register address at another
value instead of 40001.
For example, if the holding register is configured to start at MW100 and is 100 words long. An
offset of 20 specifies a beginning holding register address of 40021 instead of 40001. Any
address below 40021 and above 40119 will result in an addressing error.
HR_Start_Offset is a word value that specifies the starting address of the Modbus holding register
and is stored in the MB_SERVER instance data block. You can set this public static variable value
by using the parameter helper drop-list, after MB_SERVER is placed in your program.
For example, after MB_SERVER is placed in a LAD network, you can go to a previous network and
assign the HR_Start_Offset value. The value must be assigned prior to execution of MB_SERVER.
13.8.4.2 Example: Legacy MB_CLIENT 1: Multiple requests with common TCP connection
Multiple Modbus client requests can be sent over the same connection. To accomplish this, use
the same instance DB, connection ID, and port number.
Only 1 client can be active at any given time. Once a client completes its execution, the next
client begins execution. Your program is responsible for the order of execution.
The example shows both clients writing to the same memory area. Also, a returned error is
captured which is optional.
Network 1: Modbus function 1 - Read 16 output image bits
13.8.4.3 Example: Legacy MB_CLIENT 2: Multiple requests with different TCP connections
Modbus client requests can be sent over different connections. To accomplish this, different
instance DBs, IP addresses, and connection IDs must be used.
The port number must be different if the connections are established to the same Modbus
server. If the connections are on different servers, there is no port number restriction.
The example shows both clients writing to the same memory area. Also, a returned error is
captured which is optional.
Network 1:
Modbus function 4 - Read input words (in S7-1200 memory)
Network 2: Modbus function 3 - Read holding register words from a Modbus TCP server
13.9.1 Overview
Prior to the release of STEP 7 V13 SP1 and the S7-1200 V4.1 CPUs, the Modbus RTU
communication instructions existed with different names, and in some cases, slightly different
interfaces. The general concepts apply to both sets of instructions. Refer to the individual legacy
Modbus RTU instructions for programming information.
In the Instruction task card, display the MODBUS instructions in the Communication processor
group.
To change the version of the Modbus instruc‐
tions, select the version from the drop-down
list. You can select the group or individual in‐
structions.
When you use the instruction tree to place a Modbus instruction in your program, a new FB
instance is created in the project tree. You can see new FB instance in the project tree under
PLC_x > Program blocks > System blocks > Program resources.
To verify the version of a Modbus instruction in a program, you must inspect project tree
properties and not the properties of a box displayed in the program editor. Select a project tree
Modbus FB instance, right-click, select "Properties", and select the "Information" page to see the
Modbus instruction version number.
13.9.3.1 MB_COMM_LOAD (Configure port on the PtP module for Modbus RTU)
An instance data block is assigned for MB_MASTER or MB_SLAVE when you place these
instructions in your program. This instance data block is referenced when you specify the MB_DB
parameter for the MB_COMM_LOAD instruction.
13.9.3.2 MB_MASTER (Communicate using the PtP port as Modbus RTU master)
REQ parameter
0 = No request; 1 = Request to transmit data to Modbus Slave
You may control this input either through the use of a level or edge triggered contact. Whenever
this input is enabled, a state machine is started to ensure that no other MB_MASTER using the
same instance DB is allowed to issue a request, until the current request is completed. All other
input states are captured and held internally for the current request, until the response is
received or an error detected.
If the same instance of MB_MASTER is executed again with REQ input = 1 before the completion
of the current request, then no subsequent transmissions are made. However, when the request
is completed, a new request is issued whenever MB_MASTER is executed again with REQ input
= 1.
The MB_MASTER instruction uses a MODE input rather than a Function Code input. The
combination of MODE and Modbus address determine the Function Code that is used in the
actual Modbus message. The following table shows the correspondence between parameter
MODE, Modbus function code, and Modbus address range.
DATA_PTR parameter
The DATA_PTR parameter points to the DB or M address that is written to or read from. If you use
a data block, then you must create a global data block that provides data storage for reads and
writes to Modbus slaves.
Note
The DATA_PTR data block type must allow direct addressing
The data block must allow both direct (absolute) and symbolic addressing. When you create the
data block the "Standard" access attribute must be selected.
Condition codes
Table 13-158 MB_MASTER execution condition codes (communication and configuration errors) 1
13.9.3.3 MB_SLAVE (Communicate using the PtP port as Modbus RTU slave)
Modbus communication function codes (1, 2, 4, 5, and 15) can read and write bits and words
directly in the input process image and output process image of the CPU. For these function
codes, the MB_HOLD_REG parameter must be defined as a data type larger than a byte. The
following table shows the example mapping of Modbus addresses to the process image in the
CPU.
Modbus communication function codes (3, 6, 16) use a Modbus holding register which can be
an M memory address range or a data block. The type of holding register is specified by the
MB_HOLD_REG parameter on the MB_SLAVE instruction.
Note
MB_HOLD_REG data block type
A Modbus holding register data block must allow both direct (absolute) and symbolic
addressing. When you create the data block the "Standard" access attribute must be selected.
The following table shows examples of Modbus address to holding register mapping that is used
for Modbus function codes 03 (read words), 06 (write word), and 16 (write words). The actual
upper limit of DB addresses is determined by the maximum work memory limit and M memory
limit, for each CPU model.
The MB_SLAVE instruction supports broadcast write requests from any Modbus master as long
as the request is for accessing valid addresses. MB_SLAVE will produce error code 0x8188 for
function codes not supported in broadcast.
5HVSRQVH
WLPHRXWSHULRG
$'5 )& 'DWD &5& $'5
0DVWHUVHQGV 6ODYHVHQGV
The response timeout period RESP_TO is the amount of time a Modbus master waits for the start
of a response from a Modbus slave. This time period is not defined by the Modbus protocol, but
is a parameter of each Modbus master. The frequency of execution (the time between one
execution and the next execution) of MB_SLAVE must be based on the particular parameters of
your Modbus master. At a minimum, you should execute MB_SLAVE twice within the response
timeout period of the Modbus master.
Your program can write values to the HR_Start_Offset and Extended_Addressing variables and
control Modbus slave operations. The other variables can be read to monitor Modbus status.
HR_Start_Offset
Modbus holding register addresses begin at 40001 or 400001. These addresses correspond to
the beginning PLC memory address of the holding register. However, you can configure the
"HR_Start_Offset" variable to start the beginning Modbus holding register address at another
value instead of 40001 or 400001.
For example, if the holding register is configured to start at MW100 and is 100 words long. An
offset of 20 specifies a beginning holding register address of 40021 instead of 40001. Any
address below 40021 and above 400119 will result in an addressing error.
HR_Start_Offset is a word value that specifies the starting address of the Modbus holding register
and is stored in the MB_SLAVE instance data block. You can set this public static variable value
by using the parameter helper drop-list, after MB_SLAVE is placed in your program.
For example, after MB_SLAVE is placed in a LAD network, you can go to a previous network and
assign the HR_Start_Offset value. The value must be assigned prior to execution of MB_SLAVE.
Extended_Addressing
The Extended_Addressing variable is accessed in a similar way as the HR_Start_Offset reference
discussed above except that the Extended_Addressing variable is a Boolean value. The Boolean
value must be written by an output coil and not a move box.
Modbus slave addressing can be configured to be either a single byte (which is the Modbus
standard) or double byte. Extended addressing is used to address more than 247 devices within
a single network. Selecting extended addressing allows you to address a maximum of 64000
addresses. A Modbus function 1 frame is shown below as an example.
Condition codes
Table 13-169 MB_SLAVE execution condition codes (communication and configuration errors) 1
One MB_MASTER instruction is used in the program cycle OB to communicate with a single slave.
Additional MB_MASTER instructions can be used in the program cycle OB to communicate with
other slaves, or one MB_MASTER FB could be re-used to communicate with additional slaves.
Network 2: Read 100 words of holding register data from location 400001 on slave #2 to
memory location MW500-MW698.
Network 3: Move the first 3 words of the holding register data that has been read to some other
location, and set a DONE history bit. This network also sets an ERROR history bit and saves the
STATUS word to another location in the event of an error.
Network 4: Write 64 bits of data from MW600-MW607 to output bit locations 00017 to 00081
on slave #2.
Network 5: Set a DONE history bit when the write is complete. If an error occurs, the program
sets an ERROR history bit and saves the STATUS code.
Execution of MB_COMM_LOAD in this manner should only be done when the serial port
configuration will change at runtime, as a result of HMI configuration.
Network 1: Initialize the RS485 module parameters each time they are changed by an HMI
device.
MB_SLAVE shown below is placed in a cyclic OB that is executed every 10ms. While this does not
give the absolute fastest response by the slave, it does provide good performance at 9600 baud
for short messages (20 bytes or less in the request).
Network 2: Check for Modbus master requests during each scan. The Modbus holding register is
configured for 100 words starting at MW1000.
• CP 1243‑1 IEC:
– Article number: 6GK7 243‑1PX30‑0XE0
– Communications processor for connecting SIMATIC S7-1200 to control centers using the
IEC 60870‑5 protocol
– You communicate between the CP and CPU using configurable data points that access PLC
tags.
• CP 1243‑1 PCC:
– Article number: 6GK7 243‑1HX30‑0XE0
– Communications processor for connecting SIMATIC S7-1200 to control centers using
Plant Cloud Communication (PCC)
– You communicate between the CP and CPU using configurable data points that access PLC
tags.
• CP 1242‑7:
– Article number: 6GK7 242‑7KX31‑0XE0
– Communications processor for connecting the SIMATIC S7-1200 to a control center with
TeleControl Server Basic using mobile wireless (GPRS) and the public infrastructure (DSL)
• CP 1242‑7 GPRS V2:
– Article number: 6GK7 242‑7KX31‑0XE0
– Communications processor for connecting the SIMATIC S7-1200 to a control center with
TeleControl Server Basic (TCSB version v3) using mobile wireless (GPRS) and the public
infrastructure (DSL)
– With the help of VPN technology and the firewall, the CP allows protected access to the
S7-1200.
– You can use the CP as an additional Ethernet interface of the CPU for S7 communication.
– You communicate between the CP and CPU using configurable data points that access PLC
tags.
• CP 1243‑7 LTE-xx:
– Communications processor for connecting the SIMATIC S7-1200 to a control center with
TeleControl Server Basic (TCSB version v3) using mobile wireless (GPRS) and the public
infrastructure (DSL)
– Support of the following mobile wireless specifications: GSM/GPRS, UMTS (G3), LTE
– To cover countries with different mobile wireless specifications, the CP is available in two
variants:
- CP 1243‑7 LTE‑US:
- North American standard
- Article number: 6GK7 243‑7SX30‑0XE0
- CP 1243‑7 LTE‑EU:
- Western European standard
- Article number: 6GK7 243‑7KX30‑0XE0
– With the help of VPN technology and the firewall, the CP allows protected access to the
S7-1200.
– You can use the CP as an additional Ethernet interface of the CPU for S7 communication.
– You communicate between the CP and CPU using configurable data points that access PLC
tags.
• CP 1243‑8 IRC:
– Article number: 6GK7 242‑8RX30‑0XE0
– Communications processor for connecting the SIMATIC S7-1200 to an ST7 network, data
point configuration, and VPN
Note
You must have TeleControl Server Basic software for TeleControl applications for CPs other than
the CP 1243‑1.
Secure communication
The well-proven SINAUT ST7 protocol or the standardized DNP3 or IEC 60870‑5 protocol adds
security to Industrial Remote Communication (https://w3app.siemens.com/mcms/infocenter/
dokumentencenter/sc/ic/InfocenterLanguagePacks/Netzwerksicherheit/
6ZB5530-1AP02-0BA4_BR_Network_Security_en_112015.pdf). The TeleControl solution
provides comprehensive measures to prevent data falsification and loss. Each transmission
module has a large memory for several thousand data frames, which offers the ability to bridge
downtimes in the transmission link. Dedicated VPN solutions protect special IP-based networks.
The CP 1243-1 communications processor securely connects the SIMATIC S7‑1200 controller to
Ethernet networks. With its integrated firewall (Stateful Inspection) and VPN protocol (IPsec)
security functions, the communications processor helps protect S7‑1200 stations and lower-
level networks against unauthorized access and helps protect data transmission against
manipulation and espionage by encryption. Furthermore, the CP can also be used for integrating
the S7-1200 station into the TeleControl Server Basic control center software using IP-based
remote networks.
Requirements
The equipment used in the stations or the control center depends on the particular application.
• For communication with or via a central control room, the control center requires a PC with
Internet access.
• Apart from the station equipment, a remote S7‑1200 station with a CP 1242‑7 must meet the
following requirements to be able to communicate via the GSM network:
– A contract with a suitable GSM network provider
If GPRS is used, the contract must allow the use of the GPRS service.
If there is to be direct communication between stations only via the GSM network, the
GSM network provider must assign a fixed IP address to the CPs. In this case,
communication between stations is not via the control center.
– The SIM card belonging to the contract
The SIM card is inserted in the CP 1242‑7.
– Local availability of a GSM network in the range of the station
Telecontrol applications
• Sending messages by SMS
Via the CP 1242‑7, the CPU of a remote S7‑1200 station can receive SMS messages from the
GSM network or send messages by SMS to a configured mobile phone or an S7‑1200.
• Communication with a control center
Remote S7-1200 stations communicate via the GSM network and the Internet with a
telecontrol server in the master station. For data transfer using GPRS, the "TELECONTROL
SERVER BASIC" application is installed on the telecontrol server in the master station. The
telecontrol server communicates with a higher-level central control system using the
integrated OPC server function.
• Communication between S7‑1200 stations via a GSM network
Communication between remote stations with a CP 1242‑7 can be handled in two different
ways:
– Inter-station communication via a master station
In this configuration, a permanent secure connection between S7-1200 stations that
communicate with each other and the telecontrol server is established in the master
station. Communication between the stations is via the telecontrol server. The CP 1242‑7
operates in "Telecontrol" mode.
– Direct communication between the stations
For direct communication between stations without the detour via the master station,
SIM cards with a fixed IP address are used that allow the stations to address each other
directly. The possible communications services and security functions (for example VPN)
depend on what is offered by the network provider. The CP 1242‑7 operates in "GPRS
direct" mode.
13.10.6 Accessories
0RELOHSKRQH
*356 RU6ಣVWDWLRQ
6ಣZLWK
6WDWLRQ &3ಣ
A SIMATIC S7‑1200 with a CP 1242‑7 can send messages by SMS to a mobile phone or a
configured S7‑1200 station.
7HOHFRQWUROVHUYHUZLWK
DSSOLFDWLRQ
7(/(&21752/
6(59(5%$6,&
&RQWUROFHQWHU '6/URXWHU
,QWHUQHW
,QGXVWULDO(WKHUQHW
*356
application is installed on the telecontrol server in the master station. This results in the
following use cases:
• Telecontrol communication between station and control center
In this use case, data from the field is sent by the stations to the telecontrol server in the
master station via the GSM network and Internet. The telecontrol server is used to monitor
remote stations.
• Communication between a station and a control room with OPC client
As in the first case, the stations communicate with the telecontrol server. Using its integrated
OPC server, the telecontrol server exchanges data with the OPC client of the control room.
The OPC client and telecontrol server can be located on a single computer, for example when
TCSB is installed on a control center computer with WinCC.
• Inter-station communication via a control center
Inter-station communication is possible with S7 stations equipped with a CP 1242-7.
To allow inter-station communication, the telecontrol server forwards the messages of the
sending station to the receiving station.
1HWZRUNSURYLGHUDVVLJQVIL[HG
,3DGGUHVVHV
*356
&3ZLWKIL[HG &3ZLWKIL[HG
,3DGGUHVV ,3DGGUHVV
6ಣZLWK 6ಣZLWK
6WDWLRQ &3ಣ 6WDWLRQ &3ಣ
In this configuration, two SIMATIC S7‑1200 stations communicate directly with each other using
the CP 1242‑7 via the GSM network. Each CP 1242‑7 has a fixed IP address. The relevant service
of the GSM network provider must allow this.
(QJLQHHULQJVWDWLRQ 7HOHFRQWUROVHUYHUZLWKDSSOLFDWLRQ
ZLWK67(3 7(/(&21752/6(59(5%$6,& ,QWHUQHW
'6/URXWHU
*356
,QGXVWULDO(WKHUQHW
6ಣZLWK
6WDWLRQ &3ಣ
(QJLQHHULQJVWDWLRQ (QJLQHHULQJVWDWLRQ
ZLWK67(3 ZLWK67(3
7HOH6HUYLFHJDWHZD\
,QWHUQHW
'6/URXWHU
*356
,QGXVWULDO(WKHUQHW 6ಣZLWK
6WDWLRQ &3ಣ
Note
TM_MAIL sends a mail message over TCP/IP using the Ethernet interface of the CPU. To send a
mail message over a CP interface (with or without SSL) use the instruction TMAIL_C (Send an
email using the Ethernet interface of the CPU) instruction (Page 648).
If the CPU is changed to STOP mode while TM_MAIL is active, then the communication
connection to the email server is terminated. The communication connection to the email
server is also lost if problems occur in CPU communication on the Industrial Ethernet bus. In
these cases, the send process is suspended and the email does not reach the recipient.
NOTICE
Modifying user programs
Deletion and replacement of program blocks, the calls to TM_MAIL, or calls to the instance DBs
of TM_MAIL can break the linking of program blocks. If you fail to maintain linked program
blocks, then the TPC/IP communication functions can enter an undefined state, possibly
resulting in property damage. After transferring a modified program block, you would have to
perform a CPU restart (warm) or cold start.
To avoid breaking the linking of program blocks, only change the parts of your user program
that directly affect the TM_MAIL calls in the following cases:
• The CPU in the STOP mode
• No email is sent (REQ and BUSY = 0)
Data consistency
The input parameter ADDR_MAIL_SERVER is read when the operation is started. A new value
does not take effect until the current operation is complete and a new TM_MAIL operation is
initiated.
In contrast, the parameters WATCH_DOG_TIME, TO_S, CC, FROM, SUBJECT, TEXT, ATTACHMENT,
USERNAME and PASSWORD are read during the execution of TM_MAIL and may be changed only
when the job is finished (BUSY = 0)
SMTP authentication
TM_MAIL supports the SMTP AUTH LOGIN authentication method. For information on this
authentication method, please refer to the manual of the mail server or the website of your
internet service provider.
The AUTH LOGIN authentication method uses the TM_MAIL USERNAME and PASSWORD
parameters to connect with the mail server. The user name and password must be previously set
up on an email account at an email server.
If no value is assigned for the USERNAME parameter, then the AUTH LOGIN authentication
method is not used and the email is sent without authentication.
Note
Email server requirements
TM_MAIL can only communicate with an email server using SMTP via port 25. The assigned port
number cannot be changed.
Most IT departments and external email servers now block port 25 to prevent a PC infected with
a virus from becoming a rogue email generator.
You can connect to an internal mail server via SMTP and let the internal server manage the
current security enhancements that are required to relay email through the Internet to an
external mail server.
Configure a compatible email server account to accept remote SMTP log in. Then edit the
instance DB for TM_MAIL to put in the TM_MAIL USERNAME and PASSWORD character strings
that are used to authenticate the connection with your email account.
Note
Possible unreported email transmission errors
• Incorrect entry of a recipient address does not generate a STATUS error for TM_MAIL. In this
case, there is no guarantee that additional recipients (with correct email addresses), will
receive the email.
• More information on SMTP error codes can be found on the internet or in the error
documentation for the mail server. You can also read the last error message from the mail
server. The error message is stored in buffer1parameter of the instance DB for TM_MAIL.
The CPU also provides two LEDs that indicate the status of the PROFINET communications. Open
the bottom terminal block cover to view the PROFINET LEDs.
• Link (green) turns on to indicate a successful connection
• Rx/Tx (yellow) turns on to indicate transmission activity
The CPU and each digital signal module (SM) provide an I/O Channel LED for each of the digital
inputs and outputs. The I/O Channel (green) turns on or off to indicate the state of the individual
input or output.
WARNING
Operation in defect state cannot be guaranteed
Control devices can fail in an unsafe condition, resulting in unexpected operation of controlled
equipment. Such unexpected operations could result in death or serious injury to personnel,
and/or damage to equipment.
Use an emergency stop function, electromechanical overrides or other redundant safeguards
that are independent of the PLC.
Module error
Power supply errors are reported as follows:
An analog input module with a diagnostic error on any channel reports 32767 or -32768 on that
channel even if the diagnostics is not enabled. Analog input channels report 32767 when
dectivated.
Analog input modules can have diagnostic errors on more than one channel at a time (multiple
errors). When this occurs, only the first error is reported to the CPU. After the first error is
reported, no additional errors are reported until the cause of the first error is cleared in the
module. After the first error is cleared, the second error is then reported if the error condition still
exists.
If the CPU has protection of confidential PLC configuration data, you might be prompted to trust
the CPU. You can display and verify the CPU's certificate and decide whether to trust the CPU
online connection or abort the connection.
After connection, the orange color frames indicate an online connection. You can now use the
Online & diagnostics tools from the Project tree and the Online tools task card.
See also
Protection of confidential PLC configuration data (Page 150)
memory (for example, an ET200 S interface module configuration memory). If a name is missing
or does not match in either location, the PROFINET IO data exchange mode will not run.
You can set the IP address (Page 571) and time of day in the online CPU. After accessing "Online
& diagnostics" from the Project tree for an online CPU, you can display or change the IP address.
You can also display or set the time and date parameters of the online CPU.
Note
This feature is available only for a CPU that either has only a MAC address (has not yet been
assigned an IP address) or has been reset to factory settings.
5. Select a file that is compatible with your module. For a selected file, the table displays the
compatible modules.
6. Click the "Run update" button. Follow the dialogs, if necessary, to change the operating mode
of your CPU.
STEP 7 displays progress dialogs as it loads the firmware update. When it finishes, it prompts you
to start the module with the new firmware.
Note
If you do not choose to start the module with the new firmware, the previous firmware remains
active until you reset the module, for example by cycling power. The new firmware becomes
active only after you reset the module.
Procedure
To reset a CPU to its factory settings, follow these steps:
1. Open the Online & Diagnostics view of the CPU.
2. Select "Reset to factory settings" from the "Functions" folder.
3. Select the "Delete IP address" check box if you want to delete the IP address.
4. Select the "Delete password for protection of confidential PLC configuration data" check box
if you want to delete that password. You might want to delete the password for example, if
you plan to load a new project to the CPU or replace the CPU with a new device (Page 1379).
5. Select the "Format memory card" check box if you want to format the memory card that is
currently inserted in the online CPU. If you are running your CPU program from the memory
card and you want to format the program, select this check box.
6. Click the "Reset PLC" button.
7. Acknowledge the confirmation prompt with "Yes" to confirm that you want to reset the
module with your settings.
Result
The module switches to STOP mode if necessary, and it resets the factory settings. The online
CPU performs the following actions:
• Deletes the work memory and retentive data areas
• Deletes the load memory if it is internal load memory; deletes load memory on SIMATIC
memory card ONLY if you also selected "Format memory card"
• Sets all parameters and operand areas to their configured values
• Clears the diagnostics buffer
• Resets the time of day
• Deletes the I&M (Identification and Maintenance) data except for I&M0
• Resets the runtime meters
• Retains or deletes the IP address based on the selection you made. (The MAC address is fixed
and is never changed.)
If you did not select "Delete IP address", the CPU retains the IP address, subnet mask, and
router address (if used) from the settings in your hardware configuration, unless you have
modified these values from the user program or another tool, in which case the CPU restores
the modified values.
• Deletes the control data record (Page 133), if present
• Deletes or retains the password for protection of confidential PLC configuration data,
depending on your setting
• Formats the memory card if a memory card is installed in the online CPU and you selected the
option to format the memory card
"Online data"
The "Online data" area shows the following data of the module:
• Article number (order number)
• Firmware version
• Module name (you configured this while configuring the hardware.)
• Rack
• Slot
Note
Formatting a memory card has no effect on the contents of internal load memory.
If the CPU was using internal load memory when you inserted the memory card and you did not
restart the CPU between inserting the card and executing the format operation, the CPU retains
the contents of internal load memory.
The "CPU operator panel" displays the operating mode (STOP or RUN) of
the online CPU. The panel also shows whether the CPU has an error or if
values are being forced.
Use the CPU operating panel of the Online Tools task card to change the operating mode of an
online CPU. The Online Tools task card is accessible whenever the CPU is online.
You can also use the GET_DIAG instruction (Page 432) to collect the diagnostic information.
Note
Read access required on protected CPU for the Offline/Online compare operations
For STEP 7 V14 or later versions, the "HMI access" security level is insufficient to perform the
Offline/Online compare operations. You must have "Read access" or "Full access", to do Offline/
Online compare operations.
See also Access protection for the CPU (Page 152)
Procedure
To find the differences between the configured and thee actual topology, follow these steps:
1. Display the topology overview table of the topology view.
2. Click the "Offline/online comparison" button in the toolbar of the topology overview:
Result
STEP 7 removes the "Partner station, "Partner interface" and "Cable data" columns in the
topology overview table and inserts comparison columns for "Status", and "Action". For each
device or port in the topology overview, the Status column displays the comparison status as
follows:
Icon Meaning
Differing topology in at least one lower-level component
Identical topology
For each compared port or device, the Action column provides these possible choices:
Icon Meaning
No action possible
Adopt the online interconnection
To repeat the comparison, click the toolbar button on the topology overview.
For additional information on the topology view, the topology overview, and online/offline
topology comparisons, refer to the STEP 7 Information System. Also you can find additional
information in the PROFINET with STEP 7 V13 manual (https://support.industry.siemens.com/cs/
ww/en/view/49948856).
To monitor the tags, you must have an online connection to the CPU. Simply click the "Go
online" button in the toolbar.
When you have connected to the CPU, STEP 7 turns the headers of the
work areas orange.
The project tree displays a comparison of the offline project and the
online CPU. A green circle means that the CPU and the project are
synchronized, meaning that both have the same configuration and
user program.
Tag tables show the tags. Watch tables can also show the tags, as well
as direct addresses.
To monitor the execution of the user program and to display the values of the tags, click
the "Monitor all" button in the toolbar.
The "Monitor value" field shows the value for each tag.
Capturing a snapshot
To capture a snapshot, follow these steps:
1. In the DB editor, click the "Monitor all tags" button: The "Monitor value" column displays
the actual data values.
2. Click the button to capture a snapshot of the actual values and display them in the
"Snapshot" column.
You can use this snapshot at a later time to update the actual CPU values or to replace the start
values.
Note
Be aware that if your snapshot contains state information, timer values, or calculated
information, the CPU restores those values as of the time you made the snapshot.
15.15.4 Using a watch table to monitor and modify values in the CPU
A watch table allows you to perform monitoring and control functions on data points as the CPU
executes your program. These data points can be process image (I or Q), M, DB or physical inputs
(I_:P), depending on the monitor or control function. You cannot accurately monitor the physical
outputs (Q_:P) because the monitor function can only display the last value written from Q
memory and does not read the actual value from the physical outputs.
The monitoring function does not change the program sequence. It presents you with
information about the program sequence and the data of the program in the CPU.
Control functions enable the user to control the sequence and the data of the program. You must
exercise caution when using control functions. These functions can seriously influence the
execution of the user/system program. The three control functions are Modify, Force and Enable
Outputs in STOP.
With the watch table, you can perform the following online functions:
• Monitoring the status of the tags
• Modifying values for the individual tags
You select when to monitor or modify the tag:
• Beginning of scan cycle: Reads or writes the value at the beginning of the scan cycle
• End of scan cycle: Reads or writes the value at the end of the scan cycle
• Switch to stop
You use the buttons at the top of the watch table to select the various functions.
Enter the tag name to monitor and select a display format from the dropdown selection. With an
online connection to the CPU, click the "Monitor" button to display the actual value of the data
point in the "Monitor value" field.
Trigger Description
Permanent Continuously collects the data
At scan cycle start Permanent: Continuously collects the data at the start of the scan cycle, after the
CPU reads the inputs
Once: Collects the data at the start of the scan cycle, after the CPU reads the
inputs
Trigger Description
At scan cycle end Permanent: Continuously collects the data at the end of the scan cycle, before the
CPU writes the outputs
Once: Collects the data once at the end of the scan cycle, before the CPU writes
the outputs
At transition to STOP Permanent: Continuously collects data when the CPU transitions to STOP
Once: Collects the data once after the CPU transitions to STOP
For modifying a PLC tag at a given trigger, select either the start or the end of cycle.
• Modifying an output: The best trigger event for modifying an output is at the end of the scan
cycle, immediately before the CPU writes the outputs.
Monitor the value of the outputs at the beginning of the scan cycle to determine what value
is written to the physical outputs. Also, monitor the outputs before the CPU writes the values
to the physical outputs in order to check program logic and to compare to the actual I/O
behavior.
• Modifying an input: The best trigger event for modifying an input is at the start of the cycle,
immediately after the CPU reads the inputs and before the user program uses the input
values.
If you suspect values are changing during the scan, you might want to monitor the value of
the inputs at the end of the scan cycle to ensure that the value of the input at the end the scan
cycle has not changed from the start of the scan cycle. If there is a difference in the values,
your user program might be erroneously writing to inputs.
To diagnose why the CPU might have gone to STOP, use the "Transition to STOP" trigger to
capture the last process values.
WARNING
Risks in writing to physical outputs in STOP mode
Even though the CPU is in STOP mode, enabling a physical output can activate the process point
to which it is connected, possibly resulting in unexpected equipment operation. Unexpected
equipment operation can cause death or severe personal injury.
Before writing to an output from the watch table, ensure that changing the physical output
cannot cause unexpected equipment operation. Always observe safety precautions for your
process equipment.
You can change the state of the outputs in STOP mode when the outputs are enabled. If the
outputs are disabled, you cannot modify the outputs in STOP mode. To enable the modification
in STOP mode of the outputs from the watch table, follow these steps:
1. Select the "Expanded mode" menu command from the "Online" menu.
2. Select the "Enable peripheral outputs" option of the "Modify" command of the "Online"
menu, or from the context menu after right-clicking the row of the Watch table.
You cannot enable outputs in STOP mode if you have configured distributed I/O. An error is
returned when you try to do this.
Setting the CPU to RUN mode disables "Enable peripheral outputs" option.
If any inputs or outputs are forced, the CPU is not allowed to enable outputs while in STOP mode.
The force function must first be cancelled.
Note
The force values are stored in the CPU and not in the force table.
You cannot force an input (or "I" address) or an output (or "Q" address). However, you can force
a peripheral input or peripheral output. The force table automatically appends a ":P" to the
address (for example: "On":P or "Run":P).
In the "Force value" cell, enter the value for the input or output to be forced. You can then use
the check box in the "Force" column to enable forcing of the input or output.
Use the "Start or replace forcing" button to force the value of the tags in the force
table. Click the "Stop forcing" button to reset the value of the tags.
In the force table, you can monitor the status of the forced value for an input. However, you
cannot monitor the forced value of an output.
You can also view the status of the forced value in the program editor.
Note
When an input or output is forced in a force table, the force actions become part of the project
configuration. If you close STEP 7, the forced elements remain active in the CPU program until
they are cleared. To clear these forced elements, you must use STEP 7 to connect with the online
CPU and then use the force table to turn off or stop the force function for those elements.
Note
Digital I/O points assigned to HSC, PWM, and PTO cannot be forced
The digital I/O points used by the high-speed counter (HSC), pulse-width modulation (PWM),
and pulse-train output (PTO) devices are assigned during device configuration. When digital I/O
point addresses are assigned to these devices, the values of the assigned I/O point addresses
cannot be modified by the force function of the force table.
' ུ
$ % & ( ཱ ི ཱི
Startup RUN
A The clearing of the I memory area is not ① While writing Q memory to the physical out‐
affected by the Force function. puts, the CPU applies the force value as the
outputs are updated.
B The initialization of the outputs values is ② When reading the physical inputs, the CPU ap‐
not affected by the Force function. plies the force values just prior to copying the
inputs into I memory.
C During the execution of the startup OBs, ③ During the execution of the user program (pro‐
the CPU applies the force value when the gram cycle OBs), the CPU applies the force val‐
user program accesses the physical input. ue when the user program accesses the physi‐
cal input or writes the physical output.
D The storing of interrupt events into the ④ Handling of communication requests and self-
queue is not affected. test diagnostics are not affected by the Force
function.
E The enabling of the writing to the outputs ⑤ The processing of interrupts during any part of
is not affected. the scan cycle is not affected.
WARNING
Risks with downloading in RUN mode
When you download changes to the CPU in RUN mode, the changes immediately affect process
operation. Changing the program in RUN mode can result in unexpected system operation,
which could cause death or serious injury to personnel, and/or damage to equipment.
Only authorized personnel who understand the effects of RUN mode changes on system
operation should perform a download in RUN mode.
The "Download in RUN mode" feature allows you to make changes to a program and download
them to your CPU without switching to STOP mode:
• You can make minor changes to your current process without having to shut down (for
example, change a parameter value).
• You can debug a program more quickly with this feature (for example, invert the logic for a
normally open or normally closed switch).
You can make the following program block and tag changes and download them in RUN mode:
• Create, overwrite, and delete Functions (FC), Function Blocks (FB), and Tag tables.
• Create, delete, and overwrite Data Blocks (DB) and instance data blocks for Function Blocks
(FB). You can add to DB structures and download them in RUN mode. The CPU can maintain
the values of existing block tags and initialize the new data block tags to their initial values,
or the CPU can set all data block tags to initial values, depending on your configuration
settings (Page 1167). You cannot download a web server DB (control or fragment) in RUN
mode.
• Overwrite Organization Blocks (OB); however, you cannot create or delete OBs.
You can download a maximum number of twenty blocks in RUN mode at one time. If you must
download more than twenty blocks, you must place the CPU in STOP mode.
If you download changes to a real process (as opposed to a simulated process, which you might
do in the course of debugging a program), it is vital to think through the possible safety
consequences to machines and machine operators before you download.
Note
If the CPU is in RUN mode and program changes have been made, STEP 7 always tries to
download in RUN first. If you do not want this to happen, you must put the CPU into STOP.
If the changes made are not supported in "Download in RUN", STEP 7 prompts the user that the
CPU must go to STOP.
If the program compiles successfully, STEP 7 starts to download the program to the CPU.
2. When STEP 7 prompts you to load your program or cancel the operation, click "Load" to
download the program to the CPU.
Note
You can download a maximum number of twenty blocks in RUN mode at one time. If you must
download more than twenty blocks, you must place the CPU in STOP mode.
15.16.4 Downloading a single selected block with a compile error in another block
If you attempt a consistent download with a compile error in another block, then the dialog
indicates an error, and the load button is disabled.
You must correct the compile error in the other block. Then, the "Load" button becomes active.
The "Download without reinitialization" feature allows you to extend a data block by adding
more data block tags and download the extended data block in RUN mode. In this way, you can
add tags to a data block and download it without reinitializing your program. The CPU retains the
values of the existing data block tags and initializes the newly-added tags to their start values.
To enable this function for an online project with a CPU in RUN mode, follow these steps:
1. From the Program blocks folder in the STEP 7 project tree, open the block.
2. Click the "Download without reinitialization" toggle button in the block editor to enable the
function. (The icon has a box around it when you have enabled it: )
3. Click OK on the prompt to confirm your choice.
4. Add tags to the block interface and download the block in RUN mode. You can add and
download as many new tags as your memory reserve allows.
If you have added more bytes to your block than you have configured for the memory reserve,
STEP 7 displays an error when you attempt to download the block in RUN mode. You must edit
the block properties to increase the amount. You cannot delete existing entries or modify the
“Memory reserve” of the block while the “Download without reinitialization” function is enabled.
To disable the "Download without reinitialization" function, follow these steps:
1. Click the "Download without reinitialization" toggle button in the block editor to disable the
function. (The icon does not have a box around it when you have disabled it: )
2. Click OK on the prompt to confirm your choice.
3. Download the block. On the download dialog, you must select "reinitialize" in order to
download the extended block.
The download then reinitializes all existing and new block tags to their start values.
Restrictions
The following restrictions apply to editing and downloading blocks in RUN mode:
• Extending the block interface by adding new tags and downloading in RUN mode is only
available for optimized blocks (Page 172).
• You cannot change the structure of a block and download the changed block in RUN mode
without reinitializing. Adding new members to a Struct (Page 108) tag, changing tag names,
array sizes, data types, or retentive status all require that you reinitialize the block if you
download it in RUN mode. The only modifications to existing block tags that you can perform
and still download the block in RUN mode without reinitialization are changes to start values
(data blocks), default values (function blocks) or comments.
• You cannot download more new block tags in RUN mode than the memory reserve can
accommodate.
• You cannot download more new retentive block tags in RUN mode than the retentive
memory reserve can accommodate.
In all cases the RLO output from the instruction will be false when the error occurs. The error is
temporary. If it occurs, the instruction should be retried later.
Note
You must not retry the operation in the current execution of the OB.
Note
The trace measurement data is available only within the STEP 7 project and is not available for
processing by other tools.
The following figure shows the various steps of the trace feature:
① Configure the trace in the trace editor of STEP 7. You can configure the following options:
• Data values to record
• Recording duration
• Recording frequency
• Trigger condition
② Transfer the trace configuration from STEP 7 to the PLC.
③ The PLC executes the program, and when the trigger condition occurs, begins recording the trace
data.
④ Transfer the recorded values from the PLC to STEP 7.
⑤ Use the tools in STEP 7 to analyze, graphically display, and save the data.
The S7-1200 supports two trace jobs with a maximum of 16 variables captured per trigger event.
Each trace job provides 524288 bytes of RAM for the recording of trace values and associated
overhead, for example variable addresses and time stamps.
The CPU supports a maximum of 999 trace measurement results. During the time that the CPU
is saving the trace measurements to external load memory, the CPU does not check the trigger
condition for the trace job. Once the CPU finishes saving the trace measurements, the CPU
resumes checking for trigger conditions.
Access to examples
See the STEP 7 information system for details about how to program a trace, how to download
the configuration, upload the trace data, and display the data in the logic analyzer. You can find
detailed examples there in the "Using online and diagnostics functions > Using the trace and
logic analyzer function" chapter.
In addition, the online manual "Industry Automation SINAMICS/SIMATIC Using the trace and
logic analyzer function" (https://support.industry.siemens.com/cs/ww/en/view/64897128) is an
excellent reference.
Byte Description
26 and 27 Word value 16#8000 - indicates the diagnostic is a Profinet style diagnostic
28 and 29 Word containing channel number responsible for this diagnostic
30 Bit pattern aaabb000 that indicates the type of channel (aaa) and type of error (bb)
aaa bb
000: reserved 00: reserved
001: input channel 01: incoming error
010: output channel 10: outgoing error
011: input/output channel 11: outgoing error, other errors present
Byte Description
31 Indication of data format
0: Free data format
1: Bit
2: Two bits
3: Four bits
4: Byte
5: Word (two bytes)
6: Double word (four bytes)
7: Two double words (eight bytes)
32 and 33 Word that defines the type of error:
16#0000: reserved
16#0001: short circuit
16#0002: undervoltage
16#0003: overvoltage
16#0004: overload
16#0005: over temperature
16#0006: wire break
16#0007: high limit exceeded
16#0008: low limit exceeded
16#0009: error
• The Word at bytes 26 and 27 is 16#8000, which indicates that this is a Profinet style
diagnostic.
• The Word at bytes 28 and 29 indicates this is a diagnostic for channel 0 or the module.
• Byte 30 is 16#28, which when interpreted as the bit pattern aaa bb 00 is 001 01 000. This
value indicates that this diagnostic is for an input channel and is an incoming error.
• Byte 31 is 5, which indicates a Word value
• The word value at bytes 32 and 33 is 16#0007, which indicates high limit exceeded.
By caputuring the AINFO information from a Diagnostic error interrupt event, you can thus
determine the nature of the diagnostic event.
Backup options
The table below provides an overview of the backup and restoration options of S7 CPUs:
Snapshot of the moni‐ Upload from device Upload device as new Download backup
tored values (software) station (hardware from online device
and software)
Use case Restoring a specific sta‐ Upload blocks from a Upload of hardware Create a complete back‐
tus of a data block. CPU to the project. configuration and soft‐ up of a CPU as a restore
The actual values of da‐ ware from a device to point. The backup copy
ta blocks including the project. is consistent and can‐
time stamp are accep‐ not be changed or
ted in the project. opened.
Requirement The CPU exists in a The CPU exists in the The device is available -
project. The data project. in the hardware cata‐
blocks must be identi‐ log of TIA Portal. Any
cal online and offline. necessary HSPs or GSD
files are installed.
Possible in mode RUN, STOP RUN, STOP RUN, STOP STOP
Possible for F-CPUs Yes Yes No Yes
Backup can be edited Yes Yes Yes No
Backup contents
The table below shows which data you can download and back up with which options:
Snapshot of the moni‐ Upload from device Upload device as new Download backup
tored values (software) station (hardware from online device
and software)
Actual values of the Snapshot is possible Download is possible Download is possible Backup is possible
data blocks
Software blocks - Download is possible Download is possible Backup is possible
PLC tags (names of - Download is possible Download is possible Backup is possible
tags and constants)
Technology objects - Download is possible Download is possible Backup is possible
Hardware configura‐ - - Download is possible Backup is possible
tion
Snapshot of the moni‐ Upload from device Upload device as new Download backup
tored values (software) station (hardware from online device
and software)
Monitoring tables - - Download is not possi‐ Backup is possible
(Web server) ble
Local data, bit memo‐ Snapshot is not possible Download is not possi‐ Download is not possi‐ Backup is possible
ries, timers, counters ble ble
and process picture
Archives and recipes - - - Backup is possible
(PLC)
General data on the - - - Backup is possible
SIMATIC memory
card, for example,
help for program
blocks or GSD files
Prerequisites
You can create as many backups as you want and store a variety of configurations for a CPU. To
make a backup, you must meet the following prerequisites:
• You have already created the CPU in the STEP 7 project.
• You have connected the CPU to the programming device/PC directly using the PROFINET
interface of the CPU. Backup and restore operations do not support the PROFIBUS interfaces
of the CMs.
• The CPU is online. (If there is no online connection, the backup process establishes an online
connection.)
• The CPU is in "STOP" mode. (If the CPU is not in STOP mode, the backup process prompts you
to allow the CPU to go to STOP mode.)
Procedure
To create a backup of the current configuration of a CPU, follow these steps:
1. Select the CPU in the project tree.
2. Select the "Backup from online device" command in the "Online" menu.
If necessary, you must enter the password for read access to the CPU and confirm that the CPU
should enter "STOP" mode.
Result
The backups are named with the name of the CPU and the time and date of the backup. The
backup includes all data that are needed to restore a particular configuration of a CPU. The CPU
backs up the following data:
• Contents of the memory card if one is present
• Retentive memory areas of data blocks, counters, and bit memory
• Other retentive memory contents, such as IP address parameters
The backup contains the current values of the CPU but does not include the diagnostic buffer.
The backup does not contain the password for protection of confidential PLC configuration data.
You can find the backup in the project tree under the CPU in the "Online backups" folder.The
following figure shows an S7-1200 CPU for which two backups have been created:
Note
Note that you can also back up the online CPU from the SIMATIC Automation Tool (SAT) or
the Web server Online backup standard Web page (Page 836).
When you back files up from STEP 7, STEP 7 stores the files within the STEP 7 project. When you
back files up from the Web server, your PC or device saves the backup files in the default folder
for downloads. You cannot restore STEP 7 backup files from the Web server and you cannot
restore Web server backup files from STEP 7. You can, however, save STEP 7 backup files directly
to the download folder of your PC or device. If you do so, then you can restore these files from
the Web server.
WARNING
Restoring backups with unknown content
If you restore a backup with unknown content, you can cause serious damage or injuries in case
of malfunctions or program errors.
Make sure that the backup consists of a configuration with known content.
Restoring a backup to a CPU that has protection of confidential PLC configuration data
If your CPU has protection of confidential PLC configuration data (Page 150), make sure that the
configured password in the backup file for protection of confidential PLC configuration data
matches the one in the CPU.
If the passwords do not match, the CPU cannot go to RUN mode.
if you attempt to restore a backup file that has a different password for the protection of
confidential PLC configuration data than the CPU, the restore succeeds. The CPU, however, will
restart in an error state because the protection of confidential PLC configuration data in the CPU
did not match the one in the project you restored to the CPU.
In this case, you must set the protection of confidential PLC configuration data in the CPU to
match the project that you restored. You can use one of these ways to set or delete the password
for protection of confidential PLC configuration data that is in the CPU:
• SIMATIC Automation Tool V4.0 SP3 or greater
• TIA Portal V17 or greater, Online & Diagnostics (Page 1145)
• SIMATIC memory card (Page 121)
Prerequisites
To restore a backup, you must meet the following prerequisites:
• The STEP 7 project includes a configuration for the CPU and a previously-made backup.
• The CPU is connected to the programming device directly through the PROFINET interface of
the CPU.
• The CPU is in STOP mode.
• You know the password for full access to the CPU, if an access level (Page 152) was
configured.
Procedure
To restore a backup, follow these steps:
1. Open the CPU in the project tree to display the lower-level objects.
2. Select the backup you want to restore from the "Online backups" folder.
3. From the "Online" menu, select the "Download to device" command.
– If you had previously established an online connection (Page 1141), the "Load preview"
dialog opens. This dialog displays alarms and recommends actions needed for the loading
operation.
– If you had not previously established an online connection, the "Extended download to
device" dialog opens, and you must first select the interface from which you want to
establish the online connection to the CPU.
4. Check the alarms in the "Load preview" dialog, and select the actions in the "Action" column,
if necessary.
5. Click the "Load" button (The "Load" button is selectable as soon as downloading is possible.)
6. STEP 7 restores the backup to the CPU. From the "Load results" dialog, you can check whether
or not the loading operation was successful and take any further action that might be
necessary.
7. After reviewing the "Load results" dialog, click the "Finish" button.
If prompted, enter the password for full access to the CPU and confirm that the CPU can enter
"STOP" mode.
STEP 7 restores the contents of the backup to the CPU and restarts the CPU.
Note
Note that you can also restore a CPU backup from the Web server Online backup standard Web
page (Page 836).
Standards compliance
The S7-1200 automation system design conforms with the following standards and test
specifications. The test criteria for the S7-1200 automation system are based on these standards
and test specifications.
Note that not all S7-1200 models may be certified to these standards, and certification status
may change without notification. It is your responsibility to determine applicable certifications
by referring to the ratings marked on the product. Consult your local Siemens representative if
you need additional information related to the latest listing of exact approvals by part number.
CE approval
The S7-1200 Automation System satisfies requirements and safety related objectives according
to the EC directives listed below, and conforms to the harmonized European standards (EN) for
the programmable controllers listed in the Official Journals of the European Community.
• EC Directive 2006/95/EC (Low Voltage Directive) "Electrical Equipment Designed for Use
within Certain Voltage Limits"
– EN 61131-2 Programmable controllers - Equipment requirements and tests
• EC Directive 2004/108/EC (EMC Directive) "Electromagnetic Compatibility"
– Emission standard
EN 61000-6:+A1: Industrial Environment
– Immunity standard
EN 61000-6-2: Industrial Environment
• EC Directive 94/9/EC (ATEX) "Equipment and Protective Systems Intended for Use in
Potentially Explosive Atmosphere"
– EN 60079-0:+A11
– EN 60079-15: Type of Protection 'n'
The CE Declaration of Conformity is held on file available to competent authorities at:
Siemens AG
Digital Industries
Factory Automation
DI FA AS SYS
Postfach 1963
D-92209 Amberg
Germany
cULus approval
Underwriters Laboratories Inc. complying with:
• Underwriters Laboratories, Inc.: UL 508 Listed (Industrial Control Equipment)
• Canadian Standards Association: CSA C22.2 Number 142 (Process Control Equipment)
Note
The SIMATIC S7-1200 series meets the CSA standard.
The cULus logo indicates that the S7-1200 has been examined and certified by Underwriters
Laboratories (UL) to standards UL 508 and CSA 22.2 No. 142.
FM approval
FM Approvals
Approval Standard Class Number 3600, 3611 (ANSI/UL 121201), 3810 (ANSI/UL 61010-1),
CSA Standard C22.2 No. 0-10, C22.2 No. 213, C22.2 No. 61010-1
Approved for use in:
Class I, Division 2, Group A, B, C, D, Temperature Class T3C Ta = 60 °C [CA, US]
Class I, Zone 2, Group IIC, Temperature Class T3 Ta = 60 °C [US]
Canadian Class I, Zone 2 Installation per CEC 18-150 [CA]
IMPORTANT EXCEPTION: See Technical Specifications for the number of inputs or outputs
allowed on simultaneously. Some models are de-rated for Ta = 60 °C.
WARNING
Substitution of components can impair the suitability for Class I, Division 2 and Zone 2.
Repair of units should only be performed by an authorized Siemens Service Center.
IECEx approval
IEC 60079-0: Explosive Atmospheres – General Requirements
IEC 60079-15: Electrical Apparatus for Potentially Explosive Atmospheres
Type of protection ‘nA’
IEC FMG 14.0012X
Ex nA IIC T3 Gc
IECEx rating information may appear on the product with the FM Hazardous Location
information.
Only products marked with an IECEx rating are approved. Consult your local Siemens
representative if you need additional information related to the latest listing of exact approvals
by part number.
Relay models are not included in IECEx approvals.
Refer to specific product marking for temperature rating.
Install modules in a suitable enclosure providing a minimum degree of protection of IP54
according to IEC 60079-15.
ATEX approval
ATEX approval applies to DC models only. ATEX approval does not apply to AC and Relay models.
EN 60079-0: Explosive Atmospheres - General Requirements
EN 60079-15: Electrical Apparatus for Potentially Explosive Atmospheres;
Type of protection 'nA'
II 3 G Ex nA IIC T4 or T3 Gc
Special conditions for safe use:
Install modules in a suitable enclosure providing a minimum degree of protection of IP54
according to EN 60529, or in a location providing an equivalent degree of protection.
Attached cables and conductors should be rated for the actual temperature measured under
rated conditions.
Provisions should be made to prevent the rated voltage at the power supply terminals from
being exceeded by transient disturbances of more than 119 V.
CCCEx approval
According to GB 3836.8 (Explosive atmosphere - Part 8: Equipment protection by ignition
protection type "n")
GB 3836.1 (Explosive atmosphere - Part 1: Equipment - General requirements)
Ex nA IIC T3 Gc
Specific conditions of safety use:
• The equipment shall only be used in an area of not more than polution degree 2, as defined
in GB/T 17935.1-2008.
• The equipment shall be installed in an enclosure that provides a degree of protection not less
than IP54 in accordance with GB 3836.8-2014.
• Transient protection shall be provided that is set at a level not exceeding 140 % of the peak
rated voltage value at the supply terminals to the equipment.
• Modules marked with an asterisk (*) are derated to 55"C when mounted horizontally and
45degrees C when mounted vertically if configured for maximum load, and must not have
adjacent channels on. See user's manual for derating information.
• See instruction for other information.
Korea Certification
The S7-1200 automation system satisfies the requirements of the Korean Certification (KC
Mark). It has been defined as Class A Equipment and is intended for industrial applications and
has not been considered for home use.
Maritime approval
The S7-1200 products are periodically submitted for special agency approvals related to specific
markets and applications. Consult your local Siemens representative if you need additional
information related to the latest listing of exact approvals by part number.
Classification societies:
• ABS (American Bureau of Shipping): U.S.A.
• BV (Bureau Veritas): France
• DNV (Det Norske Veritas): Norway
• GL (Germanischer Lloyd): German
• LRS (Lloyds Register of Shipping): England
• Class NK (Nippon Kaiji Kyokai): Japan
• Korean Register of Shipping: Korea
• CSS (China Classification Society): China
Industrial environments
The S7-1200 automation system is designed for use in industrial environments.
Electromagnetic compatibility
Electromagnetic Compatibility (EMC) is the ability of an electrical device to operate as intended
in an electromagnetic environment and to operate without emitting levels of electromagnetic
interference (EMI) that may disturb other electrical devices in the vicinity.
Surge immunity
Wiring systems subject to surges from lightning strike coupling must be equipped with external
protection. One specification for evaluation of protection from lightning type surges is found in
EN 61000-4-5, with operational limits established by EN 61000‑6‑2. S7‑1200 DC CPUs and
signal modules require external protection to maintain safe operation when subject to surge
voltages defined by this standard.
Listed below are some devices that support the needed surge immunity protection. These
devices only provide the protection if they are properly installed according to the manufacturer's
Environmental conditions
Protection class
• Protection Class II according to EN 61131-2 (Protective conductor not required)
Degree of protection
• IP20 Mechanical Protection, EN 60529
• Protects against finger contact with high voltage as tested by standard probe. External
protection required for dust, dirt, water and foreign objects of < 12.5mm in diameter.
Rated voltages
Note
When a mechanical contact turns on output power to the S7-1200 CPU, or any digital expansion
module, it sends a "1" signal to the digital outputs for approximately 50 microseconds. This could
cause unexpected machine or process operation which could result in death or serious injury to
personnel and/or damage to equipment. You must plan for this, especially if you are using
devices which respond to short duration pulses.
interconnected when designated as "not isolated" in the data sheets: the 24 V DC power supply
of the CPU, the sensor power of the CPU, the power input for the relay coil of an SM, and the
power supply for a non-isolated analog input. All non-isolated M terminals must connect to the
same external reference potential.
WARNING
Connecting non-isolated M terminals to different reference potentials will cause
unintended current flows that may cause damage or unpredictable operation in the PLC
and any connected equipment.
Failure to comply with these guidelines could cause damage or unpredictable operation which
could result in death or severe personal injury and/or property damage.
Always ensure that all non-isolated M terminals in an S7-1200 system are connected to the
same reference potential.
DC Outputs
Short -circuit protection circuitry is not provided for DC outputs on CPUs, signal modules (SMs)
and signal boards (SBs).
Note
Effect of data logs on internal CPU memory
Each data log write consumes at a minimum 2 KB of memory. If your program writes small
amounts of data frequently, it is consuming at least 2 KB of memory on each write. A better
implementation would be to accumulate the small data items in a data block (DB), and to write
the data block to the data log at less frequent intervals.
If your program writes many data log entries at a high frequency, consider using a replaceable
SD memory card.
Single-port CPUs
Single-port CPUs (CPU 1211C, CPU 1212C and CPU 1214C) have a standard Ethernet MDI pin
configuration as follows:
7 GND Ground
8 GND
Dual-port CPUs
The ports of a dual-port CPU (CPU 1215C and CPU1217C) have a standard Ethernet MDI-X pin
configuration as follows:
7 GND Ground
8 GND
Note
Dual-port CPU
The number shown under the pin indicates that the dual port CPUs do not have any crossover
between pins. There is an internal Ethernet switch in the units: the TD+/- and RD+/- pairs are not
crossed over internally.
Autonegotiation
If the port’s configuration enables autonegotiation, the S7-1200 CPU automatically detects the
cable type and swaps the transmit/receive lines, if needed. If the port’s configuration disables
autonegotiation, the CPU also disables this automatic swap. You configure a port’s
autonegotiation setting in the TIA Portal’s port options dialog. This is a port-specific advanced
option for the PROFINET interface (X1) of the CPU’s properties. Refer to "Configuring the
PROFINET port" in Section 11.2.3.4: "Configuring an IP address for a CPU in your project"
(Page 572) for further information.
Note
Many variables affect measured times. The above performance times are for the fastest
instructions in this category and error-free programs.
Element Description
Blocks Type OB, FB, FC, DB
Size Up to the size of work memory
Quantity Up to 1024 blocks total (OBs + FBs + FCs + DBs)
Address range for FBs, FCs, and FB and FC: 1 to 65535 (such as FB 1 to FB 65535)
DBs DB: 1 to 59999
Nesting depth 16 from the program cycle or startup OB
6 from any interrupt event OB1
Monitoring Status of 2 code blocks can be monitored simultaneously
Element Description
OBs Program cycle Multiple
Startup Multiple
Time-delay interrupt 4 (1 per event)
Cyclic interrupts 4 (1 per event)
Hardware interrupts 50 (1 per event)
Time error interrupts 1
Diagnostic error interrupts 1
Pull or plug of modules 1
Rack or station failure 1
Time of day Multiple
Status 1
Update 1
Profile 1
MC-Interpolator 1
MC-Servo 1
MC-PreServo 1
MC-PostServo 1
Timers Type IEC
Quantity Limited only by memory size
Storage Structure in DB, 16 bytes per timer
Counters Type IEC
Quantity Limited only by memory size
Storage Structure in DB, size dependent upon count type
• SInt, USInt: 3 bytes
• Int, UInt: 6 bytes
• DInt, UDInt: 12 bytes
1
Safety programs use two nesting levels. The user program therefore has a nesting depth of four in safety programs.
A.4.4.2 Sample time for the built-in analog ports of the CPU
Table A-20 Sample time for built-in analog inputs of the CPU
① 24 V DC Sensor Power
Out
For additional noise im‐
munity, connect "M" to
chassis ground even if
not using sensor supply.
② For sinking inputs, con‐
nect "-" to "M" (shown).
X10
X11
Table A-23 Connector pin locations for CPU 1211C AC/DC/Relay (6ES7211-1BE40-0XB0)
① 24 V DC Sensor Power
Out
For additional noise im‐
munity, connect "M" to
chassis ground even if
not using sensor supply.
② For sinking inputs, con‐
nect "-" to "M" (shown).
X10
X11
Table A-25 Connector pin locations for CPU 1211C DC/DC/Relay (6ES7211-1HE40-0XB0)
① 24 V DC Sensor Power
Out
For additional noise im‐
munity, connect "M" to
chassis ground even if
not using sensor supply.
② For sinking inputs, con‐
nect "-" to "M" (shown).
X10
X11
For sourcing inputs, con‐
nect "+" to "M".
Note 1: X11 connectors must
be gold. See Appendix C,
Spare Parts for article number.
X12
Table A-27 Connector pin locations for CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0)
Note
Unused analog inputs should be shorted.
Note
Many variables affect measured times. The above performance times are for the fastest
instructions in this category and error-free programs.
Element Description
Blocks Type OB, FB, FC, DB
Size Up to the size of work memory
Quantity Up to 1024 blocks total (OBs + FBs + FCs + DBs)
Address range for FBs, FCs, and FB and FC: 1 to 65535 (such as FB 1 to FB 65535)
DBs DB: 1 to 59999
Nesting depth 16 from the program cycle or startup OB
6 from any interrupt event OB1
Monitoring Status of 2 code blocks can be monitored simultaneously
OBs Program cycle Multiple
Startup Multiple
Time-delay interrupt 4 (1 per event)
Cyclic interrupts 4 (1 per event)
Hardware interrupts 50 (1 per event)
Time error interrupts 1
Diagnostic error interrupts 1
Pull or plug of modules 1
Rack or station failure 1
Time of day Multiple
Status 1
Update 1
Profile 1
MC-Interpolator 1
MC-Servo 1
MC-PreServo 1
MC-PostServo 1
Timers Type IEC
Quantity Limited only by memory size
Storage Structure in DB, 16 bytes per timer
Counters Type IEC
Quantity Limited only by memory size
Storage Structure in DB, size dependent upon count type
• SInt, USInt: 3 bytes
• Int, UInt: 6 bytes
• DInt, UDInt: 12 bytes
1
Safety programs use two nesting levels. The user program therefore has a nesting depth of four in safety programs.
A.5.4.2 Sample time for the built-in analog ports of the CPU
Table A-39 Sample time for built-in analog inputs of the CPU
X11
For sourcing inputs, con‐
nect "+" to "M".
Note 1: X11 connectors must
be gold. See Appendix C,
X12
Spare Parts for article number.
Note 2: Either the L1 or N (L2)
terminal can be connected to
a voltage source up to 240 V
AC. The N terminal can be con‐
sidered L2 and is not required
to be grounded. No polariza‐
tion is required for L1 and N
(L2) terminals.
Note 3: See Device Configura‐
tion (Page 127) for informa‐
tion about the Ethernet port
of the CPU.
Table A-42 Connector pin locations for CPU 1212C AC/DC/Relay (6ES7212-1BE40-0XB0)
X11
X10
X12
Note 2: See Device Configura‐
tion (Page 127) for informa‐
tion about the Ethernet port
of the CPU.
Table A-44 Connector pin locations for CPU 1212C DC/DC/Relay (6ES7212-1HE40-0XB0)
X11
X10
X12
Note 2: See Device Configura‐
tion (Page 127) for informa‐
tion about the Ethernet port
of the CPU.
Table A-46 Connector pin locations for CPU 1212C DC/DC/DC (6ES7212-1AE40-0XB0)
Note
Unused analog inputs should be shorted.
Note
Many variables affect measured times. The above performance times are for the fastest
instructions in this category and error-free programs.
Element Description
Blocks Type OB, FB, FC, DB
Size OB, FB, FC: 64 Kbytes
DB: up to the size of work memory
Quantity Up to 1024 blocks total (OBs + FBs + FCs + DBs)
Address range for FBs, FCs, and FB and FC: 1 to 65535 (such as FB 1 to FB 65535)
DBs DB: 1 to 59999
Nesting depth 16 from the program cycle or startup OB
6 from any interrupt event OB1
Monitoring Status of 2 code blocks can be monitored simultaneously
Element Description
OBs Program cycle Multiple
Startup Multiple
Time-delay interrupts 4 (1 per event)
Cyclic interrupts 4 (1 per event)
Hardware interrupts 50 (1 per event)
Time error interrupts 1
Diagnostic error interrupts 1
Pull or plug of modules 1
Rack or station failure 1
Time of day Multiple
Status 1
Update 1
Profile 1
MC-Interpolator 1
MC-Servo 1
MC-PreServo 1
MC-PostServo 1
Timers Type IEC
Quantity Limited only by memory size
Storage Structure in DB, 16 bytes per timer
Counters Type IEC
Quantity Limited only by memory size
Storage Structure in DB, size dependent upon count type
• SInt, USInt: 3 bytes
• Int, UInt: 6 bytes
• DInt, UDInt: 12 bytes
1
Safety programs use two nesting levels. The user program therefore has a nesting depth of four in safety programs.
A.6.4.2 Sample time for the built-in analog ports of the CPU
Table A-58 Sample time for built-in analog inputs of the CPU
① 24 V DC Sensor Power
Out
For additional noise im‐
munity, connect "M" to
chassis ground even if
not using sensor supply.
② For sinking inputs, con‐
X10
X11
Table A-61 Connector pin locations for CPU 1214C AC/DC/Relay (6ES7214-1BG40-0XB0)
① 24 V DC Sensor Power
Out
For additional noise im‐
munity, connect "M" to
chassis ground even if
not using sensor supply.
② For sinking inputs, con‐
nect "-" to "M" (shown).
X10
X11
Table A-63 Connector pin locations for CPU 1214C DC/DC/Relay (6ES7214-1HG40-0XB0)
① 24 V DC Sensor Power
Out
For additional noise im‐
munity, connect "M" to
chassis ground even if
not using sensor supply.
② For sinking inputs, con‐
X11
X10
Table A-65 Connector pin locations for CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0)
Note
Unused analog inputs should be shorted.
Note
Many variables affect measured times. The above performance times are for the fastest
instructions in this category and error-free programs.
Element Description
Blocks Type OB, FB, FC, DB
Size OB, FB, FC: 64 Kbytes
DB: up to the size of work memory
Quantity Up to 1024 blocks total (OBs + FBs + FCs + DBs)
Address range for FBs, FCs, and FB and FC: 1 to 65535 (such as FB 1 to FB 65535)
DBs DB: 1 to 59999
Nesting depth 16 from the program cycle or startup OB
6 from any interrupt event OB1
Monitoring Status of 2 code blocks can be monitored simultaneously
Element Description
OBs Program cycle Multiple
Startup Multiple
Time-delay interrupts 4 (1 per event)
Cyclic interrupts 4 (1 per event)
Hardware interrupts 50 (1 per event)
Time error interrupts 1
Diagnostic error interrupts 1
Pull or plug of modules 1
Rack or station failure 1
Time of day Multiple
Status 1
Update 1
Profile 1
MC-Interpolator 1
MC-Servo 1
MC-PreServo 1
MC-PostServo 1
Timers Type IEC
Quantity Limited only by memory size
Storage Structure in DB, 16 bytes per timer
Counters Type IEC
Quantity Limited only by memory size
Storage Structure in DB, size dependent upon count type
• SInt, USInt: 3 bytes
• Int, UInt: 6 bytes
• DInt, UDInt: 12 bytes
1
Safety programs use two nesting levels. The user program therefore has a nesting depth of four in safety programs.
A.7.4.2 Sample time for the built-in analog ports of the CPU
Table A-77 Sample time for built-in analog inputs of the CPU
Table A-80 Analog output representation for current (CPU 1215C and CPU 1217C)
X11
X10
X12
Table A-82 Connector pin locations for CPU 1215C AC/DC/Relay (6ES7215-1BG40-0XB0)
X10
X11
X12
Table A-84 Connector pin locations for CPU 1215C DC/DC/Relay (6ES7215-1HG40-0XB0)
X10
X11
X12
Table A-86 Connector pin locations for CPU 1215C DC/DC/DC (6ES7215-1AG40-0XB0)
Note
Unused analog inputs should be shorted.
Note
Many variables affect measured times. The above performance times are for the fastest
instructions in this category and error-free programs.
Element Description
Blocks Type OB, FB, FC, DB
Size OB, FB, FC: 64 Kbytes
DB: up to the size of work memory
Quantity Up to 1024 blocks total (OBs + FBs + FCs + DBs)
Address range for FBs, FCs, and FB and FC: 1 to 65535 (such as FB 1 to FB 65535)
DBs DB: 1 to 59999
Nesting depth 16 from the program cycle or startup OB
6 from any interrupt event OB1
Monitoring Status of 2 code blocks can be monitored simultaneously
OBs Program cycle Multiple
Startup Multiple
Time-delay interrupts 4 (1 per event)
Cyclic interrupts 4 (1 per event)
Hardware interrupts 50 (1 per event)
Time error interrupts 1
Diagnostic error interrupts 1
Pull or plug of modules 1
Rack or station failure 1
Time of day Multiple
Status 1
Update 1
Profile 1
MC-Interpolator 1
MC-Servo 1
MC-PreServo 1
MC-PostServo 1
Timers Type IEC
Quantity Limited only by memory size
Storage Structure in DB, 16 bytes per timer
Element Description
Counters Type IEC
Quantity Limited only by memory size
Storage Structure in DB, size dependent upon count type
• SInt, USInt: 3 bytes
• Int, UInt: 6 bytes
• DInt, UDInt: 12 bytes
1
Safety programs use two nesting levels. The user program therefore has a nesting depth of four in safety programs.
Table A-95 CPU 1217C Digital input (DI) H/W configuration table
Table A-97 CPU 1217C Digital output (DQ) H/W configuration table
A.8.4.3 Sample time for the built-in analog ports of the CPU
Table A-100 Sample time for built-in analog inputs of the CPU
Table A-103 Analog output representation for current (CPU 1215C and CPU 1217C)
Table A-105 Connector pin locations for CPU 1217C DC/DC/DC (6ES7217-1AG40-0XB0)
Note
Unused analog inputs should be shorted.
A.8.6 CPU 1217C Differential Input (DI) detail and application example
(QFRGHU
V
56
'LIIHUHQWLDO'ULYHU
)LHOG([WHUQDO'ULYHU
([DPSOH(QFRGHU (QFRGHU
93RZHU6XSSO\
(QFRGHU
V'LIIHUHQWLDO
'ULYHU,&*1'
7; 7;
)LHOG&DEOH
6KLHOGHG7ZLVWHG3DLU
&KDVVLV*1'
(DUWK
56',))(5(17,$/,13876
0
',LVR*1'
',E[ ',E[([DPSOHVKRZQ
&38
56 5; 5;
'LIIHUHQWLDO
&38 5HFHLYHU
,QWHUQDO&LUFXLW
',LVR9 &38',LQWHUQDO9
SRZHUVXSSO\
)XQFWLRQDOLVRODWLRQWR
LQWHUQDOORJLFRI&38
',LVR*1' ',LVR*1'
2SWR
VLJQDO
LVRODWLRQ
Notes
• Each differential DI is biased "OFF" when terminal block screws are open-circuit.
• Built-in DI Termination and Bias = 100 Ω equivalent impedance.
• Built-in DI Termination and Bias resistors limit the continuous common mode voltage range.
See electrical specifications for detail.
A.8.7 CPU 1217C Differential Output (DQ) detail and application example
2SWR
VLJQDO
LVRODWLRQ
'4LVR9
&38'4LQWHUQDO
9SRZHUVXSSO\ '4LVR9
)XQFWLRQDOLVRODWLRQWR
'4LVR*1'
LQWHUQDOORJLFRI&38
&38 &38
7; 7; 56 ,QWHUQDO'4&LUFXLW
'LIIHUHQWLDO'ULYHU
'4LVR*1'
([DPSOHVKRZQ
'4D\ '4D\
56',))(5(17,$/2873876
&KDVVLV*1'
(DUWK )LHOG&DEOH
6KLHOGHG7ZLVWHG3DLU
5; 5;
0RWRU'ULYH
V
'LIIHUHQWLDO5HFHLYHU )LHOG([WHUQDO
,&*1' 0RWRU'ULYH 5HFHLYHU
93RZHU6XSSO\ ([DPSOH0RWRU'ULYH
0RWRU'ULYH
V
5656
'LIIHUHQWLDO5HFHLYHU
Note
• Built-in DQ Termination resistor limits the continuous common mode voltage range. See
electrical specifications for detail.
X10 X10
X11
X11
X12
X13
① For sinking inputs, connect "-" to "M" (shown). For sourcing inputs, connect "+" to "M".
See also
New features (Page 35)
Table A-115 Wiring diagrams for the 8-point digital output SMs
X10 X10
X11 X11
Table A-118 Wiring diagram for the 8-point digital output relay changeover SM
/
'4D;
1&
&RPPRQ
12 '4D
X10 )RUPFRQWURO
FLUFXLWU\
X11
&RLO
/
1& '4D;
&RPPRQ '4D
12
)RUPFRQWURO
FLUFXLWU\ &RLO
X12
/
X13
'4D;
1&
&RPPRQ '4D
12
)RUPFRQWURO
FLUFXLWU\
&RLO
A changeover relay output controls two circuits using a common terminal: one normally closed
contact, and one normally open contact. Using output "0" as an example, when the output point
is OFF, the common (0L) is connected to the normally closed contact (.0X) and disconnected
from the normally open contact (.0). When the output point is ON, the common (0L) is
disconnected from the normally closed contact (.0X) and connected to the normally open
contact (.0).
Table A-119 Connector pin locations for SM 1222 DQ 8 x Relay Changeover (6ES7222-1XF32-0XB0)
Table A-120 Wiring diagrams for the 16-point digital output SMs
X10 X10
X11
X11
X12 X12
X13 X13
Table A-123 Wiring diagram for the 16-point digital output 24 V DC sinking SM
See also
New features (Page 35)
Table A-128 Wiring diagrams for the digital input V DC/output relay SMs
X11
X11
X12 X12
X13 X13
Table A-129 Connector Pin Locations for SM 1223 DI 8 x 24 V DC, DQ 8 x Relay (6ES7223-1PH32-0XB0)
Table A-130 Connector Pin Locations for SM 1223 DI 16 x 24 V DC, DQ 16 x Relay (6ES7223-1PL32-0XB0)
Table A-131 Wiring diagrams for the digital input V DC/output SMs
X11
X10
X12
X12
X13 X13
Table A-134 Wiring diagram for the digital input V DC/output SMs
X10
X11
X12
X13
Table A-140 Connector Pin Locations for SM 1223 DI 8 x 120/240 V AC, DQ 8 x Relay
(6ES7223-1QH32-0XB0)
+ Transducer + Transducer
- 2- Wire 4- Wire
-
I I
I
X10 X10
L+ M 0+ 0- 1+ 1- L+ M 0+ 0- 1+ 1-
AI AI AI AI
24 VDC Analog Inputs 24 VDC Analog Inputs
X10
X10
X11
X12
X11
X13
Note: Connectors must be gold. See Appendix C, Spare Parts for article number.
Note: Connectors must be gold. See Appendix C, Spare Parts for article number.
Note
Unused voltage input channels should be shorted.
Unused current input channels should be set to the 0 to 20 mA range and/or disable broken wire
error reporting.
Inputs configured for current mode will not conduct loop current unless the module is powered
and configured.
Current input channels will not operate unless external power is supplied to the transmitter.
X10
X10
X11 X12
X13
Note: Connectors must be gold. See Appendix C, Spare Parts for article number.
+ Transducer + Transducer
- 2- Wire 4- Wire
-
I I
I
X10 X10
L+ M 0+ 0- 1+ 1- L+ M 0+ 0- 1+ 1-
AI AI AI AI
24 VDC Analog Inputs 24 VDC Analog Inputs
X10
X11
X13
Table A-160 Connector pin locations for SM 1234 AI 4 x 13 Bit / AQ 2 x 14 bit (6ES7234-4HE32-0XB0)
Note
Unused voltage input channels should be shorted.
Unused current input channels should be set to the 0 to 20 mA range and/or disable broken wire
error reporting.
Inputs configured for current mode will not conduct loop current unless the module is powered
and configured.
Current input channels will not operate unless external power is supplied to the transmitter.
Smoothing selection (sample averaging) Noise reduction/rejection frequency (Integration time selection)
400 Hz (2.5 ms) 60 Hz (16.6 ms) 50 Hz (20 ms) 10 Hz (100 ms)
None (1 cycle): No averaging 4 ms 18 ms 22 ms 100 ms
Weak (4 cycles): 4 samples 9 ms 52 ms 63 ms 320 ms
Medium (16 cycles): 16 samples 32 ms 203 ms 241 ms 1200 ms
Strong (32 cycles): 32 samples 61 ms 400 ms 483 ms 2410 ms
A.10.5 Sample time and update times for the analog inputs
Table A-162 Sample and module update times for all channels
A.10.6 Measurement ranges of the analog inputs for voltage and current (SB and SM)
Table A-163 Analog input representation for voltage (SB and SM)
Table A-164 Analog input representation for current (SB and SM)
See also
Determining the type of wire break condition from an SM 1231 module (Page 1173)
A.10.7 Measurement ranges of the analog outputs for voltage and current (SB and
SM)
Table A-165 Analog output representation for voltage (SB and SM)
Table A-166 Analog output representation for current (SB and SM)
X10 X10
X11
X12
X11
X13
Note: Connectors must be gold. See Appendix C, Spare Parts for article number.
Note
Unused analog inputs should be shorted.
The thermocouple unused channels can be deactivated. No error will occur if an unused channel
is deactivated.
The cold junction compensation restores the voltage added by the connector thermocouples.
The temperature of the module is measured internally, and then converted to a value to be
added to the sensor conversion. The corrected sensor conversion is then linearized using the
thermocouple tables.
For optimum operation of the cold junction compensation, the thermocouple module must be
located in a thermally stable environment. Slow variation (less than 0.1 °C/minute) in ambient
module temperature is correctly compensated within the module specifications. Air movement
across the module will also cause cold junction compensation errors.
If better cold junction error compensation is needed, an external iso-thermal terminal block may
be used. The thermocouple module provides for use of a 0 °C referenced or 50 °C referenced
terminal block.
Type Under-range Nominal range Nominal range Over-range Normal range 3, 4 Normal range 1, 2 ,6
minimum1 low limit high limit maximum2 accuracy @ 25 °C accuracy -20 °C
to 60 °C
J -210.0 °C -150.0 °C 1200.0 °C 1450.0 °C ±0.3 °C ±0.6 °C
-346.0 °F -238.0 °F 2192.0 °F 2642.0 °F ±0.5 °F ±1.1 °F
K -270.0 °C -200.0 °C 1372.0 °C 1622.0 °C ±0.4 °C ±1.0 °C
-454.0 °F -328.0 °F 2501.6 °F 2951.6 °F ±0.7 °F ±1.8 °F
T -270.0 °C -200.0 °C 400.0 °C 540.0 °C ±0.5 °C ±1.0 °C
-454.0 °F -328.0 °F 752.0 °F 1004.0 °F ±0.9 °F ±1.8 °F
E -270.0 °C -200.0 °C 1000.0 °C 1200.0 °C ±0.3 °C ±0.6 °C
-454.0 °F -328.0 °F 1832.0 °F 2192.0 °F ±0.5 °F ±1.1 °F
R&S -50.0 °C 100.0 °C 1768.0 °C 2019.0 °C ±1.0 °C ±2.5 °C
-58.0 °C 212.0 °F 3214.4 °F 3276.6 °F 5
±1.8 °F ±4.5 °F
B 0.0 °C 200.0 °C 800.0 °C -- ±2.0 °C ±2.5 °C
32.0 °F 392.0 °F 1472.0 °F -- ±3.6 °F ±4.5 °F
-- 800.0 °C 1820.0 °C 1820.0 °C ±1.0 °C ±2.3 °C
-- 1472.0 °F 3276.6 °F 5 3276.6 °F 5 ±1.8 °F ±4.1 °F
N -270.0 °C -200.0 °C 1300.0 °C 1550.0 °C ±1.0 °C ±1.6 °C
-454.0 °F -328.0 °F 2372.0 °F 2822.0 °F ±1.8 °F ±2.9 °F
C 0.0 °C 100.0 °C 2315.0 °C 2500.0 °C ±0.7 °C ±2.7 °C
32.0 °F 212.0 °F 3276.6 °F 5
3276.6 °F 5
±1.3 °F ±4.9 °F
Type Under-range Nominal range Nominal range Over-range Normal range 3, 4 Normal range 1, 2 ,6
minimum1 low limit high limit maximum2 accuracy @ 25 °C accuracy -20 °C
to 60 °C
TXK/XK(L) -200.0 °C -150.0 °C 800.0 °C 1050.0 °C ±0.6 °C ±1.2 °C
-328.0 °F 302.0 °F 1472.0 °F 1922.0 °F ±1.1 °F ±2.2 °F
Voltage -32512 -27648 27648 32511 ±0.05% ±0.1%
-80mV 80mV
1
Thermocouple values below the under-range minimum value are reported as -32768.
2
Thermocouple values above the over-range maximum value are reported as 32767.
3
Internal cold junction error is ±1.5 °C for all ranges. This adds to the error values in this table. The module requires at least 30
minutes of warm-up time to meet this specification. For module ambient temperatures below -10 °C internal cold junction
error can be greater than 1.5 °C.
4
In the presence of radiated radio frequency of 970 MHz to 990 MHz, the accuracy of the SM 1231 AI 4 x 16 bit TC may be
degraded.
5
Lower limit of 3276.6 with °F reporting
6
Cold junction compensation error has not been characterized for module ambient temperatures below 0 °C and may exceed
the specified value.
Note
Thermocouple channel
Each channel on the Thermocouple signal module can be configured with a different
thermocouple type (selectable in the software during configuration of the module).
Table A-174 Noise reduction and update times for the SM 1231 Thermocouple
Rejection frequency selection Integration time 4 Channel module update 8 Channel module update
time (seconds) time (seconds)
400 Hz (2.5 ms) 10 ms 1 0.143 0.285
60 Hz (16.6 ms) 16.67 ms 0.223 0.445
50 Hz (20 ms) 20 ms 0.263 0.525
10 Hz (100 ms) 100 ms 1.225 2.450
1
To maintain module resolution and accuracy when 400 Hz rejection is selected, the integration time is 10 ms. This selection
also rejects 100 Hz and 200 Hz noise.
It is recommended for measuring thermocouples that a 100 ms integration time be used. The
use of smaller integration times will increase the repeatability error of the temperature readings.
Note
After power is applied, the module performs internal calibration for the analog-to-digital
converter. During this time the module reports a value of 32767 on each channel until valid data
is available on that channel. Your user program may need to allow for this initialization time.
Because the configuration of the module can vary the length of the initialization time, you
should verify the behavior or the module in your configuration. If required, you can include logic
in your user program to accommodate the initialization time of the module.
You can implement this logic using a polling read in the "Startup OB" which blocks operation
until the initialization is complete. You must implement the polling read with an immediatede
access. If the value of the thermocouple polling read is 32767, then the read must be repeated
until the value changes. For each module this polling only needs to be executed for the highest
numbered used input point in the module (the module inputs are initialized in order from 0 to
7).
X10
X10
X11
X11
X12
X12
X13
X13
Table A-180 Connector Pin Locations for SM 1231 RTD 4 x 16 bit (6ES7231-5PD32-0XB0)
Table A-181 Connector Pin Locations for SM 1231 RTD 8 x 16 bit (6ES7231-5PF32-0XB0)
Note
The RTD unused channels can be deactivated. No error will occur if an unused channel is
deactivated.
The RTD module needs to have the current loop continuous to eliminate extra stabilization time
which is automatically added to an unused channel that is not deactivated. For consistency the
RTD module should have a resistor connected (like the 2-wire RTD connection).
Table A-182 Ranges and accuracy for the different sensors supported by the RTD modules
Temperature coef‐ RTD type Under range Nominal Nominal Over Normal Normal
ficient minimum1 range low range range range ac‐ range accura‐
limit high limit maxi‐ curacy cy ‑20 °C to
mum2 @ 25 °C 60 °C
Pt 0.003850 Pt 100 climatic -145.00 °C -120.00 °C 145.00 °C 155.00 °C ±0.20 °C ±0.40 °C
ITS90 Pt 10 -243.0 °C -200.0 °C 850.0 °C 1000.0 °C ±1.0 °C ±2.0 °C
DIN EN 60751 Pt 50 -243.0 °C -200.0 °C 850.0 °C 1000.0 °C ±0.5 °C ±1.0 °C
Pt 100
Pt 200
Pt 500
Pt 1000
Pt 0.003902 Pt 100 -243.0 °C -200.0 °C 850.0 °C 1000.0 °C ± 0.5 °C ±1.0 °C
Pt 0.003916 Pt 200 -243.0 °C -200.0 °C 850.0 °C 1000.0 °C ± 0.5 °C ±1.0 °C
Pt 0.003920
Pt 500
Pt 1000
Pt 0.003910 Pt 10 -273.2 °C -240.0 °C 1100.0 °C 1295 °C ±1.0 °C ±2.0 °C
Pt 50 -273.2 °C -240.0 °C 1100.0 °C 1295 °C ±0.8 °C ±1.6 °C
Pt 100
Pt 500
Ni 0.006720 Ni 100 -105.0 °C -60.0 °C 250.0 °C 295.0 °C ±0.5 °C ±1.0 °C
Ni 0.006180 Ni 120
Ni 200
Ni 500
Ni 1000
LG-Ni 0.005000 LG-Ni 1000 -105.0 °C -60.0 °C 250.0 °C 295.0 °C ±0.5 °C ±1.0 °C
Ni 0.006170 Ni 100 -105.0 °C -60.0 °C 180.0 °C 212.4 °C ±0.5 °C ±1.0 °C
Cu 0.004270 Cu 10 -240.0 °C -200.0 °C 260.0 °C 312.0 °C ±1.0 °C ±2.0 °C
Cu 0.004260 Cu 10 -60.0 °C -50.0 °C 200.0 °C 240.0 °C ±1.0 °C ±2.0 °C
Cu 50 -60.0 °C -50.0 °C 200.0 °C 240.0 °C ±0.6 °C ±1.2 °C
Cu 100
Cu 0.004280 Cu 10 -240.0 °C -200.0 °C 200.0 °C 240.0 °C ±1.0 °C ±2.0 °C
Cu 50 -240.0 °C -200.0 °C 200.0 °C 240.0 °C ±0.7 °C ±1.4 °C
Cu 100
1
RTD values below the under-range minimum value report -32768.
2
RTD values above the over-range maximum value report +32767.
Range Under range Nominal range Nominal range Over Normal range Normal range accu‐
minimum low limit high limit range accuracy racy ‑20 °C to 60 °C
maxi‐ @ 25 °C
mum1
150 Ω n/a 0 (0 Ω) 27648 (150 Ω) 176.383 Ω ±0.05% ±0.1%
300 Ω n/a 0 (0 Ω) 27648 (300 Ω) 352.767 Ω ±0.05% ±0.1%
600 Ω n/a 0 (0 Ω) 27648 (600 Ω) 705.534 Ω ±0.05% ±0.1%
1
Resistance values above the over-range minimum value are reported as +32767.
Note
The module reports 32767 on any activated channel with no sensor connected. If open wire
detection is also enabled, the module flashes the appropriate red LEDs.
When 500 Ω and 1000 Ω RTD ranges are used with other lower value resistors, the error may
increase to two times the specified error.
Best accuracy will be achieved for the 10 Ω RTD ranges if 4 wire connections are used.
The resistance of the connection wires in 2 wire mode will cause an error in the sensor reading
and therefore accuracy is not guaranteed.
Table A-184 Noise reduction and update times for the RTD modules
Note
After power is applied, the module performs internal calibration for the analog-to-digital
converter. During this time the module reports a value of 32767 on each channel until valid data
is available on that channel. Your user program may need to allow for this initialization time.
Because the configuration of the module can vary the length of the initialization time, you
should verify the behavior or the module in your configuration. If required, you can include logic
in your user program to accommodate the initialization time of the module.
You can implement this logic using a polling read in the "Startup OB" which blocks operation
until the initialization is complete. You must implement the polling read with an immediatede
access. If the value of the RTD polling read is 32767, then the read must be repeated until the
value changes. For each module this polling only needs to be executed for the highest numbered
used input point in the module (the module inputs are initialized in order from 0 to 7).
Table A-185 Representation of analog values for resistance thermometers PT 100, 200, 500, 1000 and
PT 10, 50, 100, 500 GOST (0.003850) standard
,2/LQN ,2/LQN
PDVWHU GHYLFH
,2/LQNFDEOH
&\FOH &\FOH
WLPH WLPH
&\FOH
WLPH
6HHRSHUDWLQJLQVWUXFWLRQV
7KHF\FOHWLPHLVQHJRWLDWHGEHWZHHQ IRUWKH,2/LQNGHYLFH
WKH,2/LQNPDVWHUDQG,2/LQN
GHYLFH
7KHQHJRWLDWHGWLPHFRUUHVSRQGVWR
WKHPLQLPXP,2/LQNF\FOHWLPHRIWKH
,2/LQNPDVWHU
Table A-188 Connector pin locations for SM 1278 IO-Link Master (6ES7278-4BD32-0XB0)
The SM 1278 4xIO‑Link Master is a 4‑port module that functions as both a signal module and a
communication module. Each port can operate in the IO‑Link mode, single 24 V DC digital input
or 24 V DC digital output.
The IO‑Link master programs acyclic communication with an IO‑Link device using the
IO_LINK_DEVICE function block (FB) in your STEP 7 S7‑1200 controller program. The
IO_LINK_DEVICE FB indicates the IO‑Link master your program uses, and which ports the master
uses for data exchange.
Visit the Siemens Industry Online Support website (https://support.industry.siemens.com) for
details on working with the IO-Link library. Enter "IO‑Link" in the website's search box to access
information about IO‑Link products and their use.
View of the module
Properties
Technical properties
• IO‑Link Master according to IO‑Link specification V1.1 (see the IO‑Link Consortium website
(https://io-link.com/en/index.php) for details)
• Serial communication module with four ports (channels)
• Data transmission rate COM1 (4.8 kbaud), COM2 (38.4 kbaud), COM3 (230.4 kbaud)
• SIO mode (standard IO mode)
• Connection of up to four IO‑Link devices (3‑wire connection) or four standard actuators or
standard encoders
• Programmable diagnostics function by port
Supported functions
• I&M (installation and maintenance) identification data
• Firmware update
• IO‑Link parameter assignment by means of the S7‑PCT port configuration tool, STEP 7
Professional, and an S7‑1200 V4.0 or later CPU. In STEP 7 Professional, V15 (with the use of
V2.1 HSP or later), IO-Link parameter assignment can be done using the TIA Portal with
limited functionality.
• Port Qualifier Information (PQI) bits
• Backup and Restore using IO-Link library FBs
IO‑Link is a point-to-point connection between a master and a device. Both conventional and
intelligent sensors/actuators can be used as devices at the IO‑Link via unshielded standard
cables using proven 3‑wire technology. IO‑Link is backward compatible with conventional
digital sensors and actuators. The circuit state and data channel are designed in proven 24 V DC
technology.
For additional information about the SIMATIC‑IO‑Link technology, refer to the "IO‑Link system
Function Manual" on the Siemens Industry Online Support website (https://
support.automation.siemens.com).
Note
IO‑Link parameter data
When you replace the SM 4xIO-Link Master, the parameter data is not automatically assigned to
it.
CAUTION
Removal and insertion
If you insert the SM 4xIO-Link Master with the load switched on, this can lead to dangerous
conditions in your plant.
Physical damage to the S7‑1200 automation system may occur as a result.
Remove or insert the SM 4xIO-Link Master only when the load is switched off.
Note
When you reset to factory settings, the device parameters are deleted and the delivery state is
restored.
If you remove an SM 1278 4xIO‑Link signal module, reset it to factory settings before you put it
into storage.
Procedure
For "Reset to factory settings", proceed as described in the S7‑PCT online help under "Master
Configuration > 'Commands' tab".
A.12.1.2 Connecting
For details about pin assignment, see table, Connector pin locations for SM 1278 I/O-Link Master
(6ES 278-4BD32-0XB0). (Page 1299)
The following table shows the terminal assignments for the SM 1278 4xIO-Link Master:
The following table contains illustrations of connection examples, where n = port number:
0Q 3($8;
Note
Connected sensors must use the device supply provided by the Master module Ln connection.
',$*
212)) /
;
'$7$
&4
3+< ;
',$*
/
;
&4
;
/
;
%DFNSODQHEXV
&4
6 w& ;
EDFNSODQHEXV
LQWHUIDFH 212)) /
;
&4
3+< ;
'$7$
0
;
0
;
0
;
0
;
0
;
5HYHUVHSRODULW\ /
SURWHFWLRQ ;
)(
;
The table below shows the conditions when you need S7-PCT:
For additional information, refer to the SIMATIC IO-Link system manual (https://
support.industry.siemens.com/cs/ww/en/view/65949252).
The following table shows the parameters for the SM 1278 4xIO-Link Master:
Instruction Application
SFB 53 WRREC Transfer of the alterable parameters to the module.
Error message
The following return value is reported in the event of an error:
EN_Portx:
0 = Diagnostics deactivated
1 = Diagnostics activated
LED display
LED DIAG
DIAG Meaning
Backplane bus supply of the S7‑1200 not OK
Off
Module is not configured
Flashes
Module parameterized and no module diagnostics
On
Module parameterized and module diagnostics
OR
Flashes
L+ power not connected
Off
Port activated, device not connected or
Port is not connected to the configured device
Flashes
Port activated, device connected
On
Off
Process signal = 1
On
F1 ... F4 Meaning
No error
Off
Error
On
Module errors are indicated as diagnostics (module status) only in IO‑Link mode.
Technical data SB 1221 DI 4 x 24 V DC, 200 kHz SB 1221 DI 4 x 5 V DC, 200 kHz
Article number 6ES7221-3BD30-0XB0 6ES7221-3AD30-0XB0
Dimensions W x H x D (mm) 38 x 62 x 21
Weight 35 grams
Power dissipation 1.5 W 1.0 W
Current consumption (SM Bus) 40 mA
Current consumption (24 V DC) 7 mA / input + 20 mA 15 mA / input + 15 mA
Technical data SB 1221 DI 4 x 24 V DC, 200 kHz SB 1221 DI 4 x 5 V DC, 200 kHz
Number of inputs 4
Type Source
Rated voltage 24 V DC at 7 mA, nominal 5 V DC at 15 mA, nominal
Continuous permissible voltage 28.8 V DC 6 V DC
Surge voltage 35 V DC for 0.5 sec. 6V
Logic 1 signal 0 V (10 mA) to L+ minus 10 V (2.9 mA) 0 V (20 mA) to L+ minus 2.0 V ( 5.1 mA)
Logic 0 signal L+ minus 5 V (1.4 mA) to L+ (0 mA) L+ minus 1.0 V (2.2 mA) to L + (0 mA)
HSC clock input rates (max.) Single phase: 200 kHz
Quadrature phase: 160 kHz
Isolation (field side to logic) 707 V DC (type test)
Isolation groups 1
Technical data SB 1221 DI 4 x 24 V DC, 200 kHz SB 1221 DI 4 x 5 V DC, 200 kHz
Filter times us settings 0.1, 0.2, 0.4, 0.8, 1.6, 3.2, 6.4, 10.0,12.8, 20.0
ms settings 0.05, 0.1, 0.2, 0.4, 0.8, 1.6, 3.2, 6.4, 10.0, 12.8, 20.0
Number of inputs on simultaneously • 2 (no adjacent points) at 60 °C hori‐ 4
zontal or 50 °C vertical
• 4 at 55 °C horizontal or 45 °C vertical
Cable length (meters) 50 shielded twisted pair
Note
When switching frequencies above 20 kHz, it is important that the digital inputs receive a square
wave. Consider the following options to improve the signal quality to the inputs:
• Minimize the cable length
• Change a driver from a sink only driver to a sinking and sourcing driver
• Change to a higher quality cable
• Reduce the circuit/components from 24 V to 5 V
• Add an external load at the input
Table A-191 Wiring diagrams for the 200 kHz digital input SBs
X19 X19
Table A-192 Connector pin locations for SB 1221 DI 4 x 24 V DC, 200 kHz (6ES7221-3BD30-0XB0)
Pin X19
1 L+ / 24 V DC
2 M / 24 V DC
Pin X19
3 DI e.0
4 DI e.1
5 DI e.2
6 DI e.3
Table A-193 Connector pin locations for SB 1221 DI 4 x 5 V DC, 200 kHz (6ES7221-3AD30-0XB0)
Pin X19
1 L+ / 5 V DC
2 M / 5 V DC
3 DI e.0
4 DI e.1
5 DI e.2
6 DI e.3
Technical data SB 1222 DQ 4 x 24 V DC, 200 kHz SB 1222 DQ 4 x 5 V DC, 200 kHz
Article number 6ES7222-1BD30-0XB0 6ES7222-1AD30-0XB0
Dimensions W x H x D (mm) 38 x 62 x 21
Weight 35 grams
Power dissipation 0.5 W
Current consumption (SM Bus) 35 mA
Current consumption (24 V DC) 15 mA
Technical data SB 1222 DQ 4 x 24 V DC, 200 kHz SB 1222 DQ 4 x 5 V DC, 200 kHz
Number of outputs 4
Output type Solid state - MOSFET sink and source1
Voltage range 20.4 to 28.8 V DC 4.25 to 6.0 V DC
Logic 1 signal at max. current L+ minus 1.5 V L+ minus 0.7 V
Logic 0 signal at max. current 1.0 V DC, max. 0.2 V DC, max.
Current (max.) 0.1 A
Lamp load --
On state contact resistance 11 Ω max. 7 Ω max.
Off state resistance 6 Ω max. 0.2 Ω max.
Leakage current per point --
Pulse Train Output rate 200 kHz max., 2 Hz min.
Technical data SB 1222 DQ 4 x 24 V DC, 200 kHz SB 1222 DQ 4 x 5 V DC, 200 kHz
Surge current 0.11 A
Overload protection No
Isolation (field side to logic) 707 V DC (type test)
Isolation groups 1
Currents per common 0.4 A
Inductive clamp voltage Non
Switching delay 1.5 μs + 300 ns rise 200 ns + 300 ns rise
1.5 μs + 300 ns fall 200 ns + 300 ns fall
Behavior on RUN to STOP Last value or substitute value (default value 0)
Control of a digital input Yes
Parallel outputs for redundant load con‐ No
trol
Parallel outputs for increased load No
Number of outputs on simultaneously • 2 (no adjacent points) at 60 °C hori‐ 4
zontal or 50 °C vertical
• 4 at 55 °C horizontal or 45 °C vertical
Cable length (meters) 50 shielded twisted pair
1
Because both sinking and sourcing configurations are supported by the same circuitry, the active state of a sourcing load is
opposite that of a sinking load. A source output exhibits positive logic (Q bit and LED are ON when the load has current
flow), while a sink output exhibits negative logic (Q bit and LED are OFF when the load has current flow). If the module is
plugged in with no user program, the default for this module is 0 V, which means that a sinking load will be turned ON.
Note
When switching frequencies above 20 kHz, it is important that the digital inputs receive a square
wave. Consider the following options to improve the signal quality to the inputs:
• Minimize the cable length
• Change a driver from a sink only driver to a sinking and sourcing driver
• Change to a higher quality cable
• Reduce the circuit/components from 24 V to 5 V
• Add an external load at the input
Table A-196 Wiring diagrams for the 200 kHz digital output SBs
X19 X19
① For sourcing outputs, connect "Load" to "-" (shown). For sinking outputs, connect "Load" to "+". Because both sinking and
sourcing configurations are supported by the same circuitry, the active state of a sourcing load is opposite that of a sinking load.
A source output exhibits positive logic (Q bit and LED are ON when the load has current flow), while a sink output exhibits
negative logic (Q bit and LED are OFF when the load has current flow). If the module is plugged in with no user program, the
default for this module is 0 V, which means that a sinking load will be turned ON.
Note
Ensure that the M connection wire is securely grounded. Loss of the ground wire connection to
the high-speed DQ SBs may allow enough leakage current to activate a DC load. If the outputs
are used for critical DC load applications, extra caution should be exercised by using a redundant
ground wire to the SB.
Table A-197 Connector pin locations for SB 1222 DQ 4 x 24 V DC, 200 kHz (6ES7222-1BD30-0XB0)
Pin X19
1 L+ / 24 V DC
2 M / 24 V DC
3 DQ e.0
4 DQ e.1
5 DQ e.2
6 DQ e.3
Table A-198 Connector pin locations for SB 1222 DQ 4 x 5 V DC, 200 kHz (6ES7222-1AD30-0XB0)
Pin X19
1 L+ / 5 V DC
2 M / 5 V DC
3 DQ e.0
4 DQ e.1
5 DQ e.2
6 DQ e.3
Note
When switching frequencies above 20 kHz, it is important that the digital inputs receive a square
wave. Consider the following options to improve the signal quality to the inputs:
• Minimize the cable length
• Change a driver from a sink only driver to a sinking and sourcing driver
• Change to a higher quality cable
• Reduce the circuit/components from 24 V to 5 V
• Add an external load at the input
Table A-202 Wiring diagrams for the 200 kHz digital input/output SBs
X19 X19
Note
Ensure that the M connection wire is securely grounded. Loss of the ground wire connection to
the high-speed DQ SBs may allow enough leakage current to activate a DC load. If the outputs
are used for critical DC load applications, extra caution should be exercised by using a redundant
ground wire to the SB.
Table A-203 Connector pin locations for SB 1223 DI 2 x 24 V DC/DQ 2 x 24 V DC, 200 kHz
(6ES7223-3BD30-0XB0)
Pin X19
1 L+ / 24 V DC
2 M / 24 V DC
3 DI e.0
4 DI e.1
5 DQ e.0
6 DQ e.1
Table A-204 Connector pin locations for SB 1223 DI 2 x 5 V DC / DQ 2 x 5 V DC, 200 kHz
(6ES7223-3AD30-0XB0)
Pin X19
1 L+ / 5 V DC
2 M / 5 V DC
3 DI e.0
4 DI e.1
5 DQ e.0
6 DQ e.1
SB 1223 DI 2 x 24 V DC, DQ 2 x 24 V DC
(6ES7223-0BD30-0XB0)
X19
Pin X19
1 L+ / 24 V DC
2 M / 24 V DC
3 DI e.0
4 DI e.1
5 DQ e.0
6 DQ e.1
Note
To use this SB, your CPU firmware must be V2.0 or higher.
AI AI
R 0+ 0+ 0- X19 R 0+ 0+ 0- X19
Sensor
output
- + + - + -
Transducer 24V Power Transducer + + 24V Power
2-Wire Supply 4-Wire - - Supply
X19
X19
Note: Connectors must be gold. See Appendix C, Spare Parts for article number.
A.14.3.2 Sample time and update times for the analog inputs
A.14.3.3 Measurement ranges of the analog inputs for voltage and current (SB and SM)
Table A-222 Analog input representation for voltage (SB and SM)
Table A-223 Analog input representation for current (SB and SM)
A.14.3.4 Measurement ranges of the analog outputs for voltage and current (SB and SM)
Table A-224 Analog output representation for voltage (SB and SM)
Table A-225 Analog output representation for current (SB and SM)
Note
To use this SB, your CPU firmware must be V2.0 or higher.
Two more thermocouples are formed where the two dissimilar wires are attached to the signal
connector. The connector temperature causes a voltage that adds to the voltage from the sensor
thermocouple. If this voltage is not corrected, then the temperature reported will deviate from
the sensor temperature.
Cold junction compensation is used to compensate for the connector thermocouple.
Thermocouple tables are based on a reference junction temperature, usually zero degrees
Celsius. The cold junction compensation compensates the connector to zero degrees Celsius.
The cold junction compensation restores the voltage added by the connector thermocouples.
The temperature of the module is measured internally, and then converted to a value to be
added to the sensor conversion. The corrected sensor conversion is then linearized using the
thermocouple tables.
For optimum operation of the cold junction compensation, the thermocouple module must be
located in a thermally stable environment. Slow variation (less than 0.1 °C/minute) in ambient
module temperature is correctly compensated within the module specifications. Air movement
across the module will also cause cold junction compensation errors.
If better cold junction error compensation is needed, an external iso-thermal terminal block may
be used. The thermocouple module provides for use of a 0 °C referenced or 50 °C referenced
terminal block.
Rejection frequency (Hz) Integration time (ms) Signal board update time (seconds)
10 100 0.306
50 20 0.066
60 16.67 0.056
400 1
10 0.036
1
To maintain module resolution and accuracy when 400 Hz rejection is selected, the integration time is 10 ms. This selection
also rejects 100 Hz and 200 Hz noise.
It is recommended for measuring thermocouples that a 100 ms integration time be used. The
use of smaller integration times will increase the repeatability error of the temperature readings.
Note
After power is applied, the module performs internal calibration for the analog-to-digital
converter. During this time the module reports a value of 32767 on each channel until valid data
is available on that channel. Your user program may need to allow for this initialization time.
Because the configuration of the module can vary the length of the initialization time, you
should verify the behavior or the module in your configuration. If required, you can include logic
in your user program to accommodate the initialization time of the module.
You can implement this logic using a polling read in the "Startup OB" which blocks operation
until the initialization is complete. You must implement the polling read with an immediatede
access. If the value of the thermocouple polling read is 32767, then the read must be repeated
until the value changes. For each module this polling only needs to be executed for the highest
numbered used input point in the module (the module inputs are initialized in order from 0 to
7).
X19
Note: Connectors must be gold. See Appendix C, Spare Parts for article number.
Table A-232 Connector pin locations for SB 1231 AI 1 x 16 bit thermocouple (6ES7231-5QA30-0XB0)
Note
To use this SB, your CPU firmware must be V2.0 or higher.
X19
Table A-237 Connector pin locations for SB 1231 AI 1 x 16 bit RTD (6ES7231-5PA30-0XB0)
Table A-238 Ranges and accuracy for the different sensors supported by the RTD modules
Temperature co‐ RTD type Under range Nominal Nominal Over range Normal Normal
efficient minimum1 range range maximum2 range accu‐ range accu‐
low limit high limit racy @ racy ‑20 °C
25 °C to 60 °C
Pt 0.003850 Pt 100 climatic -145.00 °C -120.00 °C -145.00 °C -155.00 °C ±0.20 °C ±0.40 °C
ITS90 Pt 10 -243.0 °C -200.0 °C 850.0 °C 1000.0 °C ±1.0 °C ±2.0 °C
DIN EN 60751 Pt 50 -243.0 °C -200.0 °C 850.0 °C 1000.0 °C ±0.5 °C ±1.0 °C
Pt 100
Pt 200
Pt 500
Pt 1000
Pt 0.003902 Pt 100 -243.0 °C -200.0 °C 850.0 °C 1000.0 °C ± 0.5 °C ±1.0 °C
Pt 0.003916 Pt 200
Pt 0.003920
Pt 500
Pt 1000
Pt 0.003910 Pt 10 -273.2 °C -240.0 °C 1100.0 °C 1295 °C ±1.0 °C ±2.0 °C
Pt 50 -273.2 °C -240.0 °C 1100.0 °C 1295 °C ±0.8 °C ±1.6 °C
Pt 100
Pt 500
Ni 0.006720 Ni 100 -105.0 °C -60.0 °C 250.0 °C 295.0 °C ±0.5 °C ±1.0 °C
Ni 0.006180 Ni 120
Ni 200
Ni 500
Ni 1000
LG-Ni 0.005000 LG-Ni 1000 -105.0 °C -60.0 °C 250.0 °C 295.0 °C ±0.5 °C ±1.0 °C
Ni 0.006170 Ni 100 -105.0 °C -60.0 °C 180.0 °C 212.4 °C ±0.5 °C ±1.0 °C
Cu 0.004270 Cu 10 -240.0 °C -200.0 °C 260.0 °C 312.0 °C ±1.0 ° ±2.0 °C
Cu 0.004260 Cu 10 -60.0 °C -50.0 °C 200.0 °C 240.0 °C ±1.0 °C ±2.0 °C
Cu 50 -60.0 °C -50.0 °C 200.0 °C 240.0 °C ±0.6 °C ±1.2 °C
Cu 100
Cu 0.004280 Cu 10 -240.0 °C -200.0 °C 200.0 °C 240.0 °C ±1.0 °C ±2.0 °C
Cu 50 -240.0 °C -200.0 °C 200.0 °C 240.0 °C ±0.7 °C ±1.4 °C
Cu 100
1
RTD values below the under-range minimum value are reported as -32768.
2
RTD values above the over-range maximum value are reported as +32768.
Range Under range Nominal range Nominal range Over range Normal range Normal range
minimum low limit high limit maximum1 accuracy accuracy
@ 25 °C ‑20 °C to 60 °C
150 Ω n/a 0 (0 Ω) 27648 (150 Ω) 176.383 Ω ±0.05% ±0.1%
300 Ω n/a 0 (0 Ω) 27648 (300 Ω) 352.767 Ω ±0.05% ±0.1%
600 Ω n/a 0 (0 Ω) 27648 (600 Ω) 705.534 Ω ±0.05% ±0.1%
1
Resistance values above the over-range maximum value are reported as 32767.
Note
The module reports 32767 on any activated channel with no sensor connected. If open wire
detection is also enabled, the module flashes the appropriate red LEDs.
Best accuracy will be achieved for the 10 Ω RTD ranges if 4 wire connections are used.
The resistance of the connection wires in 2 wire mode will cause an error in the sensor reading
and therefore accuracy is not guaranteed.
Table A-240 Noise reduction and update times for the RTD modules
Note
After power is applied, the module performs internal calibration for the analog-to-digital
converter. During this time the module reports a value of 32767 on each channel until valid data
is available on that channel. Your user program may need to allow for this initialization time.
Because the configuration of the module can vary the length of the initialization time, you
should verify the behavior or the module in your configuration. If required, you can include logic
in your user program to accommodate the initialization time of the module.
You can implement this logic using a polling read in the "Startup OB" which blocks operation
until the initialization is complete. You must implement the polling read with an immediatede
access. If the value of the RTD polling read is 32767, then the read must be repeated until the
value changes. For each module this polling only needs to be executed for the highest numbered
used input point in the module (the module inputs are initialized in order from 0 to 7).
Note
The BB 1297 is mechanically designed to fit the CPUs with the firmware 3.0 and later versions.
Do not use the BB 1297 with earlier version CPUs as the BB 1297 connector will not plug into the
CPU.
WARNING
Installing an unspecified battery in the BB 1297, or otherwise connecting an unspecified
battery to the circuit can result in fire or component damage and unpredictable operation
of machinery.
Fire or unpredictable operation of machinery can result in death, severe personal injury, or
property damage.
Use only the specified CR1025 battery for backup of the Real-time clock.
A.16.1 PROFIBUS
Technical specifications
Article number 6GK7242‑5DX30‑0XE0
Interfaces
Connection to PROFIBUS 9-pin D-sub female connector
Technical specifications
Maximum current consumption on the PROFIBUS interface 15 mA at 5 V (only for bus termination) *)
when connecting network components (for example optical
network components)
Permitted ambient conditions
Ambient temperature
• during storage • -40 °C to 70 °C
• during transportation • -40 °C to 70 °C
• during operation with a vertical installation (DIN rail hori‐ • 0 °C to 55 °C
zontal)
• during operation with a horizontal installation (DIN rail • 0 °C to 45 °C
vertical)
Relative humidity at 25 °C during operation, without conden‐ 95 %
sation, maximum
Degree of protection IP20
Power supply, current consumption and power loss
Type of power supply DC
Power supply from the backplane bus 5V
Current consumption (typical) 150 mA
Effective power loss (typical) 0.75 W
Electrical isolation 710 V DC for 1 minute
• PROFIBUS interface to ground
• PROFIBUS interface to internal circuit
Dimensions and weights
• Width • 30 mm
• Height • 100 mm
• Depth • 75 mm
Weight
• Net weight • 115 g
• Weight including packaging • 152 g
*)The current load of an external consumer connected between VP (pin 6) and DGND (pin 5) must not exceed a maximum of 15
mA (short-circuit proof) for bus termination.
PROFIBUS interface
Technical specifications
Article number 6GK7243‑5DX30‑0XE0
Interfaces
Connection to PROFIBUS 9-pin D-sub female connector
Maximum current consumption on the PROFIBUS 15 mA at 5 V (only for bus termination) *)
interface when connecting network components
(for example optical network components)
Permitted ambient conditions
Ambient temperature
• during storage • -40 °C to 70 °C
• during transportation • -40 °C to 70 °C
• during operation with a vertical installation • 0 °C to 55 °C
(DIN rail horizontal)
• during operation with a horizontal installation • 0 °C to 45 °C
(DIN rail vertical)
Technical specifications
Relative humidity at 25 °C during operation, with‐ 95 %
out condensation, maximum
Degree of protection IP20
Power supply, current consumption and power loss
Type of power supply DC
Power supply / external 24 V
• minimum • 19.2 V
• maximum • 28.8 V
Current consumption (typical)
• from 24 V DC • 100 mA
• from the S7‑1200 backplane bus • 0 mA
Effective power loss (typical)
• from 24 V DC • 2.4 W
• from the S7‑1200 backplane bus • 0W
Power supply 24 V DC / external
• Min. cable cross section • min.: 0.14 mm2 (AWG 25)
• Max. cable cross section • max.: 1.5 mm2 (AWG 15)
• Tightening torque of the screw terminals • 0.45 Nm (4 lb-in)
Electrical isolation 710 V DC for 1 minute
• PROFIBUS interface to ground
• PROFIBUS interface to internal circuit
Dimensions and weights
• Width • 30 mm
• Height • 100 mm
• Depth • 75 mm
Weight
• Net weight • 134 g
• Weight including packaging • 171 g
*)The current load of an external consumer connected between VP (pin 6) and DGND (pin 5) must not
exceed a maximum of 15 mA (short-circuit proof) for bus termination.
Note
The CM 1243-5 (PROFIBUS master module) must receive power from the 24 V DC sensor supply
of the CPU.
PROFIBUS interface
PROFIBUS cable
Note
Contacting the shield of the PROFIBUS cable
The shield of the PROFIBUS cable must be contacted.
To do this, strip the insulation from the end of the PROFIBUS cable and connect the shield to
functional earth.
A.16.2 CP 1242-7
Note
The CP 1242-7 is not approved for Maritime applications
The CP 1242-7 does not have Maritime approval.
Note
To use these modules, your CPU firmware must be V2.0 or higher.
Technical specifications
Article number 6GK7242‑7KX3‑0XE0
Wireless interface
Antenna connector SMA socket
Nominal impedance 50 ohms
Wireless connection
Maximum transmit power • GSM 850, class 4: +33 dBm ±2dBm
• GSM 900, class 4: +33 dBm ±2dBm
• GSM 1800, class 1: +30 dBm ±2dBm
• GSM 1900, class 1: +30 dBm ±2dBm
GPRS Multislot class 10
device class B
coding scheme 1...4 (GMSK)
SMS Mode outgoing: MO
service: point-to-point
Permitted ambient conditions
Ambient temperature
• during storage • -40 °C to 70 °C
• during transportation • -40 °C to 70 °C
• during operation with a vertical installation (DIN rail hori‐ • 0 °C to 55 °C
zontal)
• during operation with a horizontal installation (DIN rail • 0 °C to 45 °C
vertical)
Relative humidity at 25 °C during operation, without conden‐ 95 %
sation, maximum
Degree of protection IP20
Power supply, current consumption and power loss
Type of power supply DC
Power supply / external 24 V
• minimum • 19.2 V
• maximum • 28.8 V
Current consumption (typical)
• from 24 V DC • 100 mA
• from the S7‑1200 backplane bus • 0 mA
Technical specifications
Effective power loss (typical)
• from 24 V DC • 2.4 W
• from the S7‑1200 backplane bus • 0W
24 V DC power supply
• Min. cable cross section • min.: 0.14 mm2 (AWG 25)
• Max. cable cross section • max.: 1.5 mm2 (AWG 15)
• Tightening torque of the screw terminals • 0.45 Nm (4 lb-in)
Electrical isolation 710 V DC for 1 minute
Power supply unit to internal circuit
Dimensions and weights
• Width • 30 mm
• Height • 100 mm
• Depth • 75 mm
Weight
• Net weight • 133 g
• Weight including packaging • 170 g
Note
Preventing CPU interference from antennas
CPU interference can occur if antenna proximity is too close, or if you do not use recommended
antennas. For recommended antennas, refer to Antenna ANT794-4MR for LTE/UMTS/GSM
Compact Operating Instructions (https://support.industry.siemens.com/cs/ww/en/view/
23119005) (available in English and German only).
ANT794-4MR
Article number 6NH9860‑1AA00
Mobile wireless networks GSM/GPRS
Frequency ranges • 824 to 960 MHz (GSM 850, 900)
• 1 710 to 1 880 MHz (GSM 1 800)
• 1 900 to 2 200 MHz (GSM / UMTS)
Characteristics omnidirectional
Antenna gain 0 dB
Impedance 50 ohms
Standing wave ratio (SWR) < 2,0
Max. power 20 W
Polarity linear vertical
ANT794-4MR
Connector SMA
Length of antenna cable 5m
External material Hard PVC, UV-resistant
Degree of protection IP20
Permitted ambient conditions
• Operating temperature • -40 °C through +70 °C
• Transport/storage temperature • -40 °C through +70 °C
• Relative humidity • 100 %
External material Hard PVC, UV-resistant
Construction Antenna with 5 m fixed cable and SMA male con‐
nector
Dimensions (D x H) in mm 25 x 193
Weight
• Antenna incl. cable • 310 g
• Fittings • 54 g
Installation With supplied bracket
ANT794-3M
Article number 6NH9870‑1AA00
Mobile wireless networks GSM 900 GSM 1800/1900
Frequency ranges 890 - 960 MHz 1710 - 1990 MHz
Standing wave ratio (VSWR) ≤ 2:1 ≤ 1,5:1
Return loss (Tx) ≈ 10 dB ≈ 14 dB
Antenna gain 0 dB
Impedance 50 ohms
Max. power 10 W
Antenna cable HF cable RG 174 (fixed) with SMA male connector
Cable length 1.2 m
Degree of protection IP64
Permitted temperature range -40 °C to +75 °C
Flammability UL 94 V2
External material ABS Polylac PA-765, light gray (RAL 7035)
Dimensions (W x L x H) in mm 70.5 x 146.5 x 20.5
Weight 130 g
Technical data
Article number 3RK7243-2AA30-0XB0
Firmware version V1.0
Date 01.12.2011
Interfaces
Maximum current consumption
From the S7‑1200 backplane bus Max. 250 mA,
From the AS-i cable supply voltage S7-1200 communication bus 5 V DC
Max. 100 mA
Maximum current carrying capacity between the 8A
ASI+/ASI- terminals
Pin assignment See section Electrical connections of the AS-i master
(Page 1349)
Conductor cross-section 0.2 mm² (AWG 24) ... 3.3 mm² (AWG 12)
ASI connector tightening torque 0.56 Nm
Permissible ambient conditions
Ambient temperature
During storage -40 °C ... 70 °C
During transport -40 °C ... 70 °C
During the operating phase, with vertical installation (hori‐
zontal standard mounting rail) 0 °C ... 55 °C
During the operating phase, with horizontal installation (ver‐
tical standard mounting rail) 0 °C ... 45 °C
Relative humidity at 25 °C during operating phase, no con‐ 95 %
densation, maximum
Degree of protection IP20
Power supply, current consumption, power loss
Type of power supply DC
Current consumption (typically)
From the S7‑1200 backplane bus 200 mA
Total power loss (typical):
• From the S7‑1200 backplane bus 1W
2.4 W
• From AS-i cable
Dimensions and weights
Technical data
Width 30 mm
Height 100 mm
Depth 75 mm
Weight
Net weight 122 g
Weight including packaging 159 g
AS‑Interface terminals
The removable terminal for connecting the AS‑i cable is located behind the lower cover on the
front of the AS-i master CM 1243‑2.
If the AS‑i shaped cable is used, you can recognize the correct polarity of the cable by means of
the symbol
Information on how to remove and re-install the terminal block can be found in the Installation
chapter (Page 55).
Note
Maximum current carrying capacity of the terminal contacts
The current carrying capacity of the connection contacts is max. 8 A. If this value is exceeded on
the AS-i cable, the AS-i master CM 1243-2 must not be "looped in" to the AS-i cable, but must
instead be connected via a spur line (only one connection pair assigned on the AS-i master
CM 1243-2).
Please also ensure that the cables used are suitable for operating temperatures of at least 75 °C
if current is being conducted via the AS-i master and currents of greater than 4 amperes are
present.
You will find additional information on connecting the AS‑i cable in the section "Installation,
connection and commissioning of the modules" in the manual "AS-i Master CM 1243-2 and AS-
i data decoupling unit DCM 1271 for SIMATIC S7-1200".
Terminal assignment
Label Meaning
ASI+ AS‑i connection – positive polarity
ASI– AS‑i connection – negative polarity
Functional ground
Note
To use this CB, your CPU firmware must be V2.0 or higher.
① Connect "TA" and TB" as shown to terminate the network. (Terminate only the end devices on the RS485 network.)
② Use shielded twisted pair cable and connect the cable shield to ground.
You terminate only the two ends of the RS485 network. The devices in between the two end
devices are not terminated or biased. See the topic "Biasing and terminating an RS485 network
connector" (Page 892)
WARNING
Safe use of input simulators
These input simulators are not approved for use in Class I DIV 2 or Class I Zone 2 hazardous
locations. The switches present a potential spark hazard/explosion hazard if used in a Class I DIV
2 or Class I Zone 2 location. Unapproved use could result in death or serious injury to personnel,
and/or damage to equipment.
Use these input simulators only in non-hazardous locations. Do not use in Class I DIV 2 or Class
I Zone 2 hazardous locations.
PP
PP
Note
Follow ESD guidelines when handling the S7-1200 Potentiometer module.
Technical Data
Article number 6ES7290-6AA30-0XA0
Cable length 2m
Weight 200 g
Refer to the installation section (Page 56) for information about installing and removing the
S7-1200 expansion cable.
• Complies to the CANopen communication profiles CiA 301 rev. 4.2 and the CiA 302 rev. 4.1
• Supports transparent CAN 2.0A for custom protocol handling
• Pre-made function blocks available for each PLC programming in TIA portal
• CM CANopen modules include; DSUB with screw terminals for subnetwork. CM CANopen
configuration studio CD, and USB configuration cable
For more information about this product and for the product documentation, refer to the
product catalog web site for the CM CANopen.
See also
SIWAREX WP251 (https://support.industry.siemens.com/cs/ww/en/view/109481751)
WARNING
Connecting an external 24 V DC power supply in parallel with the DC sensor supply can
result in a conflict between the two supplies as each seeks to establish its own
preferred output voltage level.
The result of this conflict can be shortened lifetime or immediate failure of one or both
power supplies, with consequent unpredictable operation of the PLC system. Unpredictable
operation could result in death, severe personal injury and/or property damage.
The DC sensor supply on the CPU and any external power supply should provide power to
different points. A single connection of the commons is allowed.
Some of the 24 V DC power input ports in the PLC system are interconnected, with a logic
common circuit connecting multiple M terminals. The CPU 24 V DC power supply input, the SM
relay coil power input, and a non-isolated analog power supply input are examples of circuits
that are interconnected when designated as not isolated in the data sheets. All non-isolated M
terminals must connect to the same external reference potential.
WARNING
Connecting non-isolated M terminals to different reference potentials will cause
unintended current flows that may cause damage or unpredictable operation in the PLC
and connected equipment.
Such damage or unpredictable operation could result in death, severe personal injury and/or
property damage.
Always be sure that all non-isolated M terminals in a PLC system are connected to the same
reference potential.
Information about the power budgets of the CPUs and the power requirements of the signal
modules is provided in the technical specifications (Page 1183).
Note
Exceeding the power budget of the CPU may result in not being able to connect the maximum
number of modules allowed for your CPU.
Note
The CPU has already allocated the power required to drive the internal relay coils. You do not
need to include the internal relay coil power requirements in a power budget calculation.
The CPU in this example provides sufficient 5 V DC current for the SMs, but does not provide
enough 24 V DC current from the sensor supply for all of the inputs and expansion relay coils.
The I/O requires 456 mA and the CPU provides only 400 mA. This installation requires an
additional source of at least 56 mA at 24 V DC power to operate all the included 24 V DC inputs
and outputs.
Minus
System requirements 5 V DC 24 V DC
Total requirements
Equals
Current balance 5 V DC 24 V DC
Current balance total
C.2 Signal modules (SMs), signal boards (SBs), and battery boards
(BBs)
C.3 Communication
Note
Keyed removable terminal blocks
PLCs always require correct wiring to ensure safety and proper operation.
When replacing the terminal block in your CPU or SM, it is important that you use the correct
terminal block and correct wiring source for your module.
The keyed feature helps prevent you from accidentally placing a high voltage wired terminal
block into a low voltage module, or from placing a special voltage wired terminal block into a
normal voltage module. Some terminal blocks are specifically keyed at left, at right or at middle.
Removable terminal block Key on device Key on device only fits appropriate re‐
(keyed example shown movable terminal block
Table C-16 S7-1200 CPU V4.0 and later - Terminal block spare kits
If you have S7-1200 CPU V4.0 and later Use this terminal block spare kit (4/pk)
(article number) Terminal block (screw- Equivalent Terminal block
type) Push-in terminal block description
article number
article number
CPU 1211C DC/DC/DC 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7211-1AE40-0XB0) 6ES7292-1AH30-0XA0 6ES7292-2AH30-0XA0 8 pin, tin-plated
6ES7292-1AP30-0XA0 6ES7292-2AP30-0XA0 14 pin, tin-plated
CPU 1211C DC/DC/Relay 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7211-1HE40-0XB0) 6ES7292-1AH40-0XA0 6ES7292-2AH40-0XA0 8 pin, tin-plated,
keyed
6ES7292-1AP30-0XA0 6ES7292-2AP30-0XA0 14 pin, tin-plated
CPU 1211C AC/DC/Relay 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7211-1BE40-0XB0) 6ES7292-1AH40-0XA0 6ES7292-2AH40-0XA0 8 pin, tin-plated,
keyed
6ES7292-1AP40-0XA0 6ES7292-2AP40-0XA0 14 pin, tin-plated,
keyed
CPU 1212C DC/DC/DC 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7212-1AE40-0XB0) 6ES7292-1AH30-0XA0 6ES7292-2AH30-0XA0 8 pin, tin-plated
6ES7292-1AP30-0XA0 6ES7292-2AP30-0XA0 14 pin, tin-plated
CPU 1212C DC/DC/Relay 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7212-1HE40-0XB0) 6ES7292-1AH40-0XA0 6ES7292-2AH40-0XA0 8 pin, tin-plated,
keyed
6ES7292-1AP30-0XA0 6ES7292-2AP30-0XA0 14 pin, tin-plated
If you have S7-1200 CPU V4.0 and later Use this terminal block spare kit (4/pk)
(article number) Terminal block (screw- Equivalent Terminal block
type) Push-in terminal block description
article number
article number
CPU 1212C AC/DC/Relay 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7212-1BE40-0XB0) 6ES7292-1AH40-0XA0 6ES7292-2AH40-0XA0 8 pin, tin-plated,
keyed
6ES7292-1AP40-0XA0 6ES7292-2AP40-0XA0 14 pin, tin-plated,
keyed
CPU 1214C DC/DC/DC 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7214-1AG40-0XB0) 6ES7292-1AM30-0XA0 6ES7292-2AM30-0XA0 12 pin, tin-plated
6ES7292-1AV30-0XA0 6ES7292-2AV30-0XA0 20 pin, tin-plated
CPU 1214C DC/DC/Relay 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7214-1HG40-0XB0) 6ES7292-1AM40-0XA0 6ES7292-2AM40-0XA0 12 pin, tin-plated,
keyed
6ES7292-1AV30-0XA0 6ES7292-2AV30-0XA0 20 pin, tin-plated
CPU 1214C AC/DC/Relay 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7214-1BG40-0XB0) 6ES7292-1AM40-0XA0 6ES7292-2AM40-0XA0 12 pin, tin-plated,
keyed
6ES7292-1AV40-0XA0 6ES7292-2AV40-0XA0 20 pin, tin-plated,
keyed
CPU 1215C DC/DC/DC 6ES7292-1BF30-0XB0 6ES7292-2BF30-0XB0 6 pin, gold-plated
(6ES7215-1AG40-0XB0) 6ES7292-1AM30-0XA0 6ES7292-2AM30-0XA0 12 pin, tin-plated
6ES7292-1AV30-0XA0 6ES7292-2AV30-0XA0 20 pin, tin-plated
CPU 1215C DC/DC/Relay 6ES7292-1BF30-0XB0 6ES7292-2BF30-0XB0 6 pin, gold-plated
(6ES7215-1HG40-0XB0) 6ES7292-1AM40-0XA0 6ES7292-2AM40-0XA0 12 pin, tin-plated,
keyed
6ES7292-1AV30-0XA0 6ES7292-2AV30-0XA0 20 pin, tin-plated
CPU 1215C AC/DC/Relay 6ES7292-1BF30-0XB0 6ES7292-2BF30-0XB0 6 pin, gold-plated
(6ES7215-1BG40-0XB0) 6ES7292-1AM40-0XA0 6ES7292-2AM40-0XA0 12 pin, tin-plated,
keyed
6ES7292-1AV40-0XA0 6ES7292-2AV40-0XA0 20 pin, tin-plated,
keyed
CPU 1217C DC/DC/DC 6ES7292-1BF30-0XB0 6ES7292-2BF30-0XB0 6 pin, gold-plated
(6ES7217-1AG40-0XB0) 6ES7292-1AK30-0XA0 6ES7292-2AK30-0XA0 10 pin, pin-plated
6ES7292-1AR30-0XA0 6ES7292-2AR30-0XA0 16 pin, pin-plated
6ES7292-1AT30-0XA0 6ES7292-2AT30-0XA0 18 pin, tin-plated
Table C-17 S7-1200 SMs V3.2 and later - Terminal block spare kits
If you have S7-1200 SMs V3.2 and later Use this terminal block spare kit (4/pk)
(article number) Terminal block (screw- Equivalent Terminal block
type) Push-in terminal block description
article number
article number
SM 1221 DI 8 x DC 6ES7292-1AG30-0XA0 6ES7292-2AG30-0XA0 7 pin, tin-plated
(6ES7221-1BF32-0XB0)
SM 1222 DQ 8 x DC 6ES7292-1AG30-0XA0 6ES7292-2AG30-0XA0 7 pin, tin-plated
(6ES7222-1BF32-0XB0)
SM 1222 DQ 8 x Relay 6ES7292-1AG40-0XA1 6ES7292-2AG40-0XA1 7 pin, tin-plated,
(6ES7222-1HF32-0XB0) keyed-left
SM 1238 Energy Meter 480 V AC 6ES7292-1AG40-0XA2 6ES7292-2AG40-0XA2 7-pin, tin-plated,
(6ES7238-5XA32-0XB0) for voltage input keyed-middle
(top)
SM 1238 Energy Meter 480 V AC 6ES7292-1AG30-0XA0 6ES7292-2AG30-0XA0 7-pin, tin-plated
(6ES7238-5XA32-0XB0) for current input
(bottom)
SM 1231 AI 4 x 13 bit 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7231-4HD32-0XB0)
SM 1232 AQ 2 x 14 bit 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7232-4HB32-0XB0)
SM 1231 AI 4 x TC 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7231-5QD32-0XB0)
SM 1231 AI 4 x 16 bit 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7231-5ND32-0XB0)
SM 1221 DI 16 x DC 6ES7292-1AG30-0XA0 6ES7292-2AG30-0XA0 7 pin, tin-plated
(6ES7221-1BH32-0XB0)
SM 1222 DQ 16 x DC 6ES7292-1AG30-0XA0 6ES7292-2AG30-0XA0 7 pin, tin-plated
(6ES7222-1BH32-0XB0)
SM 1222 DQ 16 x Relay 6ES7292-1AG40-0XA0 6ES7292-2AG40-0XA0 7 pin, tin-plated,
(6ES7222-1HH32-0XB0) keyed-right
SM 1223 DI 8 x DC/DQ 8 x DC 6ES7292-1AG30-0XA0 6ES7292-2AG30-0XA0 7 pin, tin-plated
(6ES7223-1BH32-0XB0)
SM 1223 8 x DC/8 x Relay 6ES7292-1AG30-0XA0 6ES7292-2AG30-0XA0 7 pin, tin-plated
(6ES7223-1PH32-0XB0) 6ES7292-1AG40-0XA0 6ES7292-2AG40-0XA0 7 pin, tin-plated,
keyed-right
SM 1223 8 x AC/8 x Relay 6ES7292-1AG40-0XA0 6ES7292-2AG40-0XA0 7 pin, tin-plated,
(6ES7223-1QH32-0XB0) keyed-right
SM 1234 AI 4 / AQ 2 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7234-4HE32-0XB0)
SM 1231 AI 8 x 13 BIT 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7231-4HF32-0XB0)
SM 1232 AQ 4 x 14 bit 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7232-4HD32-0XB0)
SM 1231 AI 4 x RTD 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7231-5PD32-0XB0)
If you have S7-1200 SMs V3.2 and later Use this terminal block spare kit (4/pk)
(article number) Terminal block (screw- Equivalent Terminal block
type) Push-in terminal block description
article number
article number
SM 1231 AI 8 x TC 6ES7292-1BG30-0XA0 6ES7292-2BG30-0XA0 7 pin, gold-plated
(6ES7231-5QF32-0XB0)
SM 1278 IO LINK 6ES7292-1AG30-0XA0 6ES7292-2AG30-0XA0 7 pin, tin-plated
(6ES7278-4BD32 0XB0)
SM 1222 DQ 8 x Relay (Changeover) 6ES7292-1AL40-0XA0 6ES7292-2AL40-0XA0 11 pin, tin-plated,
(6ES7222‑1XF32‑0XB0) keyed
SM 1223 DI 16 x DC/DQ 16 x DC 6ES7292-1AL30-0XA0 6ES7292-2AL30-0XA0 11 pin, tin-plated
(6ES7223-1BL32-0XB0)
SM 1223 DI 16 x DC/DQ 16 x Relay 6ES7292-1AL30-0XA0 6ES7292-2AL30-0XA0 11 pin, tin-plated
(6ES7223-1PL32-0XB0) 6ES7292-1AL40-0XA0 6ES7292-2AL40-0XA0 11 pin, tin-plated,
keyed
SM 1231 AI 8 x RTD 6ES7292-1BL30-0XA0 6ES7292-2BL30-0XA0 11 pin, gold-plated
(6ES7231-5PF32-0XB0)
Table C-18 S7-1200 SBs, CBs, and BBs - Terminal block spare kits
If you have S7-1200 SB, CB, or BB (article number) Use this terminal block spare kit (4/pk)
Terminal block (screw- Terminal block
type) description
article number
SB 1221 DI 4 x 5 V DC (6ES7221-3AD30-0XB0) 6ES7292-1BF30-0XA0 6-pin
SB 1221 DI 4 x 5 V DC (6ES7221-3AD30-0XB0)
SB 1221 DI 4 x 24 V DC (6ES7221-3BD30-0XB0)
SB 1222 DQ 4 x 5 V DC (6ES7222-1AD30-0XB0)
SB 1222 DQ 4 x 24 V DC (6ES7222-1BD30-0XB0)
SB 1223 DI 2x24 V DC/DQ 2x24 V DC (6ES7223-0BD30-0XB0)
SB 1223 DI 2x5 V DC / DQ 2x5 V DC (6ES7223-3AD30-0XB0)
SB 1223 DI 2x24 V DC / DQ 2x24 V DC (6ES7223-3BD30-0XB0)
SB 1231 AI 1 x 12 BIT (6ES7231-4HA30-0XB0)
SB 1231 AI 1 x RTD (6ES7231-5PA30-0XB0)
SB 1231 AI 1 x TC (6ES7231-5QA30-0XB0)
SB 1232 AQ 1x12 BIT (6ES7232-4HA30-0XB0)
CB 1231 RS485 (6ES7241-1CH30-1XB0)
BB 1297 Battery (6ES7297-0AX30-0XA0)
If you have Fail-Safe CPU (article num‐ Use this terminal block spare kit (4/pk)
ber) Terminal block Equivalent Push‑in termi‐ Terminal block
article number nal block article number description
CPU 1212FC DC/DC/DC 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7212-1AF40-0XB0) 6ES7292-1AH30-0XA0 6ES7292-2AH30-0XA0 12 pin, tin-plated
6ES7292-1AP30-0XA0 6ES7292-2AP30-0XA0 20 pin, tin-plated
CPU 1212FC DC/DC/Relay 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7212-1HF40-0XB0) 6ES7292-1AH40-0XA0 6ES7292-2AH40-0XA0 3 pin, gold-plated
6ES7292-1AP30-0XA0 6ES7292-2AP30-0XA0 12 pin, tin-plated,
keyed
CPU 1214FC DC/DC/DC 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7214-1AF40-0XB0) 6ES7292-1AM30-0XA0 6ES7292-2AM30-0XA0 12 pin, tin-plated
6ES7292-1AV30-0XA0 6ES7292-2AV30-0XA0 20 pin, tin-plated
CPU 1214FC DC/DC/Relay 6ES7292-1BC30-0XA0 6ES7292-2BC30-0XA0 3 pin, gold-plated
(6ES7214-1HF40-0XB0) 6ES7292-1AM40-0XA0 6ES7292-2AM40-0XA0 12 pin, tin-plated,
keyed
6ES7292-1AV30-0XA0 6ES7292-2AV30-0XA0 20 pin, tin-plated
CPU 1215FC DC/DC/DC (6ES7215-1AF40 6ES7292-1BF30-0XB0 6ES7292-2BF30-0XB0 6 pin, gold-plate
0XB0) 6ES7292-1AM30-0XA0 6ES7292-2AM30-0XA0 12 pin, tin-plated
6ES7292-1AV30-0XA0 6ES7292-2AV30-0XA0 20 pin, tin-plated
CPU 1215FC DC/DC/Relay 6ES7292-1BF30-0XB0 6ES7292-2BF30-0XB0 6 pin, gold-plated
(6ES7215-1HF40 0XB0) 6ES7292-1AM40-0XA0 6ES7292-2AM40-0XA0 2 pin, tin-plated,
keyed
6ES7292-1AV30-0XA0 6ES7292-2AV30-0XA0 20 pin, tin-plated
If you have Fail-Safe signal module (ar‐ Use this Terminal block spare kit (4/pk)
ticle number) Terminal block Equivalent Push‑in termi‐ Terminal block
article number nal block article number description
SM 1226 F-DI (6ES7226-6BA32-0XB0) 6ES7292-1AL30-0XA0 6ES7292-2AL30-0XA0 11 pin, tin-plated
SM 1226 F-DQ (6ES7226-6DA32-0XB0) 6ES7292-1AL30-0XA0 6ES7292-2AL30-0XA0 11 pin, tin-plated
SM 1226 F-Relay (6ES7226-6RA32-0XB0) 6ES7292-1AL40-0XA0 6ES7292-2AL40-0XA0 11 pin, tin-plated,
keyed
Note
No device exchange possible in STEP 7 from V4.x to V3.0
You can exchange a V3.0 CPU for a V4.x CPU, but you cannot exchange a V4.x CPU for a V3.0 CPU
after you download the configuration. If you want to view or otherwise use your existing STEP 7
V3.0 project, make an archive of your STEP 7 V3.0 project prior to the device exchange.
Note that if you have not downloaded the exchanged device configuration, you can undo it.
After downloading, however, you cannot undo the exchange from V3.0 to V4.x.
You need to be aware of some configuration and operational changes between the two CPU
versions:
WARNING
Risks with copying and pasting program logic from older versions of STEP 7
Copying program logic from an older version of STEP 7 such as STEP 7 V12 into STEP 7 V15 can
cause unpredictable behavior in program execution or failures to compile. Different versions of
STEP 7 implement program elements differently. The compiler does not always detect the
differences if you made the changes by pasting from an older version into STEP 7 V15.
Executing unpredictable program logic could result in death or severe personal injury if you do
not correct the program.
When using program logic from a release of STEP 7 earlier than STEP 7 V15, always upgrade the
entire project to STEP 7 V15. Then you can copy, cut, paste, and edit program logic as necessary.
In STEP 7 V15, you can open a project from STEP 7 V13 SP1 or later. STEP 7 then performs the
necessary compatibility conversions and upgrades the program correctly. Such upgrade
conversions and corrections are necessary for proper program compilation and execution. If
your project is older than STEP 7 V13 SP1, you must upgrade the project incrementally to STEP 7
V15.
Organization blocks
You can configure OB execution to be interruptible or non-interruptible (Page 83). In projects
from V3.0 CPUs, STEP 7 set all OBs by default to be non-interruptible.
STEP 7 sets all OB priorities (Page 83) to the values they were in the V3.0 CPU STEP 7 project.
You can subsequently change the interruptability or priority settings if you choose.
The Diagnostic error interrupt OB (Page 76) start information references the submodule as a
whole if no diagnostics event is pending.
Note that the V4.x access level "No access (complete protection)" did not exist for V3.0.
Web server
If you use user-defined Web pages in your V3.0 project, store them in your project installation
folder under the subfolder "UserFiles\Webserver" prior to upgrading your project. If you store
your user-defined pages at this location, saving the STEP 7 project will also save the user-defined
Web pages.
If you exchange a V3.0 CPU for a V4.x CPU, your Web server project setting (Page 805) for
activating the Web server and HTTPS setting will be the same as it was in V3.0. You can then
configure users, privileges, passwords (Page 808), and languages (Page 805) as needed to use
the Web server. If you do not configure users with additional privileges, then you are limited as
to what you can view from the standard Web pages (Page 816). The S7‑1200 V4.x CPU does not
support the former pre-configured "admin" user and password.
The S7-1200 V3.0 Web server Data log page provided a "Download and Clear" operation. The
V4.x Web server File browser page (Page 845), from which you access data logs, no longer
provides this feature. Instead, the Web server provides the ability to download, rename, and
delete data log files.
GET/PUT communication
By default, S7‑1200 V3.0 CPUs enabled GET/PUT communication. When you replace your V3.0
CPU with a V4.x CPU (Page 142), you see a message in the compatibility information section
stating that GET/PUT is enabled.
The TO structure is different between motion control versions V3.0 and V5.0. All associated
blocks change as well. Block interfaces, watch tables, and traces update to the new motion
control V5.0 structure. You can find the differences between the V3.0 CPU and V4.x CPU motion
control axis parameters in the following two tables:
The only "commandtable" parameter that is renamed is the array with the commands:
V3.0 V4.x
Config.Command[] Command[]
Note: The array "Command[]" is a UDT of the type "TO_CmdTab_Config_Command" in V3.0 and
"TO_Struct_Command" in V4.x.
Instruction changes
The following instructions have changes in parameters or behavior:
• RDREC and WRREC (Page 352)
• CONV (Page 269)
If you have already performed the device exchange, you must remove the 100-byte reserve from
each block individually:
1. From the project tree, right-click a data block from the Program blocks folder and select
Properties from the shortcut menu.
2. In the Data block properties dialog, select the "Download without reinitialization" node.
3. Set the memory reserve to 0 bytes.
4. Repeat for each data block in your project.
Table D-1 S7-1200 CPU V3.0 and earlier - Terminal Block spare kits
Table D-2 S7-1200 SMs V3.0 and earlier - Terminal Block spare kits
size limit and calculating size, 479 Device configuration, 127, 688
viewing Data logs, 478 add modules, 132
Data transmission, initiating, 924, 1063 add new device, 129
Data types, 100 AS-i, 748
arrays, 107 AS-i port, 748
Bool, Byte, Word, and DWord, 101 changing a device type, 142
characters and strings, 105 configuring the CPU, 143
PLC data type editor, 108 configuring the modules, 158
Real, LReal (floating-point real), 103 discover, 130
Struc, 108 download, 188
Time, Date, TOD (time of day), DTL (date and time Ethernet port, 572
long), 104 network connection, 565
USInt, SInt, UInt, Int, UDInt, Dint (integer), 102 PROFIBUS, 743
Variant (pointer), 109 PROFINET port, 572
DataLogClear, 472 time synchronization property (PROFINET), 579
DataLogDelete, 474 Device exchange
Date procedure, 142
Date data type, 104 V3.0 CPU for a V4.x CPU, 1380
DTL (date and time long data type), 104 DeviceStates (read module status of an I/O
SET_TIMEZONE (set time zone), 315 system), 423
T_ADD (add times), 310 DeviceStates, example, 424
T_COMBINE (combine times), 311 Diagnostic error interrupt OB, 76
T_CONV (convert times and extract), 309 Diagnostic standard Web page, 825
T_DIFF (time difference), 311 Diagnostics
T_SUB (subtract times), 310 buffer, 92
Daylight saving time TimeTransformationRule, 314 cycle time, 1150
DB (data block), (Data block) DeviceStates (read module status of an I/O
DB_ANY_TO_VARIANT (Convert DB_ANY to system), 423
VARIANT, 279 diagnostics buffer, 1151
DC GET_DIAG (read diagnostic information), 432
grounding, 59 Get_IM_Data (read the identification and
inductive loads, 62 maintenance data), 408
isolation guidelines, 59 LED (read LED status), 407
outputs, 1190 LED indicators, 1137
wiring guidelines, 58, 60 memory usage, 1150
Debugging in RUN mode, 1170 ModuleStates (read module status information of a
Debugging n RUN mode, 1162 module), 427
DEC (decrement), 226 status indicator, 91
DECO (decode), 303 watch table, 1157
Defining enum types, user-defined Web pages, 856 Diagnostics standard Web page, 823
Degree of protection, 1189 Diagnostics, reducing security events, 92
DELETE (delete characters in a character string), 335 Differences
DELETE_DB (Delete data block), 496 in Modbus RTU instructions, 1028
DEMUX (demultiplex), 306 in Modbus TCP instructions, 964
Deserialize, 234 in point-to-point instructions, 894
Designing a PLC system, 165, 166 in TCON, TDISCON, TSEND, and TRCV
DETACH (detach an OB from an interrupt even)t, 382 instructions, 617
Device in TSEND_C and TRCV_C instructions, 598
PROFINET IO, 695 in USS instructions, 944
PROFINET IO device names, 696 Digital I/O
shared, 710 configuration, 159
inputs and outputs, 1161 GetInstancePath (Query composite global name of the
peripheral inputs, 1160, 1161 block instance), 346
scan cycle, 1161 GETIO, 355
watch table, 1157 GETIO_PART, 357
Force table GETSMCInfo, 438
addressing peripheral inputs, 1160 GetSMCinfo (Reading out information about the
force, 1160 memory card), 438
force operation, 1161 GetStationInfo, 415
Formatting a memory card, 1149 GetSymbolName (Read out a tag on the input
FRAC (return fraction), 229 parameter), 339
Fragment DBs (user-defined Web pages) GetSymbolPath (Query composite global name of the
creating from AWP command, 858 input parameter assignment), 342
generating, 863 Global data block, 94, 172
importing with AWP command, 859 Global library
Freeport protocol, 894 legacy USS protocol overview, 1070
Frequency, clock bits, 91 USS protocol overview, 944
Function (FC) Go online, 1141
calling code blocks within the user program, 167 GOTO, SCL, 301
know-how protection, 156 GSD file, 707
linear and structured programs, 166 Guidelines
overview, 65, 170 CPU installation, 49
valid FC numbers, 65 grounding, 59
Function block (FB) inductive loads, 62
calling code blocks within the user program, 167 installation, 43
initial value, 171 installation procedures, 48
instance data block, 171 isolation, 59
know-how protection, 156 lamp loads, 61
linear and structured programs, 166 wiring guidelines, 58, 60
output parameters, 171
overview, 65, 171
single FB with multiple instance DBs, 172 H
valid FB numbers, 65
Hardware configuration, 127
Functionality, I-device, 698
add modules, 132
add new device, 129
AS-i, 748
G AS-i port, 748
Gen_UsrMsg (Generate user diagnostic alarms), 395 configuring the CPU, 143
Generating user-defined Web page DBs, 863 configuring the modules, 158
GEO2LOG (Determine the hardware identifier based discover, 130
upon slot information), 497 download, 188
GEOADDR, 502 Ethernet port, 572
GET (read data from a remote CPU), 755 network connection, 565
configuring the connection, 567 PROFIBUS, 743
GET_DIAG (read diagnostic information), 432 PROFINET port, 572
GET_ERROR (get error locally), 289 Hardware flow control, 899
GET_ERROR_ID (get error ID locally), 291 Hardware interrupt OB, 74
Get_Features (get advanced features), 932 High-speed counter, 512, 537
Get_IM_Data (read the identification and cannot be forced, 1161
maintenance data), 408 configuration, 527
GetBlockName (Read out name of the block), 348 counting modes, 528
GetInstanceName (Read out name of block operating phase, 528
instance), 344
F_TRIG (set tag on negative signal edge), 203 Label (jump label), 280
FieldRead (read field), 250 LED (read LED status), 407
FieldWrite (write field), 250 LEFT (read the left characters of a character
FileDelete, 508 string), 334
FileReadC, 504 legacy TCON, TDISCON, TSEND, and TRCV
FileWriteC, 506 instructions, 635
FILL_BLK (fill block), 239 legacy TRCV_C (receive data via Ethernet
FIND (find characters in a character string), 338 (TCP)), 611
FLOOR (generate next lower integer from floating- legacy TSEND_C (send data via Ethernet
point number), 274 (TCP)), 611
FOR (SCL), 297 legacy USS status codes, 1080
force operation, 1161 LEN (determine the length of a character string),
FRAC (return fraction), 229 LIMIT (set limit value), 228
Gen_UsrMsg (Generate user diagnostic LN (form natural logarithm), 229
alarms), 395 LOG2GEO (Determine the slot from the hardware
GEO2LOG (Determine the hardware identifier identifier), 499
based upon slot information), 497 LOWER_BOUND (read out ARRAY low limit), 241
GET (read data from a remote CPU), 755 MAX (get maximum), 227
GET_DIAG (read diagnostic information), 432 MAX_LEN (maximum length of a character
GET_ERROR (get error locally), 289 string), 332
GET_ERROR_ID (get error ID locally), 291 MB_CLIENT, 965
Get_Features (get advanced features), 932 MB_RED_CLIENT, 985
Get_IM_Data (read the identification and MB_RED_SERVER, 1003
maintenance data), 408 MC_CommandTable, 547
GetBlockName (Read out name of the block), 348 MC_Halt (pause axis), 545
GetInstanceName (Read out name of block MC_Home (home axis), 544
instance), 344 MC_MoveAbsolute (position axis absolutely), 545
GetSInstancePath (Query composite global name MC_MoveJog (move axis in jog mode), 547
of the block instance), 346 MC_MoveRelative (position axis relatively), 546
GETSMCInfo, 438 MC_MoveVelocity (move axis at predefined
GetSMCinfo (Reading out information about the velocity), 546
memory card), 438 MC_Power (release/block axis), 543
GetSymbolName (Read out a tag on the input MC_ReadParam (read parameters of a technology
parameter), 339 object), 548
GetSymbolPath (Query composite global name of MC_Reset (confirm error), 544
the input parameter assignment), 342 MC_WriteParam (write to parameters of a
GOTO (SCL), 301 technology object), 548
HTA (convert hexadecimal number to ASCII MID (read the middle characters of a character
string), 330 string), 334
IF-THEN (SCL), 295 MIN (get minimum), 227
IN_Range (value within range), 219 MOD (return remainder of division), 224
INC (increment), 226 Modbus_Comm_Load (Configure SIPLUS I/O or
INSERT (insert characters in a character port on the PtP module for Modbus RTU), 1032
string), 336 Modbus_Master (Communicate using SIPLUS I/O or
INV (create ones complement), 303 the PtP port as Modbus RTU master), 1035
IO2MOD (Determine the hardware identifier from Modbus_Slave (Communicate using SIPLUS I/O or
an I/O address, 500 the PtP port as Modbus RTU slave), 1042
IS_ARRAY (Check for ARRAY), 222 ModuleStates (read module status information of a
IS_NULL (Query for EQUALS zero pointer), 221 module), 427
JMP (jump if RLO = 1), 280 monitor, 1155
JMP_LIST (define jump list), 281 monitoring status or value, 1154
JMPN (jump if RLO = 0), 280 motion control, 541
SRT_DINT (start time-delay interrupt), 392 versions of instructions, 598, 611, 618, 634, 946,
status, 1155 964, 1031, 1071, 1083, 1099
STP (exit program), 289 WHILE (SCL), 298
Strg_TO_Chars (convert character string to array of WR_LOC_T (set local time), 312
CHAR), 328 WR_SYS_T (set time-of-day), 312
STRG_VAL (convert character string to numerical WRIT_DBL (write to data block in load
value), 319 memory), 491
SUB (subtract), 223 WRITE_BIG (Write data in big endian format), 245
SWAP (swap bytes), 240 WRITE_LITTLE (Write data in little endian
SWITCH (jump distributor), 282 format), 245
T_ADD (add times), 310 WRREC (write data record), 352
T_COMBINE (combine times), 311 WWW (synchronizing user-defined Web
T_CONFIG (configure interface), 675 pages), 864
T_CONV (convert times and extract), 309 x box (FBD XOR logic operation), 198
T_DIAG, 644 XOR (logic operation), 302
T_DIFF (time difference), 311 Instructions, legacy
T_RESET, 642 MB_CLIENT (communicate via PROFINET as
T_SUB (subtract times), 310 Modbus TCP client), 1084
TAN (form tangent value), 229 MB_COMM_LOAD (configure port on the PtP
TCON, 619 module for Modbus RTU), 1100
TDISCON, 619 MB_MASTER (communicate via the PtP port as
time, 309 Modbus master), 1103
timer, 205 MB_SERVER (communicate via PROFINET as
TM_MAIL (send email), 1129 Modbus TCP server), 1090
TOF (off-delay timer), 205 MB_SLAVE (communicate via the PtP port as
TON (on-delay timer), 205 Modbus slave), 1108
TONR (on-delay retentive timer), 205 PORT_CFG (configure communication parameters
TP (pulse timer), 205 dynamically), 1056
TRCV, 619 RCV_CFG (configure serial receive parameters
TRCV_C, 599, 694 dynamically), 1059
TRUNC (truncate numerical value), 273 RCV_PTP (enable receive messages), 1065
TSEND, 619 RCV_RST (delete receive buffer), 1067
TSEND_C, 599, 693 SEND_CFG (configure serial transmission
TURCV (receive data via Ethernet (UDP)), 671 parameters dynamically), 1058
TUSEND (send data via Ethernet (UDP)), 671 SEND_PTP (transmit send buffer data), 1063
UFILL_BLK (fill block uninterruptible), 239 SGN_GET (Query RS232 signals), 1068
UMOVE_BLK (move block uninterruptible), 231 SGN_SET (set RS-232 signals), 1069
UPPER_BOUND (read out ARRAY high limit), 242 USS_DRV (Swap data with drive), 1075
USS status codes, 956 USS_PORT (Edit communication via USS
USS_Drive_Control (Swap data with drive), 951 network), 1074
USS_Port_Scan (Edit communication via USS USS_RPM (readout parameters from the
network), 949 drive), 1078
USS_Read_Param (readout parameters from the USS_WPM (change parameters in the drive), 1079
drive), 953 Inter-character gap, 905
USS_Write_Param (change parameters in the Interrupts
drive), 955 ATTACH (attach an OB to an interrupt event), 382
VAL_STRG (convert numerical value to character CAN_DINT (cancel time-delay interrupt), 392
string), 319 DETACH (detach an OB from an interrupt
VARIANT_TO_DB_ANY (Convert VARIANT to event, 382
DB_ANY), 277 interrupt latency, 83
VariantGet (Read VARIANT tag value), 247 overview, 72
VariantPut (Write VARIANT tag value), 248
cooling, 44 Numbers
CPU, 49 binary, 101
dimensions, 47 integer, 102
expansion cable, 56 real, 103
grounding, 59
guidelines, 43
inductive loads, 62 O
isolation, 59
OB, (Organization block)
lamp loads, 61
Off-delay (TOF), 205
overview, 48
OK (check validity), 219
signal board (SB), 51
On-delay delay (TON), 205
signal module (SM), 53
On-delay retentive (TONR), 205
terminal block connector, 55
Online
thermal zone, 44, 47
assigning an IP address, 571
wiring guidelines, 58, 60
capturing and resetting DB values, 1156
MOVE (move value), 231
comparing and synchronizing, 1152
MOVE_BLK (move block), 231
cycle time, 1150
Movement sequence (MC_CommandTable), 547
diagnostics buffer, 1151
MUL (multiply), 223
force, 1160
Multi-node connections
force operation, 1161
connection types, 760
going online, 1141
Ethernet protocols, 760
IP address, 1144
Multiple AWP variable definitions, 860
memory usage, 1150
MUX (multiplex), 305
monitoring status or value, 1154
operating panel, 1150
status, 1155
N time of day, 1144
N (scan operand for negative signal edge), 202 tools, 1154
N_TRIG (scan RLO for negative signal edge), 203 watch table, 1154, 1155, 1157
N= box and N coil (set operand on negative signal Online and diagnostic tools
edge), 202 downloading in RUN mode, 1162
NE_ElemType (Compare data type for UNEQUAL with Online device names
the data type of a tag), 221 PROFINET IO, 1142
NE_Type (Compare data type for UNEQUAL with the OPC UA
data type of a tag), 220 Method calls, 796
NEG (create twos complement), 225 OPC UA Method calls, 796
Nesting depth, 65 OPC UA server
Network communication, 687 activating, 770
bias and terminate cable, 892 companion specifications, 783
Network connection configuration settings, 773
connecting devices, 565 define server interface, 781
multiple CPUs, 690, 692, 695, 742, 747 interfaces, 783
Network time protocol (NTP), 579 PLC nodes,
New features, 35 secuirty overview, 777
No restart, 68 supported data types, 781
NORM_X (normalize), 275 supported node types, 781
Normalizing analog values, 276 supported security policies, 777
Normally open/closed coil, 199 trusted clients, 779
Normally open/closed contact, 197 user authentication, 779
NOT (invert RLO), 198 OPC, configuration, 1125
NOT_NULL (Query for UNEQUALS ZERO pointer), 221
NOT_OK (check invalidity), 219
RTM (runtime meters), 316 Transferring the process image area with
startup processing, 70 SETIO_PART, 358
system design, 165 Writing outputs with SETIO, 356
tags, 94 PROFIBUS
terminal block connector, 55 add CM 1243-5 (DP master) module, 742
time synchronization property, 579 add DP slave, 742
using blocks, 166 address, 743
watch table, 1157 address, configuring, 743
PM 1207 power module, 1360 CM 1242-5 (DP slave) module, 739
PN slave CM 1243-5 (DP master) module, 740
Activating and deactivating with D_ACT_DP, 362 distributed I/O instructions, 350
Pointers DPNRM_DG (read diagnostic data from a DP
Variant data type, 109 slave), 378
Point-to-Point communication, 894 DPRD_DAT (read consistent data of a DP standard
Point-to-Point programming, 934 slave), 371
POKE, POKE_BOOL, POKE_BLK, 184, 244 DPWR_DAT (write consistent data of a DP standard
Polling architecture, 935 slave), 371
Polution degree, 1189 GET (read data from a remote CPU), 755
Port configuration, 897 master, 739
errors, 915, 1057 network connection, 565, 742
instructions, 934 number of communication connections, 561
PtP example program, 937 PUT (write data to a remote CPU), 755
Port configuration, 3964(R), 909 RALRM (receive interrupt), 359
Port numbers RDREC (read data record), 352
assigning to communication partners, 581 S7 connection, 760
restricted, 687 slave, 739
PORT_CFG (configure communication parameters WRREC (write data record), 352
dynamically), legacy, 1056 PROFIBUS and PROFINET
Port_Config (port configuration), 913 DeviceStates example, 424
Portal view, 39 ModuleStates example, 429
Potentiometer module PROFIenergy, 380
specifications, 1358 Profile OB, 81
Power budget, 44 PROFINET
example, 1364 ad hoc mode, 584
form for calculations, 1365 configuring communication between CPU and HMI
overview, 1363 device, 689
Power supply module configuring the IP address, 143
PM1207, 1360 connection IDs, 584
Priority CPU-to-CPU communication, 691
priority class, 72 device naming and addressing, 581
priority in processing, 83 distributed I/O instructions, 350
Process image DPRD_DAT (read consistent data of a standard DP
force, 1160 slave), 371
force operation, 1161 DPWR_DAT (write consistent data of a DP standard
monitor, 1155 slave), 371
monitoring status or value, 1154 Ethernet address properties, 573
Reading inputs with GETIO, 355 GET (read data from a remote CPU), 755
Reading the process image area with IP address, 572
GETIO_PART, 357 IP address assignment, 581
status, 1155, 1160 MAC address, 572
network connection, 565, 690, 692, 695
number of communication connections, 561
String TCP
S_MOVE (move character string), 319 ad hoc mode, 584
string data overview, 318 connection configuration, 566
String data type, 106 connection IDs, 584
string operations overview, 331 parameters, 586
Structured programming, block structure, 166 protocol, 581
SUB (subtract), 223 TCP/IP communication, 581
Subnet mask, 573 TDISCON, 619
Support, 3 Technical specifications, 1183
Suppressor circuits for inductive loads, 62 Technical support, 3
Surge immunity, 1187 Technology instructions, 512, 537
SWAP (swap bytes), 240 Technology module, SM 1278 4xIO-Link
SWITCH (jump distributor), 282 Master, 1299
Switching languages, user-defined Web pages, 878 Telecontrol, 1121
Synchonizing data block start values, 191 TeleControl
Synchronization communication processors, 1117
time synchronization property (PROFINET), 579 Teleservice communication
System clock TM_MAIL (send email), 1129
RD_SYS_T (read time-of-day), 312 TeleService via GPRS, 1121
WR_LOC_T (set local time), 312 Temp memory
WR_SYS_T (set time-of-day), 312 maximum per OB priority level, 97
System memory byte, 91 usage by blocks, 97
System requirements, 37 Terminal block connector, 55, 1372
Terminal emulator for PtP example program, 943
Testing the program, 194
T Thermal zone, 44, 47
Thermocouple
T_ADD (add times), 310
basic operation, 1290, 1331
T_COMBINE (combine times), 311
cold junction compensation, 1290, 1331
T_CONFIG (configure interface), 675
SB 1231 AI 1 x 16 bit, 1329
T_CONV (convert times and extract), 309
SB 1231 Filter selection table, 1332
T_DIAG, 644
SB 1231 Thermocouple filter selection table, 1331
T_DIFF (time difference), 311
SM 1231 Thermocouple filter selection
T_RESET, 642
table, 1290
T_SUB (subtract times), 310
SM 1231 Thermocouple selection table, 1290
Tablet, accessing Web server, 811
TIA Portal, Portal view and Project view, 39
Tag
Time
force operation, 1161
DTL (date and time long data type), 104
monitoring status or value, 1154
RD_LOC_T (read local time), 312
overlay, 111
RD_SYS_T (read time-of-day), 312
slice, 109
SET_TIMEZONE (set time zone), 315
Tag status standard Web page, 833
T_ADD (add times), 310
TAN (form tangent value), 229
T_COMBINE (combine times), 311
Task cards
T_CONV (convert times and extract), 309
columns and headers, 598, 611, 618, 634, 946,
T_DIFF (time difference), 311
964, 1031, 1071, 1083, 1099
T_SUB (subtract times), 310
TCON, 619
Time data type, 104
configuration, 566
TOD (time of day data type), 104
connection IDs, 584
WR_LOC_T (set local time), 312
connection parameters, 586
WR_SYS_T (set time-of-day), 312
TCON, TDISCON, TSEND, and TRCV
Time delay OB, 73
versions, 618, 634
Time error interrupt OB, 75
TCON_Param, 586
SB 1231, 1324
SB 1231 RTD, 1336
SB 1231 thermocouple, 1333
SB 1232, 1326
SM 1221, 1258
SM 1222, 1262
SM 1223, 1269, 1274
SM 1231, 1277
SM 1231 RTD, 1294
SM 1231 thermocouple, 1288
SM 1232, 1280
SM 1234, 1283
SM 1278 IO-Link Master, 1301
Wiring guidelines, 60
clearance for airflow and cooling, 44
grounding, 59
prerequisites, 58
Work memory, 28
CPU 1211C, 1193
CPU 1212C, 1204
CPU 1214C, 1216
CPU 1215C, 1227
CPU 1217C, 1241
WR_LOC_T (set local time), 312
WR_SYS_T (set time-of-day), 312
WRIT_DBL (write to data block in load memory), 491
WRITE_BIG (Write data in big endian format), 245
WRITE_LITTLE (Write data in little endian
format), 245
Writing to DBs, I/O, or memory, 184, 244
WRREC (write data record), 352, 367
WString (word string data type), 106
WWW (synchronizing user-defined Web pages), 864
X
x box (FBD EXCLUSIVE OR logic operation), 198
XON / XOFF, 900
XOR (logic operation), 302