Collection of useful information for beginner and no beginner Step 7 programing engineers.
42
The Case of the Missing SIMATIC Step 7 Documentation http://www.plcdev.com/book/export/html/410[14/12/2015 09:15:38 p.m.] The Case of the Missing SIMATIC Step 7 Documentation “We had documentation at one time.” Sound familiar? Have you suddenly found changes that have been made in the PLC but not in the offline program? Nobody knows what happened. Unfortunately this is an all too common phenomena with the Siemens SIMATIC Step 7 software. The problems stem from the flexibility of the software both for downloading and editing the online program. If the person is not familiar with the software it’s very easy to get confused if the changes are being made on the computer or in the controller. How to solve this problem? Let’s first of all review some basic terminology. After that is a step by step best practice when editing programs. Finally, we’ll highlight the pitfalls and the indicators that tell you whether you are offline or online. This procedure applies to SIMATIC Step 7 version 5.4. Terminology Offline program – The program that is stored on the hard disk of the computer. This will contain the documentation. It’s very important to keep a pristine copy of the offline program as the associated documentation is not stored in the PLC. Online program – This is the program resident in the PLC. Download – The act of taking the offline program on the computer and downloading it into the PLC. Upload – Taking the program in the PLC and bringing it up to the computer. Doing this without having the associated offline program open will cause a loss of documentation.
Transcript
The Case of the Missing SIMATIC Step 7 Documentation
The Case of the Missing SIMATIC Step 7Documentation“We had documentation at one time.”
Sound familiar? Have you suddenly found changes that have been made in the PLC but not inthe offline program? Nobody knows what happened.
Unfortunately this is an all too common phenomena with the Siemens SIMATIC Step 7software. The problems stem from the flexibility of the software both for downloading andediting the online program. If the person is not familiar with the software it’s very easy to getconfused if the changes are being made on the computer or in the controller.
How to solve this problem? Let’s first of all review some basic terminology. After that is a stepby step best practice when editing programs. Finally, we’ll highlight the pitfalls and theindicators that tell you whether you are offline or online. This procedure applies to SIMATICStep 7 version 5.4.
Terminology
Offline program – The program that is stored on the hard disk of the computer. This willcontain the documentation. It’s very important to keep a pristine copy of the offline programas the associated documentation is not stored in the PLC.
Online program – This is the program resident in the PLC.
Download – The act of taking the offline program on the computer and downloading it intothe PLC.
Upload – Taking the program in the PLC and bringing it up to the computer. Doing thiswithout having the associated offline program open will cause a loss of documentation.
Save – Stores the open block onto the hard drive. It’s important to realize that an edited blockcan be downloaded to the PLC without saving it offline. Note that this only saves the openedblock and not any others that are concurrently open.
These may seem like simple terms but it’s important to understand how they’re used in theSiemens environment.
Here are some other terms that may come up.
PG/PC – This is Siemens way of referring to a PC or laptop running the SIMATIC software.
Nodes – Refers to any programmable device (in our case a PLC) in the network which willhave its own unique address.
Best Practice
The best practice is to make sure you are working from an offline file. There really isn’t anyreason to be working on the program inside the PLC. Of course, this assumes that you have agood working copy to begin with. The “golden” copy of the program should live somewhere ona network server or have a dedicated place on one computer or laptop. I’ve even heard ofsome companies using USB memory sticks to store the latest and greatest which is great but anoriginal copy should still live on a computer that is backed up.
1. Open the offline file from the File pull down menu and select Open or use the Open Project icon on the toolbar. In the dialog box select the projectunder the User Project tab. Click OK. You may have to select Browse to find it in thedirectory structure. Note if the Manager was closed with a project open then it will openback up to that project automatically.
2. Expand the project tree down to the program files and select the Blocksfolder. Good practice dictates that all blocks should be opened from here.
3. Once changes have been made:1. Save the block to the hard disk by clicking the Save icon (or menu item
The Case of the Missing SIMATIC Step 7 Documentation
File | Save)2. Download the block by clicking the Download icon (or menu item PLC |
Download). If the block all ready exists in the PLC then it will confirm that you wantto overwrite it1. Click Yes.
3. Note that downloading from here only sends that one block to the PLC. It does notdownload the entire program.
4. To monitor the block make sure to open it using steps 1 through 3 and thenpress the Monitor icon (or menu item Debug | Monitor). The window’s title bar willhighlight a lovely shade of blue to indicate a connection to the CPU. It’s important tonote here that you are still working with the program on the computer and not the PLC. If the procedure in step 3 has not been followed then discrepancies can occur betweenwhat you are monitoring in the PLC and what is displayed in the SIMATIC software.
That’s it. Following these simple steps will save a lot of headaches.
The Pitfalls and Warning Signs
So where do some people get lost? Here are some common mistakes and their warning signs. If you get any of these dialog boxes then you should really back out and start over becauseyou’re on the road to losing your documentation.
These dialog boxes are telling you that it cannot find the documentation for the localparameters and symbols. More then likely it will also not show any network comments or titles.
The result of opening the block looks like this
The Case of the Missing SIMATIC Step 7 Documentation
This is an example void of documentation. Notice the local parameters all say TEMP. Thereare no comments or titles. There are no symbols so it’s all in direct addressing. The properlydocumented copy looks like this...
Pitfall #1 – Using Accessible Nodes to Open Blocks
The Display Accessible Nodes selection under the PLC menu is a handy way to see what isconnected to the network but it should never be used to open blocks. Opening blocks fromhere uploads it straight from the PLC and produces the warnings dialog boxes shown above.
The Case of the Missing SIMATIC Step 7 Documentation
Once a project is open and a connection to a PLC is established then selecting the Onlinebutton (menu View | Online) brings up a similar project tree showing the contents insidethe PLC. The window title bar is highlighted in blue to indicate its online status. Working fromthis window presents less of a danger for losing documentation but it is confusing and couldlead to problems. For instance if a block is renamed offline and then the old one is openedonline then it will have no associated documentation.
The proper way to view a block online is to open the block and select the Establish Connectionto Configured CPU icon . Just make sure what you are viewing has been downloaded to thePLC.
The Case of the Missing SIMATIC Step 7 Documentation
If an offline block is open then selecting the Open Offline/Online Partner icon (menu itemFile | Open Online) will switch it to the online version of the block for editing. Essentially thisputs you in the same place as pitfall #2.
Conclusion
Programming with SIMATIC Step 7 is different enough from other types of PLCs to throw offthe casual user. Always working from the offline copy will make it less likely to screw up. Opening up a block from the accessible nodes window is always a no-no. Likewise, opening ablock from a window that has a highlighted blue title bar will also cause potential problems. Besure and read all dialog boxes especially the ones we’ve shown in the article. Avoid the pitfallsand keep that documentation. Mystery solved.
Footnote:
(1) Siemens dialog boxes have an option that says, “Do not display this message again.” This
The Case of the Missing SIMATIC Step 7 Documentation
is handy for some annoying pop ups but it is really not a good idea to turn off important oneslike warnings for overwriting blocks. These warnings are especially crucial if you are workingon real machinery. If more then one person is using the software then you can reset thesemessages to display again by going to the SIMATIC Manager and select the menu Options |Customize. Click the General tab and press the Activate button. If it’s grayed out then allmessages are set to display.
S7 Library FunctionsI couldn't find a complete listing of all the function blocks in the standard Siemens S7 Librariesso I made one myself. It helps me get a better overview of what is available. The completelisting is also available as an Excel spreadsheet so you can sort or adjust to your needs.
System Function Blocks
Number Name Family Description
SFB 0 CTU IEC_TC Count Up
SFB 1 CTD IEC_TC Count Down
SFB 2 CTUD IEC_TC Count Up/Down
SFB 3 TP IEC_TC Generate a Pulse
SFB 4 TON IEC_TC Generate an On Delay
SFB 5 TOF IEC_TC Generate an Off Delay
SFB 8 USEND COM_FUNC Uncoordinated Sending of Data
SFB 9 URCV COM_FUNC Uncoordinated Receiving of Data
SFB 12 BSEND COM_FUNC Sending Segmented Data
SFB 13 BRCV COM_FUNC Receiving Segmented Data
SFB 14 GET COM_FUNC Read Data from a Remote CPU
SFB 15 PUT COM_FUNC Write Data to a Remote CPU
SFB 16 PRINT COM_FUNC Send Data to Printer
SFB 19 START COM_FUNC Initiate a Warm or Cold Restart on a Remote Device
SFB 20 STOP COM_FUNC Changing a Remote Device to the STOP State
SFB 21 RESUME COM_FUNC Initiate a Hot Restart on a Remote Device
SFB 22 STATUS COM_FUNC Query the Status of a Remote Partner
SFB 23 USTATUS COM_FUNC Receive the Status of a Remote Device
SFB 29 HS_COUNT COUNTERS Counter (high-speed counter, integrated function) (onlyexist on the CPU 312 IFM and CPU 314 IFM)
SFB 30 FREQ_MES COUNTERS Frequency Meter (frequency meter, integrated function(only exist on the CPU 312 IFM and CPU 314 IFM)
SFB 31 NOTIFY_8P COM_FUNC Generating block related messages withoutacknowledgement indication
SFB 32 DRUM TIMERS Implement a Sequencer
SFB 33 ALARM COM_FUNC Generate Block-Related Messages with AcknowledgmentDisplay
SFB 34 ALARM_8 COM_FUNC Generate Block-Related Messages without Values for 8
FC 24 LT_STRNG IEC Compare STRING for smaller than
FC 25 MAX IEC Point Math Select maximum
FC 26 MID IEC Middle part of a STRING variable
FC 27 MIN IEC Point Math Select minimum
FC 28 NE_DT IEC Compare DT for unequal
FC 29 NE_STRNG IEC Compare STRING for unequal
FC 30 R_STRNG IEC Data type conversion REAL to STRING
FC 31 REPLACE IEC Replace in a STRING variable
FC 32 RIGHT IEC Right part of a STRING variable
FC 33 S5TI_TIM IEC Data type conversion S5TIME to TIME
FC 34 SB_DT_DT IEC Point Math Subtract two time values
FC 35 SB_DT_TM IEC Point Math Subtract duration from a time
FC 36 SEL IEC Point Math Binary selection
FC 37 STRNG_DI IEC Data type conversion STRING to DINT
FC 38 STRNG_I IEC Data type conversion STRING to INT
FC 39 STRNG_R IEC Data type conversion STRING to REAL
FC 40 TIM_S5TI IEC Data type conversion TIME to S5TIME
PID Control Blocks
Number Name Family Description
FB 41 CONT_C ICONT Continuous Control
FB 42 CONT_S ICONT Step Control
FB 43 PULSEGEN ICONT Pulse Generation
FB 58 TCONT_CP CONTROL Temperature Continuous Controller
FB 59 TCONT_S CONTROL Temperature Step Controller
Communication Blocks
Number Name Family Description
FB 2 IDENTIFY CP_300 For checking deviceproperties
FB 3 READ CP_300 Reads data from a data area of the communicationpartner specified by a name or index depending on theassignment of parameters for the job.
FB 4 REPORT CP_300 Allows unconfirmed transmission of variables by anFMS server.
FB 5 STATUS CP_300 allows status information to be requested from the
FC 100 RSETI BIT_LOGC Reset Range of Immediate Outputs
FC 101 SETI BIT_LOGC Set Range of Immediate Outputs
FC 102 DEV MATH_FP Standard Deviation
FC 103 CDT TABLE Correlated Data Table
FC 104 TBL_TBL TABLE Table to Table
FC 105 SCALE CONVERT Scaling Values
FC 106 UNSCALE CONVERT Unscaling Values
Miscellaneous Blocks
Number Name Family Description
FB 60 SET_SW TIMEFUNC supports the summertime/wintertime changeover in CPUsthat do not have the time status. For this purpose it setsthe CPU clock to the current time and according to thechangeover rules in the Control DB.
FB 61 SET_SW_S TIMEFUNC supports the summertime/wintertime changeover in CPUsthat do have the time status. For this purpose it sets thetime status to the current time and according to thechangeover rules in the Control DB.
FB 62 TIMESTMP TIMEFUNC transfers the time-stamped messages of an IM153-2 intoits instance DB.
FC 60 LOC_TIME TIMEFUNC reads the time status or time of the CPU and calculates thelocal time. It is therefore only useful on CPUs with timestatus.
FC 61 BT_LT TIMEFUNC calculates the local time from the base time given at theinput.
FC 62 LT_BT TIMEFUNC calculates the base time from the local time given at the
Underscores in time and date are optionalIt is not required to specify all time units (for example: T#5h10s is valid)Maximum time value = 9,990 seconds or 2H_46M_30S
Siemens S7 Indirect Addressingby Automation Training
The following is provided by Automation Training from their excellent Siemens Step 7 trainingmanual. This is a really nice explanation of a difficult but important subject. Check out theirwebsite for hands-on and online training classes.
Introduction
The most common form of addressing used in the Siemens S7 PLCs is direct and symbolic.When a direct addressed is referenced by an instruction there is no question as to the locationin memory. The following are examples of direct addressing:
Inputs: I4.0, IB4, IW4 , ID4
Outputs: Q124.0, QB124, QW124, QD124
Markers: M11.0, MB10, MW10, MD10
Timers: T34
Counters: C23
Local: L0.0, LB1, LW2, LD4
Data Block: DB5.DBX2.0, DB5.DBW6, DBD8
By using the methods of indirect addressing the address used by an instruction can be varied topoint to any number of locations. In this case, a memory location stores a “pointer†toanother memory location. While this may increase the difficulty of troubleshooting, itsadvantage is to greatly reduce the number of networks and instructions needed to control aprocess. It is also a method that must be understood to use some of the library and systemfunction calls provided by Siemens.
A POINTER data type is used to format a number to be accepted as an address rather then avalue. A pointer is always preceded by a P# symbol. The pointer address may be in threedifferent formats.
Format Example Memory Storage
P#<byte>.<bit> P#8.0P#124.3
4 Bytes
P#<area><byte>.<bit> P#M50.0P#I4.0
6 Bytes
P#<area><byte>.<bit><length> P#DB25.DBX0.0 BYTE 14P#M0.0 WORD 2P#I0.0 DWORD 5
10 Bytes
The ANY data type is used to pass a parameter of an unknown or undefined data type. Somefunctions in the library use the ANY data type to work on whole sections of memory. To dothis, the last pointer method is used to describe an area. For example the address P#DB25.DBX0.0 Byte 14 points to the first byte of DB25 with a length of 14 bytes.
NOTE: A DINT can be converted to a POINTER by simply shifting the double word left by 3 bits.
Data Block Instructions
When working with indirect addressing it is sometimes needed to first of all open a DB and thenbegin working on theaddress without directly referring to any one DB. This is done using the OPN instruction. TheOPN instruction can open either a shared data block (DB) or an instance data block (DI).
OPN DB 10 //Open DB10 as a shared data block
L DBW 36 //Load data word 36 of DB10 into ACCU1
T MW 22 //Transfer the contents of ACCU1 into MW22
OPN DI 20 //Open DB20 as an instance data block
L DIB 12 //Load data byte 12 from DB20 into ACCU1
T DBB 37 //Transfer the contents of ACCU1 to data//byte 37 of the open shared data block DB10
When monitoring in STL the shared DB number is displayed in the DB1 column and theinstance DB number is displayed in the DB2 column.
Furthermore, there are instructions to confirm that the correct DB number is opened and that itis large enough for the next operation.
L DBNO //Loads the number of the opened //shared data block into ACCU1
L DBLG //Loads the length of the opened//shared data block into ACCU1
L DINO //Loads the number of the opened//instance data block into ACCU1
L DILG //Loads the length of the opened//instance data block into ACCU1
Memory Indirect Addressing
The first method of indirect addressing is called memory indirect addressing because it allowsfor a memory location (M, DB or L) to determine or point to another.
The memory area identifiers T, C, DB, DI, FB and FC use a word (16-bit) pointer location ininteger format. Two examples are as follows:
L 5 //Load ACCU1 with pointer value
T MW 2 //Transfer pointer into MW2
L T [MW 2] //Load ACCU1 with T5 current time value
OPN DB [#DB_Temp] //Open DB whose data block number is //from the interface temp parameter //named DB_Temp
The memory area identifiers I, Q, M, L, DB use a double word (32-bit) location using thePOINTER data type.
L P#0.7 //Load ACCU1 with pointer value
T MD 2 //Transfer pointer into MD2
A I [MD 2] //Check state of I0.7
= M [MD 2] //Assign value of RLO to M0.7
OPN DB 5 //Open DB5
L P#2.0 //Load pointer into ACCU1
T #TempPointer //Transfer pointer to temp location
L DBW [#TempPointer] //Load the value at DB5.DBW2 into ACCU1
L 0 //Load a zero into ACCU1
>D //Check if the value is greater //then zero
When monitoring memory indirect addressing the INDIRECT column displays the currentaddress the instruction is using.
Note that math can be done on the POINTER data type using the double math instructions(e.g. P#2.0 + P#5.0 = P#7.0).
L P#2.0 //Load ACCU1 with pointer value
L P#5.0 //Load ACCU1 with secondpointer value
+D
T MD 0 //MD0 now contains the value P#7.0
Since the bit position only goes to eight the result of P#8.7 + P#1.1 = P#10.0 and not P#9.8.These methods can be used to offset the address or increase/decrease the pointer in a loop.
The Address Registers
Besides the regular accumulators, there are two 32-bit address registers (AR1, AR2) for storingpointers used in register indirect addressing methods. A series of different load and transfertype instructions can be used to work with AR1. A similar set is available for AR2.
STL Description
LAR1 Loads AR1 with the contents of ACCU1
LAR1 P#M100.0 Loads AR1 with a pointer constant
LAR1 MD24 Loads AR1 with the pointer in MD24
LAR1 AR2 Loads AR1 with the contents of AR2
TAR1 Transfers the contents AR1 into ACCU1
TAR1 MD28 Transfers the contents in AR1 to a memory location
Addition can be directly accomplished on AR1 and AR2 with the following:
STL Description
+AR1 Adds the contents of ACCU1 to AR1 and stores the result back intoAR1
+AR1 P#100.0 Adds the pointer constant to AR1 and stores the result back into AR1
Area-Internal Register Indirect Addressing
The area-internal register indirect addressing method uses one of the address registers plus apointer to determine the address the instruction is to reference. The format is:
address identifier [address register, pointer]
The address identifier can be I, Q, M, L, DI or DB in bit, byte, word or double word form. Theaddress register must be previously loaded with a double word pointer without reference to theaddress identifier. The exact address is determined by adding the address register with thepointer. The example below shows the area-internal method using bit locations.
L P#0.7 //Load ACCU1 with pointer value
LAR1 //Load AR1 with pointer in ACCU1
A I [AR1, P#0.0] //Check input I0.7
= Q [AR1, P#1.1] //If RLO=1 turn on Q2.0
Area-Crossing Register Indirect Addressing
Area-crossing register indirect addressing is similar to the area-internal method except thepointer loaded into the address register references a memory area (e.g. P#M10.0 orP#DBX0.0). This means the address identifier used before the opening bracket is not needed ifreferencing a bit otherwise it will be a B for byte, W for word or D for double. The examplebelow shows the area-crossing method using bit locations.
This next example shows area-crossing methods using a word and double word format.
L P#M0.0 //Load ACCU1 with pointer value
LAR1 //Load AR1 with pointer in ACCU1
L W [AR1,P#10.0]
//Load the word whose address is //determined by the contents of //AR1 plus 10 bytes (MW10) into ACCU1
OPN DB 5 //Open DB5
L P#DBX 0.0 //Load ACCU1 with pointer value
LAR2 //Load AR2 with pointer in ACCU1
L L#0 //Load zero into ACCU1
T D [AR2,P#50.0]
//Transfer the value in ACCU1 to the //double word whose exact location is //the address in AR2 plus 50 bytes //(DB5.DBD50)
Exercise #1
1. Comment the lines of STL below to describe what this network does:
A I 0.0
JC M001
L P#M10.0
JU M002
M001: L P#Q0.0
M002: LAR1
A I 0.1
= [AR1, P#0.1]
2. Enter the code, monitor it and verify your answers.
Exercise #2 (Advanced)
1. Create a DB with an array of 10 real numbers. Populate the array with random values.2. Create a function that will return the max number in the array and its position. Use the
Siemens S7 Status WordIn Siemens PLCs the Status Word is an internal CPU register used to keep track of the state ofthe instructions as they are being processed. In order to use STL more effectively it isimportant to understand the Status Word and its functions.
Each bit in the Status Word has a specific function to keep track of bit logic (RLO, STA), math(OV, OS), comparison operations (CC0, CC1) and whether the logic should continue, be nestedor start new (/FC, OR, BR). Only the first 9 of the 16 bits are used.
Bit Positions
8 7 6 5 4 3 2 1 0
BR CC0 CC1 OV OS OR STA RLO /FC
Each instruction may do the following to each bit in the status word.
- No read or write
* Read
x May write "1" or "0"
0 Reset to "0"
1 Set to "1"
The status word can be seen by displaying the STATUS column while monitoring in STL view. The RLO (bit 1) and the STA (bit 2) are also displayed in the RLO and STA column.
If the /FC bit is a 0 then the instruction is considered to be the first instruction beingprocessed. If the /FC is a 1 then the instruction being scanned will use the logic from theprevious instruction. Certain instructions like =, S and R will set the /FC bit to 0 thus startingnew logic after it. Other instructions like A or O will set the /FC bit to 1 signalling to combinethe logic with the next instruction.
RLO – Result of Logic Operation (bit 1)
The RLO bit stores the running logic state of the currently processing instructions. Certain bitlogic and comparison instruction will turn the RLO to a 1 when the condition is TRUE and writea 0 when the condition is FALSE. Other instructions read the RLO (=, S, R) to determine howthey are to execute.
STA – Status (bit 2)
The STA bit reflects the state of the current Boolean address.
Help with RLO, STA and /FC
If you are used to ladder logic and struggling to understand the purpose of the RLO and STA itmay help to visualize a rung like below. The STA is used to keep track of the state of theaddresses. The RLO is used to keep track of the state of the rung.
The equivalent STL is shown below.
It steps through the logic as follows:
1. At the start the First Check bit (/FC) is zero so an And instruction will logically mirror theStatus bit (STA) over to the Result of Logic Operation (RLO). In this case the addressI0.0 is 1 so the STA is one and the result of the logic (RLO) will be 1. The A instructionwrites a 1 to /FC.
2. On the second line, the /FC bit is now 1 indicating that this line needs to use the RLOfrom the previous line. The address I1.1 is on so the STA = 1. The RLO from the lastline is 1 and this is ‘anded’ with the current STA with a result of 1 in the currentRLO.
3. The same thing happens on the second line but this time 1 and 0 makes the current RLO= 0.
4. The fourth is the Assign instruction which takes the RLO and writes it out to thecorresponding address. In this case the final RLO = 0 so the output will be off. IfM0.0 was 1 then the “And†operation will evaluate to true making the RLO = 1 whichwill then turn on the output Q1.0.
The Other Status Bits
OR (bit 3)
The OR bit is used for combining AND functions before OR functions.
OS – Overflow Stored (bit 4)
In the event of an overflow (OV bit 5) the OS bit will store the value even after the OV bit hasbeen reset. The following commands reset the OS bit: JOS (Jump if OS=1), block callinstructions, block end instructions.
OV – Overflow (bit 5)
The OV bit is set by a math instruction with floating point numbers after a fault has occurred(overflow, illegal operation, comparison unordered). The OV bit is reset when the fault iseliminated.
The Binary Result transfers the result of the operationsonto the next instruction for reference. When the BR bit is 1 it enables the outputof the block (ENO) to be TRUE and thus allow other blocks after it to beprocessed. The SAVE, JCB and JNB instructions set the BR bit.
